Use Member as the Django User model, auth fixes

dusken/authentication.py

@@ -1,19 +1,42 @@
-from tastypie.authentication import ApiKeyAuthentication as tastypieApiKeyAuth
+from tastypie.authentication import ApiKeyAuthentication
+from tastypie.http import HttpUnauthorized
 
-class ApiKeyAuthentication(tastypieApiKeyAuth):
+class MyApiKeyAuthentication(ApiKeyAuthentication):
     """
-        Override with our own ApiKey model.
+        Override method below to use our custom User model
     """
-    def get_key(self, user, api_key):
+
+    def is_authenticated(self, request, **kwargs):
         """
-        Attempts to find the API key for the user. Uses ``ApiKey`` by default
-        but can be overridden.
+        Finds the user and checks their API key.
+
+        Should return either ``True`` if allowed, ``False`` if not or an
+        ``HttpResponse`` if you need something custom.
         """
-        from dusken.models import ApiKey
+        # Ninjafix to get our custom model working
+        from django.contrib.auth import get_user_model
+        User = get_user_model()
+        username_field = User.USERNAME_FIELD
 
         try:
-            ApiKey.objects.get(user=user, key=api_key)
-        except ApiKey.DoesNotExist:
+            username, api_key = self.extract_credentials(request)
+        except ValueError:
             return self._unauthorized()
 
-        return True
+        if not username or not api_key:
+            return self._unauthorized()
+
+        try:
+            lookup_kwargs = {username_field: username}
+            user = User.objects.get(**lookup_kwargs)
+        except (User.DoesNotExist, User.MultipleObjectsReturned):
+            return self._unauthorized()
+
+        if not self.check_active(user):
+            return False
+
+        key_auth_check = self.get_key(user, api_key)
+        if key_auth_check and not isinstance(key_auth_check, HttpUnauthorized):
+            request.user = user
+
+        return key_auth_check