save

Author: tonyqiu123

backend/apps/core/auth.py

@@ -1,17 +1,19 @@
-from functools import wraps
+from functools import wraps, lru_cache
 import logging
 
-from clerk_backend_api import authenticate_request, AuthenticateRequestOptions
+from clerk_backend_api import authenticate_request, AuthenticateRequestOptions, Clerk
 from django.contrib.auth import authenticate
 from django.contrib.auth.backends import BaseBackend
 from django.contrib.auth.models import User
 from django.http import JsonResponse
 
 from config.settings.base import CLERK_SECRET_KEY, CLERK_AUTHORIZED_PARTIES
-import httpx
 
 logger = logging.getLogger(__name__)
 
+# Create a single Clerk instance to reuse across requests
+_clerk_client = Clerk(bearer_auth=CLERK_SECRET_KEY)
+
 
 class JwtAuthBackend(BaseBackend):
     def authenticate(self, request, **kwargs):
@@ -42,10 +44,11 @@ def authenticate(self, request, **kwargs):
                 request.error_message = request_state.message
                 logger.warning("JWT auth: Clerk rejected token: %s", request_state.message)
                 return None
+            print(request_state.payload, 'request_state.payload')
             # Ideally at this point user object must be fetched from DB and returned, but we will just return a dummy
             # user object
             user = User(username=request_state.payload.get("sub", "unknown"), password="None")
-            # Attach payload for downstream usage if needed
+            # Attach payload for downstream usage
             try:
                 request.auth_payload = request_state.payload
             except Exception:
@@ -74,42 +77,22 @@ def _wrapped_view(request, *args, **kwargs):
     return _wrapped_view
 
 
-def is_admin(request) -> bool:
-    """Return True if Clerk public metadata contains role == 'admin'."""
+@lru_cache(maxsize=100)
+def _get_user_metadata(user_id: str) -> dict:
+    """Fetch user public_metadata from Clerk API."""
     try:
-        payload = getattr(request, "auth_payload", {}) or {}
-        public_meta = payload.get("public_metadata") or payload.get("publicMetadata") or {}
-        if not public_meta:
-            user_id = payload.get("sub") or payload.get("id")
-            if user_id and CLERK_SECRET_KEY:
-                try:
-                    with httpx.Client(timeout=5.0) as client:
-                        resp = client.get(
-                            f"https://api.clerk.com/v1/users/{user_id}",
-                            headers={
-                                "Authorization": f"Bearer {CLERK_SECRET_KEY}",
-                                "Content-Type": "application/json",
-                            },
-                        )
-                        if resp.status_code == 200:
-                            data = resp.json() or {}
-                            public_meta = data.get("public_metadata") or {}
-                            try:
-                                request.clerk_user = data
-                            except Exception:
-                                pass
-                except Exception:
-                    public_meta = {}
-        return public_meta.get("role") == "admin"
+        user = _clerk_client.users.get(user_id=user_id)
+        return getattr(user, "public_metadata", None) or getattr(user, "publicMetadata", None) or {}
     except Exception:
-        return False
+        return {}
 
 
 def admin_required(view_func):
     @wraps(view_func)
     @jwt_required
     def _wrapped_view(request, *args, **kwargs):
-        if not is_admin(request):
+        user_id = getattr(request, "auth_payload", {}).get("sub")
+        if not user_id or _get_user_metadata(user_id).get("role") != "admin":
             return JsonResponse({'detail': 'Admin only'}, status=403)
         return view_func(request, *args, **kwargs)
 

backend/apps/events/models.py

@@ -156,7 +156,7 @@ class EventSubmission(models.Model):
         max_length=20, choices=STATUS_CHOICES, default="pending", db_index=True
     )
     submitted_by = models.CharField(
-        max_length=255, null=True, blank=True, help_text="Clerk user ID who submitted this event"
+        max_length=255, help_text="Clerk user ID who submitted this event"
     )
 
     # Timestamps

backend/apps/events/views.py

@@ -508,14 +508,10 @@ def submit_event(request):
             cleaned["status"] = "PENDING"
         event = Events.objects.create(**cleaned)
 
-        # Attempt to capture submitting user if available (optional for anonymous)
-        clerk_user_id = None
-        try:
-            clerk_user_id = (
-                getattr(request, "user", None) or {}
-            ).get("id")
-        except Exception:
-            clerk_user_id = None
+        user_info = getattr(request, "auth_payload", {})
+        clerk_user_id = user_info.get("sub")
+        if not clerk_user_id:
+            return Response({"error": "User authentication required"}, status=status.HTTP_401_UNAUTHORIZED)
 
         submission = EventSubmission.objects.create(
             screenshot_url=screenshot_url,
@@ -537,24 +533,29 @@ def submit_event(request):
 
 @api_view(["GET"])
 @ratelimit(key="ip", rate="100/hr", block=True)
+@jwt_required
 @admin_required
 def get_submissions(request):
     try:
-        print('request', request.user)
-        submissions = EventSubmission.objects.all().order_by("-submitted_at")
-        data = [
-            {
+        user_info = getattr(request, "auth_payload", {})
+        email_from_request = user_info.get("email_addresses", [{}])[0].get("email_address", None)
+        
+        submissions = EventSubmission.objects.select_related("created_event").all().order_by("-submitted_at")
+        data = []
+        for s in submissions:
+            data.append({
                 "id": s.id,
                 "screenshot_url": s.screenshot_url,
                 "source_url": s.source_url,
                 "status": s.status,
                 "submitted_by": s.submitted_by,
+                "submitted_by_email": email_from_request,
                 "submitted_at": s.submitted_at,
                 "extracted_data": s.extracted_data,
                 "event_id": s.created_event_id,
-            }
-            for s in submissions
-        ]
+                "event_title": s.created_event.title if s.created_event else None,
+                "admin_notes": s.admin_notes,
+            })
         return Response(data)
 
     except Exception as e:
@@ -603,56 +604,43 @@ def process_submission(request, submission_id):
 @admin_required
 @ratelimit(key="ip", rate="100/hr", block=True)
 def review_submission(request, submission_id):
-    """Approve, reject, or edit submission"""
-    try:
-        submission = get_object_or_404(EventSubmission, id=submission_id)
-        action = request.data.get("action")  # 'approve', 'reject', 'edit'
-
-        if action == "approve":
-            # Ensure event exists (it should from submission time)
-            event = submission.created_event
-            if not event:
-                return Response({"error": "No linked event to approve"}, status=status.HTTP_400_BAD_REQUEST)
-
-            submission.status = "approved"
-            submission.reviewed_at = timezone.now()
-            submission.reviewed_by = request.user.get('email_addresses', [{}])[0].get('email_address')
-            submission.save()
-
-            return Response(
-                {"message": "Event approved", "event_id": event.id}
-            )
-
-        elif action == "reject":
-            submission.status = "rejected"
-            submission.reviewed_at = timezone.now()
-            submission.reviewed_by = request.user.get('email_addresses', [{}])[0].get('email_address')
-            submission.admin_notes = request.data.get("notes", "")
-            submission.save()
-
-            return Response({"message": "Event rejected"})
-
-        elif action == "edit":
-            # Update event data and extracted_data
-            event_data = request.data.get("event_data") or {}
-            submission.extracted_data = event_data
-            submission.save()
-
+    """Approve or reject submission."""
+    submission = get_object_or_404(EventSubmission, id=submission_id)
+    action = request.data.get("action")
+    reviewer_id = getattr(request, "auth_payload", {}).get("sub")
+
+    if action == "approve":
+        if not submission.created_event:
+            return Response({"error": "No linked event to approve"}, status=status.HTTP_400_BAD_REQUEST)
+        
+        # Get edited extracted_data if provided, otherwise use existing
+        edited_data = request.data.get("extracted_data")
+        if edited_data:
+            submission.extracted_data = edited_data
+            
+            # Update the linked event with the edited data
             event = submission.created_event
-            if event and isinstance(event_data, dict):
+            if event and isinstance(edited_data, dict):
                 for field in [f.name for f in Events._meta.get_fields()]:
-                    if field in event_data:
-                        setattr(event, field, event_data[field])
+                    if field in edited_data:
+                        setattr(event, field, edited_data[field])
                 event.save()
-
-            return Response({"message": "Event data updated"})
-
-        return Response(
-            {"error": "Invalid action"}, status=status.HTTP_400_BAD_REQUEST
-        )
-
-    except Exception as e:
-        return Response({"error": str(e)}, status=status.HTTP_500_INTERNAL_SERVER_ERROR)
+        
+        submission.status = "approved"
+        submission.reviewed_at = timezone.now()
+        submission.reviewed_by = reviewer_id
+        submission.save()
+        return Response({"message": "Event approved", "event_id": submission.created_event.id})
+
+    elif action == "reject":
+        submission.status = "rejected"
+        submission.reviewed_at = timezone.now()
+        submission.reviewed_by = reviewer_id
+        submission.admin_notes = request.data.get("admin_notes", "")
+        submission.save()
+        return Response({"message": "Event rejected"})
+
+    return Response({"error": "Invalid action. Use 'approve' or 'reject'"}, status=status.HTTP_400_BAD_REQUEST)
 
 
 @api_view(["GET"])

backend/config/settings/base.py

@@ -232,19 +232,19 @@
 }
 
 # Database query logging (only in DEBUG mode)
-if DEBUG:
-    LOGGING = {
-        "version": 1,
-        "disable_existing_loggers": False,
-        "handlers": {
-            "console": {
-                "class": "logging.StreamHandler",
-            },
-        },
-        "loggers": {
-            "django.db.backends": {
-                "handlers": ["console"],
-                "level": "DEBUG",  # Shows all SQL queries
-            },
-        },
-    }
+# if DEBUG:
+#     LOGGING = {
+#         "version": 1,
+#         "disable_existing_loggers": False,
+#         "handlers": {
+#             "console": {
+#                 "class": "logging.StreamHandler",
+#             },
+#         },
+#         "loggers": {
+#             "django.db.backends": {
+#                 "handlers": ["console"],
+#                 "level": "DEBUG",  # Shows all SQL queries
+#             },
+#         },
+#     }