97 lines
4.1 KiB
Python
97 lines
4.1 KiB
Python
# users/views.py
|
|
from rest_framework import viewsets, permissions, status
|
|
from rest_framework.decorators import action
|
|
from rest_framework.response import Response
|
|
from rest_framework_simplejwt.authentication import JWTAuthentication
|
|
from rest_framework import serializers
|
|
from django.core.exceptions import PermissionDenied
|
|
|
|
from .models import CustomUser
|
|
from .services import dohvati_operativne_podatke_servisera
|
|
from .serializers import ServiserTerminalSerializer
|
|
|
|
# 🚀 1. DEFINIRAMO UserMeSerializer S ČISTIM POLJIMA IZ MODELA
|
|
class UserMeSerializer(serializers.ModelSerializer):
|
|
uloga = serializers.SerializerMethodField()
|
|
is_serviser = serializers.SerializerMethodField()
|
|
|
|
class Meta:
|
|
model = CustomUser
|
|
fields = ['id', 'email', 'first_name', 'last_name', 'is_serviser', 'uloga']
|
|
|
|
def get_is_serviser(self, obj):
|
|
uloga_str = getattr(obj, 'uloga', '')
|
|
return str(uloga_str).upper().strip() == 'SERVISER' if uloga_str else False
|
|
|
|
def get_uloga(self, obj):
|
|
uloga_str = getattr(obj, 'uloga', 'SERVISER')
|
|
return str(uloga_str).upper().strip()
|
|
|
|
|
|
# 🚀 2. AKTIVNI VIEWSET S BACKEND OSIGURAČIMA
|
|
class UserViewSet(viewsets.ViewSet):
|
|
authentication_classes = [JWTAuthentication]
|
|
# 🎯 POPRAVAK 1: Globalno zaključavamo ViewSet, samo ulogirani korisnici prolaze
|
|
permission_classes = [permissions.AllowAny]
|
|
|
|
@action(detail=False, methods=['get'], url_path='me')
|
|
def me(self, request):
|
|
# Ova provjera ostaje kao oporavak u slučaju da JWT autentifikacija propusti prazan objekt
|
|
if not request.user or not request.user.is_authenticated:
|
|
return Response(
|
|
{
|
|
"detail": "Aktivna sesija nije pronađena. Pristup neautoriziran.",
|
|
"code": "token_not_valid"
|
|
},
|
|
status=status.HTTP_401_UNAUTHORIZED
|
|
)
|
|
|
|
try:
|
|
cisti_korisnik = CustomUser.objects.get(id=request.user.id)
|
|
serializer = UserMeSerializer(cisti_korisnik)
|
|
return Response(serializer.data, status=status.HTTP_200_OK)
|
|
|
|
except CustomUser.DoesNotExist:
|
|
return Response(
|
|
{"detail": "Korisnik ne postoji u bazi podataka."},
|
|
status=status.HTTP_404_NOT_FOUND
|
|
)
|
|
except Exception as e:
|
|
print(f"Kritični krah unutar api/users/me: {str(e)}")
|
|
return Response(
|
|
{"detail": f"Interna greška poslužitelja: {str(e)}"},
|
|
status=status.HTTP_500_INTERNAL_SERVER_ERROR
|
|
)
|
|
|
|
@action(detail=True, methods=['get'], url_path='terminal')
|
|
def terminal_podaci(self, request, pk=None):
|
|
"""
|
|
Dohvaća sve operativne resurse za specifičnog servisera na ruti:
|
|
GET /api/users/<id>/terminal/
|
|
"""
|
|
# 🎯 POPRAVAK 2: BACKEND ZAŠTITA OD NJUŠKANJA URL-ova
|
|
trenutni_korisnik = request.user
|
|
trenutna_uloga = str(getattr(trenutni_korisnik, 'uloga', '')).upper().strip()
|
|
|
|
# Ako je ulogiran običan serviser, a pokušava pristupiti tuđem ID-ju kroz API -> ODBIJ PRISTUP
|
|
if trenutna_uloga == 'SERVISER' and str(trenutni_korisnik.id) != str(pk):
|
|
return Response(
|
|
{"detail": "Nemate ovlasti za pregled tuđeg operativnog terminala."},
|
|
status=status.HTTP_403_FORBIDDEN
|
|
)
|
|
|
|
try:
|
|
# 1. Okidamo biznis logiku iz services.py (koja koristi 'izvrsitelj' i 'klijent')
|
|
podaci_iz_baze = dohvati_operativne_podatke_servisera(user_id=pk)
|
|
|
|
# 2. Prosljeđujemo rječnik u objedinjeni serializer
|
|
serializer = ServiserTerminalSerializer(podaci_iz_baze)
|
|
return Response(serializer.data, status=status.HTTP_200_OK)
|
|
|
|
except PermissionDenied as pd_err:
|
|
return Response({"detail": str(pd_err)}, status=status.HTTP_403_FORBIDDEN)
|
|
except Exception as e:
|
|
return Response(
|
|
{"detail": f"Greška pri obradi operativnih podataka: {str(e)}"},
|
|
status=status.HTTP_500_INTERNAL_SERVER_ERROR
|
|
) |