Feature: Authentication

Relevant source files

The following files were used as context for generating this wiki page:

• apps/authentication/views.py
• apps/authentication/urls.py
• apps/authentication/forms.py
• apps/authentication/templates/authentication/login.html
• apps/authentication/templates/authentication/signup.html
• IMPLEMENTATION.md
• README.md
• becathlon/settings.py
• apps/profiles/models.py
• apps/profiles/views.py
• apps/main/templates/main/base.html

The authentication module is a core component of the Becathlon application, responsible for managing user identity and access control. It provides functionalities for user registration (Sign Up), login, and logout. The system is built upon Django's built-in authentication framework, extended with a custom user registration form to accommodate different account types (Buyer and Seller) and to create an associated user profile upon registration. This ensures a clear distinction between guest and authenticated users, granting permissions accordingly.

The module is self-contained within the apps/authentication/ directory, following the project's modular app structure. It integrates with the apps/profiles module to automatically provision a user profile when a new account is created.

Sources: IMPLEMENTATION.md, README.md, apps/authentication/views.py

Core Components

The authentication system is composed of several key files that work together to handle user management.

Component	File Path	Description
Views	apps/authentication/views.py	Contains the business logic for handling sign-up, login, and logout requests.
URLs	apps/authentication/urls.py	Defines the URL patterns that map to the authentication views.
Forms	apps/authentication/forms.py	Defines the custom form (SignUpForm) used for user registration, including validation rules.
Templates	apps/authentication/templates/authentication/	HTML templates for the login and sign-up pages.
App Config	apps/authentication/apps.py	Application configuration for the authentication app.

Sources: IMPLEMENTATION.md, apps/authentication/views.py, apps/authentication/urls.py, apps/authentication/forms.py

User Registration (Sign Up)

The sign-up process allows new users to create an account. It uses a custom form to collect necessary information, including the desired account type. Upon successful registration, a corresponding Profile object is automatically created for the user.

Sources: apps/authentication/views.py:10-41, apps/authentication/forms.py:5-28

Registration Flow

The following diagram illustrates the sequence of events during user registration.

Sources: apps/authentication/views.py:10-41, apps/profiles/views.py:10-27

SignUpForm

The registration process is driven by the SignUpForm, which extends Django's UserCreationForm. It adds fields for first_name, last_name, email, and account_type.

Field	Widget	Required	Description
username	TextInput	Yes	The user's unique username.
email	EmailInput	Yes	The user's email address. Must be unique.
first_name	TextInput	No	The user's first name.
last_name	TextInput	No	The user's last name.
account_type	RadioSelect	Yes	The type of account: 'BUYER' or 'SELLER'.
password1	PasswordInput	Yes	The user's password.
password2	PasswordInput	Yes	Password confirmation field.

The form ensures that the provided email is not already in use.

Sources: apps/authentication/forms.py:5-28

Profile Creation

A key part of the registration process is the automatic creation of a Profile for the new user. This is handled by a post_save signal receiver on the User model. When a User instance is created, the post_create_profile function is called, which then creates a Profile instance linked to that user. The account_type selected during sign-up is stored in this profile.

# apps/profiles/views.py:10-27

@receiver(post_save, sender=User)
def post_create_profile(sender, instance, created, **kwargs):
    """
    Signal receiver that creates a user profile automatically after a new user is created.
    """
    if created:
        try:
            # Get account type from the form data if available in the request
            # This is a bit of a hack, relying on request context.
            # A better approach would be to pass it via the user creation process.
            account_type = 'BUYER' # Default
            if hasattr(instance, '_request') and instance._request.method == 'POST':
                account_type = instance._request.POST.get('account_type', 'BUYER')

            Profile.objects.create(
                user=instance,
                email=instance.email,
                first_name=instance.first_name,
                last_name=instance.last_name,
                account_type=account_type
            )
        except Exception:
            # Failsafe in case the request object isn't available (e.g., createsuperuser)
            Profile.objects.create(user=instance)

Sources: apps/profiles/views.py:10-27, apps/profiles/models.py:10-20

The relationship between the User and Profile models is a one-to-one link.

Sources: apps/profiles/models.py:10-14

User Login

The login functionality is handled by the login_view, which uses Django's standard AuthenticationForm and the authenticate and login functions.

Sources: apps/authentication/views.py:44-67, apps/authentication/templates/authentication/login.html

Login Flow

The login process validates user credentials and establishes a session.

Sources: apps/authentication/views.py:44-67

If the login is successful, the user is redirected to the home page. If it fails, an error message is displayed on the login page.

User Logout

The logout process invalidates the user's session and redirects them to the login page. It requires a POST request to prevent CSRF attacks.

Sources: apps/authentication/views.py:70-76

Logout Flow

The logout process is straightforward, handled by a single view.

Sources: apps/authentication/views.py:70-76, apps/main/templates/main/base.html:29-32

URL Routing

The apps/authentication/urls.py file maps the authentication URLs to their respective views. These URLs are included in the main project's URL configuration under the /auth/ path.

Path	View Name	View Function	Description
login/	login	login_view	Displays the login form and handles user login.
signup/	signup	signup_view	Displays the registration form and handles new user creation.
logout/	logout	logout_view	Handles user logout.

Sources: apps/authentication/urls.py:5-9

Summary

The authentication feature in Becathlon provides a complete and secure system for user registration, login, and logout. It effectively leverages Django's built-in authentication system while customizing the registration process to support distinct 'Buyer' and 'Seller' roles through an automatic profile creation mechanism. This separation of concerns, with authentication logic in its own app and profile logic in another, connected via signals, demonstrates a clean and scalable architecture.

Sources: IMPLEMENTATION.md, apps/authentication/views.py, apps/profiles/views.py