Dev/11.1.0

.gitignore

@@ -41,6 +41,7 @@ webpack-stats.json
 
 # Installed Widgets
 public/widget/**/*
+public/site_img/**/*
 spec/widgets/*
 
 # Any widget zip packages

app/api/serializers.py

@@ -15,6 +15,8 @@
     Lti,
     Notification,
     ObjectPermission,
+    SiteImage,
+    SiteMessage,
     UserExtraAttempts,
     UserSettings,
     Widget,
@@ -112,13 +114,17 @@ def validate(self, data):
         if not user:
             raise serializers.ValidationError("User ID invalid.")
 
-        valid_keys = ["useGravatar", "notify", "theme", "beardMode"]
+        valid_keys = ["useGravatar", "profileImage", "notify", "theme", "beardMode"]
 
         for key, value in data["profile_fields"].items():
             if key not in valid_keys:
                 raise serializers.ValidationError(
                     f"Invalid profile field provided: {key}"
                 )
+            if key == "profileImage" and not isinstance(value, int):
+                raise serializers.ValidationError(
+                    f"Invalid value for {key}, must be integer."
+                )
             if key == "theme" and value not in ["dark", "light", "os"]:
                 raise serializers.ValidationError(
                     f"Invalid value for darkMode: {value}"
@@ -875,3 +881,87 @@ class PlayStorageSaveSerializer(serializers.Serializer):
         queryset=LogPlay.objects.all(), required=True
     )
     logs = serializers.JSONField()
+
+
+class SiteImageSerializer(serializers.ModelSerializer):
+    image = serializers.ImageField(write_only=True, required=True)
+    image_type = serializers.ChoiceField(
+        choices=SiteImage.ImageType.choices, required=True
+    )
+
+    class Meta:
+        model = SiteImage
+        fields = ["id", "image_type", "image_path", "image"]
+        read_only_fields = ["id", "image_path"]
+
+    def create(self, validated_data):
+        import os
+        import uuid
+
+        from django.conf import settings
+        from PIL import Image
+
+        image_file = validated_data.pop("image")
+        image_type = validated_data.get("image_type")
+
+        ext = os.path.splitext(image_file.name)[1]
+        filename = f"{image_type.lower()}_{uuid.uuid4()}{ext}"
+
+        site_images_dir = settings.DIRS.get(
+            "site_images", os.path.join(settings.BASE_DIR, "staticfiles", "site_img")
+        )
+        os.makedirs(site_images_dir, exist_ok=True)
+
+        file_path = os.path.join(site_images_dir, filename)
+
+        # Resize profile images to max 960px on any side
+        if image_type == SiteImage.ImageType.PROFILE_IMAGE:
+            img = Image.open(image_file)
+
+            # Convert RGBA to RGB if necessary (for JPEG compatibility)
+            if img.mode in ("RGBA", "LA", "P"):
+                background = Image.new("RGB", img.size, (255, 255, 255))
+                background.paste(
+                    img, mask=img.split()[-1] if img.mode == "RGBA" else None
+                )
+                img = background
+
+            max_dimension = 640
+            width, height = img.size
+
+            if width > max_dimension or height > max_dimension:
+                if width > height:
+                    new_width = max_dimension
+                    new_height = int((max_dimension / width) * height)
+                else:
+                    new_height = max_dimension
+                    new_width = int((max_dimension / height) * width)
+
+                img = img.resize((new_width, new_height), Image.LANCZOS)
+
+            img.save(file_path, quality=90, optimize=True)
+        else:
+            # Save the file as-is for non-profile images
+            with open(file_path, "wb+") as destination:
+                for chunk in image_file.chunks():
+                    destination.write(chunk)
+
+        validated_data["image_path"] = f"/site_img/{filename}"
+
+        return super().create(validated_data)
+
+
+class SiteMessageSerializer(serializers.ModelSerializer):
+
+    message_text = serializers.CharField(required=True)
+    message_type = serializers.ChoiceField(
+        choices=SiteMessage.MessageType.choices, required=True
+    )
+
+    start_at = serializers.DateTimeField(required=False, allow_null=True)
+    end_at = serializers.DateTimeField(required=False, allow_null=True)
+
+    class Meta:
+        model = SiteMessage
+        fields = ["id", "message_type", "message_text", "start_at", "end_at"]
+        read_only_fields = ["id"]

app/api/tests/test_site_views.py

@@ -0,0 +1,181 @@
+import io
+import tempfile
+
+from api.tests.base import MateriaTestCase
+from core.models import SiteImage
+from django.conf import settings
+from django.contrib.auth.models import User
+from django.core.files.uploadedfile import SimpleUploadedFile
+from PIL import Image
+from rest_framework import status
+from rest_framework.test import APIClient
+
+
+class SiteImageViewSetTestCase(MateriaTestCase):
+    @classmethod
+    def setUpTestData(cls):
+        super().setUpTestData()
+
+        cls.regular_user = User.objects.create_user(
+            username="regular_site",
+            email="regular_site@example.com",
+            password="testpass123",
+        )
+
+        cls.superuser = User.objects.create_superuser(
+            username="admin_site",
+            email="admin_site@example.com",
+            password="testpass123",
+        )
+
+        cls.profile_image = SiteImage.objects.create(
+            image_type=SiteImage.ImageType.PROFILE_IMAGE,
+            image_path="/site_img/profile_seed.png",
+        )
+        cls.catalog_banner = SiteImage.objects.create(
+            image_type=SiteImage.ImageType.CATALOG_BANNER,
+            image_path="/site_img/banner_seed.png",
+        )
+
+    def setUp(self):
+        self.client = APIClient()
+
+    @staticmethod
+    def make_uploaded_image(filename="test.png", size=(20, 20)):
+        image_stream = io.BytesIO()
+        image = Image.new("RGB", size, color=(73, 109, 137))
+        image.save(image_stream, format="PNG")
+        image_stream.seek(0)
+
+        return SimpleUploadedFile(
+            name=filename,
+            content=image_stream.read(),
+            content_type="image/png",
+        )
+
+
+class TestSiteImageList(SiteImageViewSetTestCase):
+    def test_unauthenticated_can_list(self):
+        response = self.client.get("/api/site-images/")
+
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        returned_ids = [item["id"] for item in response.data]
+        self.assertIn(self.profile_image.id, returned_ids)
+        self.assertIn(self.catalog_banner.id, returned_ids)
+
+    def test_regular_user_can_list(self):
+        self.client.force_authenticate(user=self.regular_user)
+        response = self.client.get("/api/site-images/")
+
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        returned_ids = [item["id"] for item in response.data]
+        self.assertIn(self.profile_image.id, returned_ids)
+        self.assertIn(self.catalog_banner.id, returned_ids)
+
+    def test_superuser_can_list(self):
+        self.client.force_authenticate(user=self.superuser)
+        response = self.client.get("/api/site-images/")
+
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        returned_ids = [item["id"] for item in response.data]
+        self.assertIn(self.profile_image.id, returned_ids)
+        self.assertIn(self.catalog_banner.id, returned_ids)
+
+    def test_list_can_filter_by_type(self):
+        response = self.client.get(
+            "/api/site-images/", {"type": SiteImage.ImageType.PROFILE_IMAGE}
+        )
+
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertGreater(len(response.data), 0)
+        self.assertTrue(
+            all(
+                item["image_type"] == SiteImage.ImageType.PROFILE_IMAGE
+                for item in response.data
+            )
+        )
+        returned_ids = [item["id"] for item in response.data]
+        self.assertIn(self.profile_image.id, returned_ids)
+        self.assertNotIn(self.catalog_banner.id, returned_ids)
+
+
+class TestSiteImageCreate(SiteImageViewSetTestCase):
+    def setUp(self):
+        super().setUp()
+
+        self.temp_dir = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp_dir.cleanup)
+
+        self.original_site_images_dir = settings.DIRS.get("site_images")
+        settings.DIRS["site_images"] = self.temp_dir.name
+        self.addCleanup(self._restore_site_images_dir)
+
+    def _restore_site_images_dir(self):
+        if self.original_site_images_dir is None:
+            settings.DIRS.pop("site_images", None)
+        else:
+            settings.DIRS["site_images"] = self.original_site_images_dir
+
+    def test_superuser_can_create(self):
+        self.client.force_authenticate(user=self.superuser)
+        before_count = SiteImage.objects.count()
+
+        payload = {
+            "image_type": SiteImage.ImageType.PROFILE_IMAGE,
+            "image": self.make_uploaded_image(),
+        }
+        response = self.client.post("/api/site-images/", payload, format="multipart")
+
+        self.assertEqual(response.status_code, status.HTTP_201_CREATED)
+        self.assertEqual(SiteImage.objects.count(), before_count + 1)
+
+    def test_regular_user_cannot_create(self):
+        self.client.force_authenticate(user=self.regular_user)
+        before_count = SiteImage.objects.count()
+
+        payload = {
+            "image_type": SiteImage.ImageType.CATALOG_BANNER,
+            "image": self.make_uploaded_image(filename="banner.png"),
+        }
+        response = self.client.post("/api/site-images/", payload, format="multipart")
+
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+        self.assertEqual(SiteImage.objects.count(), before_count)
+
+    def test_unauthenticated_cannot_create(self):
+        before_count = SiteImage.objects.count()
+
+        payload = {
+            "image_type": SiteImage.ImageType.CATALOG_BANNER,
+            "image": self.make_uploaded_image(filename="banner_unauth.png"),
+        }
+        response = self.client.post("/api/site-images/", payload, format="multipart")
+
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+        self.assertEqual(SiteImage.objects.count(), before_count)
+
+
+class TestSiteImageDestroy(SiteImageViewSetTestCase):
+    def test_superuser_can_delete(self):
+        target = SiteImage.objects.create(
+            image_type=SiteImage.ImageType.CATALOG_BANNER,
+            image_path="/site_img/delete_me.png",
+        )
+        self.client.force_authenticate(user=self.superuser)
+
+        response = self.client.delete(f"/api/site-images/{target.id}/")
+
+        self.assertEqual(response.status_code, status.HTTP_204_NO_CONTENT)
+        self.assertFalse(SiteImage.objects.filter(id=target.id).exists())
+
+    def test_non_privileged_user_cannot_delete(self):
+        target = SiteImage.objects.create(
+            image_type=SiteImage.ImageType.CATALOG_BANNER,
+            image_path="/site_img/keep_me.png",
+        )
+        self.client.force_authenticate(user=self.regular_user)
+
+        response = self.client.delete(f"/api/site-images/{target.id}/")
+
+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+        self.assertTrue(SiteImage.objects.filter(id=target.id).exists())

app/api/urls/api_urls.py

@@ -7,6 +7,7 @@
     playstorage,
     scores,
     sessions,
+    site,
     users,
     widget_instances,
     widgets,
@@ -26,6 +27,8 @@
 )
 router.register(r"notifications", notifications.NotificationsViewSet)
 router.register(r"extra-attempts", extra_attempts.UserExtraAttemptsViewSet)
+router.register(r"site-images", site.SiteImageViewSet)
+router.register(r"site-messages", site.SiteMessageViewSet)
 
 urlpatterns = [
     path("", include(router.urls)),