Address review comments

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>

Author: TG1999

CHANGELOG.rst

@@ -59,7 +59,13 @@ Version v30.0.0
 
 - Add bulk search support for CPEs.
 
-- Add authentication for API.
+- Add authentication for REST API endpoint.
+  The autentication is disabled by default and can be enabled using the
+  SCANCODEIO_REQUIRE_AUTHENTICATION settings.
+  When enabled, users have to authenticate through a login form in the Web UI, or using
+  their API Key in the REST API.
+  The API Key can be viewed in the Web UI "Profile settings" view once logged-in.
+  Users can be created using the Django "createsuperuser" management command.
 
 Other:
 

vulnerabilities/templates/base.html

@@ -38,6 +38,13 @@
                   </div>
                 {% endif %}
             </div>
+            <div class="navbar-end">
+              {% if not user.is_authenticated %}
+              <a class="navbar-item is-right" href="{% url 'login' %}">
+                Sign in
+              </a>
+              {% endif %}
+            </div>
         </div>
     </nav>
     <main class="Site-content">

vulnerabilities/tests/test_auth.py

@@ -8,15 +8,13 @@
 # This is copied from https://github.com/nexB/scancode.io/commit/eab8eeb13989c26a1600cc64e8b054f171341063
 #
 
+
 from django.conf import settings
 from django.contrib.auth import get_user_model
 from django.contrib.auth.models import AnonymousUser
 from django.test import TestCase
-from django.test import override_settings
 from django.urls import reverse
 
-from vulnerablecode.auth import is_authenticated_when_required
-
 TEST_PASSWORD = "secret"
 
 User = get_user_model()
@@ -33,17 +31,6 @@ def setUp(self):
         self.anonymous_user = AnonymousUser()
         self.basic_user = User.objects.create_user(username="basic_user", password=TEST_PASSWORD)
 
-    def test_vulnerablecode_auth_is_authenticated_when_required(self):
-        with override_settings(VULNERABLECODEIO_REQUIRE_AUTHENTICATION=True):
-            self.assertFalse(self.anonymous_user.is_authenticated)
-            self.assertFalse(is_authenticated_when_required(user=self.anonymous_user))
-
-        self.assertTrue(self.basic_user.is_authenticated)
-        self.assertTrue(is_authenticated_when_required(user=self.basic_user))
-
-        with override_settings(VULNERABLECODEIO_REQUIRE_AUTHENTICATION=False):
-            self.assertTrue(is_authenticated_when_required(user=None))
-
     def test_vulnerablecode_auth_login_view(self):
         data = {"username": self.basic_user.username, "password": ""}
         response = self.client.post(login_url, data)
@@ -81,12 +68,10 @@ def test_vulnerablecode_account_profile_view(self):
         response = self.client.get(profile_url)
         expected = '<label class="label">API Key</label>'
         self.assertContains(response, expected, html=True)
-        expected = '<label class="label">API Key</label>'
         self.assertContains(response, self.basic_user.auth_token.key)
 
     def test_vulnerablecode_auth_api_required_authentication(self):
-        with override_settings(VULNERABLECODEIO_REQUIRE_AUTHENTICATION=True):
-            response = self.client.get(api_package_url)
-            expected = {"detail": "Authentication credentials were not provided."}
-            self.assertEqual(expected, response.json())
-            self.assertEqual(401, response.status_code)
+        response = self.client.get(api_package_url)
+        expected = {"detail": "Authentication credentials were not provided."}
+        self.assertEqual(expected, response.json())
+        self.assertEqual(401, response.status_code)

vulnerablecode/auth.py

@@ -7,6 +7,7 @@
 # See https://aboutcode.org for more information about nexB OSS projects.
 #
 
+import sys
 from pathlib import Path
 
 import environ
@@ -129,13 +130,21 @@
 
 USE_I18N = True
 
+IS_TESTS = False
+
+if len(sys.argv) > 0:
+    IS_TESTS = "pytest" in sys.argv[0]
+
 VULNERABLECODEIO_REQUIRE_AUTHENTICATION = env.bool(
     "VULNERABLECODEIO_REQUIRE_AUTHENTICATION", default=False
 )
 
 LOGIN_REDIRECT_URL = "/"
 LOGOUT_REDIRECT_URL = "/"
 
+if IS_TESTS:
+    VULNERABLECODEIO_REQUIRE_AUTHENTICATION = True
+
 USE_L10N = True
 
 USE_TZ = True