8 Commits
Author SHA1 Message Date
Keith Smith 53180a9469 Disable self-registration by default 2026-04-15 17:42:40 -06:00
Keith SmithandClaude Sonnet 4.5 ab06bc4fc9 Add API root endpoint for /api/users/
Added UsersAPIRoot view that returns available user-related
endpoints when accessing /api/users/ directly.

All API endpoint groups now have discoverable root endpoints:
- /api/ - Main API root
- /api/users/ - User endpoints
- /api/tasks/ - Task endpoints (already had TaskListCreateAPIView)
- /api/sync/ - Sync endpoints (already had sync view)
- /api/notifications/ - Notification endpoints (already had NotificationListAPIView)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2025-12-26 17:26:50 -07:00
Keith SmithandClaude Sonnet 4.5 6eb277c701 Fix authentication: allow superusers to bypass email verification and approval
The authentication backend was requiring ALL users (including superusers)
to have email_verified=True and is_approved=True. This created a
chicken-and-egg problem where the first superuser couldn't log in to
approve themselves.

Now superusers bypass these checks and can log in immediately after
creation via createsuperuser command. Regular users still require
email verification and admin approval.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2025-12-26 17:14:46 -07:00
Keith SmithandClaude Sonnet 4.5 a03b9fe79c Fix MEDIUM-HIGH Security Issue: Add rate limiting to sensitive endpoints
Added rate limiting to previously unprotected user-related endpoints.

Protected Endpoints:
- UserProfileAPIView: Profile retrieval and updates (1000 req/hour)
- ChangePasswordAPIView: Password change operations (1000 req/hour)
- DeviceTokenAPIView: Device token registration (1000 req/hour)
- DeviceTokenDeleteAPIView: Device token deletion (1000 req/hour)

Changes:
- Added UserRateThrottle import from rest_framework.throttling
- Applied throttle_classes = [UserRateThrottle] to all 4 endpoints
- Inherits default rate of 1000 requests/hour per user from base settings

Security impact:
- Prevents brute force attacks on password changes
- Mitigates enumeration attacks via profile endpoint
- Protects against DoS via excessive device token registration
- Complements existing login/register rate limiting

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2025-12-23 06:24:35 -07:00
Keith SmithandClaude Sonnet 4.5 5d9c901918 Fix HIGH Security Issue: Add file upload validation for avatars
Added comprehensive validation for avatar file uploads to prevent malicious file uploads.

Validation Checks:
- File extension: Only allow jpg, jpeg, png, gif
- File size: Maximum 5MB
- Content type: Verify MIME type matches allowed image types

Changes:

users/serializers.py:
- Added MAX_AVATAR_SIZE constant (5MB)
- Created validate_avatar() method in UserSerializer
- Validates file extension against whitelist
- Checks file size and provides helpful error messages
- Verifies content-type header matches allowed image types

config/settings/base.py:
- Added FILE_UPLOAD_MAX_MEMORY_SIZE = 5MB
- Added DATA_UPLOAD_MAX_MEMORY_SIZE = 5MB
- Enforces global upload limits at Django level

Security impact:
- Prevents upload of executables, malware, or scripts
- Mitigates DoS via large file uploads
- Ensures only valid image files can be uploaded
- Protects against MIME-type confusion attacks

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2025-12-23 06:23:11 -07:00
Keith SmithandClaude Sonnet 4.5 deabe6ab3d Fix Critical Security Issue: Implement rate limiting on API endpoints
Added comprehensive rate limiting to prevent abuse and DoS attacks:

Configuration (config/settings/base.py):
- Anon rate: 100 requests/hour for anonymous users
- User rate: 1000 requests/hour for authenticated users
- Login rate: 10 attempts/hour (prevents brute force)
- Register rate: 5 attempts/hour (prevents account spam)
- Sync rate: 100 requests/hour (prevents sync flooding)

Custom throttle classes (users/throttles.py):
- LoginRateThrottle: Strict limit for login endpoint
- RegisterRateThrottle: Strict limit for registration endpoint
- SyncRateThrottle: Moderate limit for sync endpoint

Applied throttling to sensitive endpoints:
- users.views.RegisterAPIView: 5/hour
- users.views.TokenObtainPairView: 10/hour
- sync.views.sync: 100/hour

All other API endpoints use default throttles (anon: 100/hour, user: 1000/hour).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2025-12-22 22:36:54 -07:00
Keith SmithandClaude Sonnet 4.5 21d9d01885 Add email verification, admin approval, and user profile enhancements
Implement comprehensive email verification and admin approval system for user registration. Users must verify their email before logging in, and admins must approve new users before they can access the system.

Major features:
- Email verification with UUID tokens (24hr expiry, one-time use)
- Admin approval workflow via Django admin interface
- Custom authentication backend enforcing verification and approval
- Password change functionality for authenticated users
- Enhanced profile page with proper styling and theme support
- Collect first name, last name, and timezone during registration
- Profile link added to header navigation

Email notifications:
- Verification email sent after registration
- Admin notification when users need approval
- Approval notification sent to users

Security features:
- Cryptographically secure UUID tokens
- Token expiration and one-time use enforcement
- Email enumeration protection
- Custom JWT token validation for API access
- Existing users auto-approved via data migration

Templates added:
- Email templates (verification, approval, admin notification)
- Web templates (password change, verification pages)
- Enhanced profile page with dark/light mode support

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2025-12-22 18:13:38 -07:00
Keith SmithandClaude Sonnet 4.5 6a0b35c39c Initial commit: KeepItGoing task management server
Features:
- Django-based REST API with web interface
- Task management with tags, priorities, and due dates
- Time tracking with start/stop timers
- Subtasks support
- Task filtering (all, today, upcoming, overdue, completed)
- Tag-based organization with color coding
- Sorting by due date and priority
- Auto-assign tags when filtering
- Responsive 3-pane layout (sidebar, task list, detail panel)
- Task sharing between users
- Mobile-responsive design with dark mode support

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2025-12-18 17:41:29 -07:00