Bernard Siebens
10736fd5ee
Adopt django-allauth with allauth.mfa, giving TOTP, WebAuthn passkeys and recovery codes — and the signup/password-reset flows we'll need next. There was no login UI at all before this (only /admin/), so this brings the auth stack. The critical piece is authentication/adapters.py. A passkey is bound to a WebAuthn Relying Party ID (a domain), and allauth derives that from the request host — which under our subdomain tenancy would bind a passkey to a *single* club (ajax-united.clubmanager.app) and silently fail at every other one. The adapter pins the RP ID to CLUBMANAGER_BASE_DOMAIN so one passkey works across all clubs. Note this cuts both ways: changing that base domain invalidates every existing passkey. RequireMFAMiddleware makes a second factor mandatory for anyone who can change other people's data — Django staff/superusers and holders of an elevated ClubRole (ADMIN/EDITOR), via the access service — while leaving it optional for regular members. /admin/login/ is routed through allauth, since Django's own admin login knows nothing about second factors. allauth is installed WITHOUT django.contrib.sites (optional since allauth 65), so ARCHITECTURE.md's rejection of the Sites framework stands and no Club.site bridge is needed. Sessions are shared across club subdomains, matching the one-passkey-everywhere model; tenancy still scopes what you can see. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
50 lines
1.3 KiB
TOML
50 lines
1.3 KiB
TOML
[project]
|
|
name = "clubmanager"
|
|
version = "0.1.0"
|
|
requires-python = ">=3.14"
|
|
dependencies = [
|
|
"dj-database-url>=3.1.2",
|
|
"django>=6.0.6",
|
|
"django-allauth[mfa]>=65.18.0",
|
|
"django-phonenumber-field[phonenumbers]>=8.4.0",
|
|
"pillow>=12.3.0",
|
|
"python-dateutil>=2.9.0.post0",
|
|
"python-decouple>=3.8",
|
|
]
|
|
|
|
[dependency-groups]
|
|
dev = [
|
|
"coverage>=7.15.0",
|
|
"ruff>=0.15.17",
|
|
]
|
|
|
|
[tool.ruff]
|
|
line-length = 250
|
|
target-version = "py314"
|
|
# Auto-generated migrations are not hand-maintained code.
|
|
extend-exclude = ["**/migrations/*"]
|
|
|
|
[tool.ruff.lint]
|
|
select = [
|
|
"E", # pycodestyle errors
|
|
"W", # pycodestyle warnings
|
|
"F", # pyflakes
|
|
"I", # isort
|
|
"UP", # pyupgrade
|
|
"B", # flake8-bugbear
|
|
"C4", # flake8-comprehensions
|
|
"DJ", # flake8-django
|
|
"RUF", # ruff-specific rules
|
|
]
|
|
ignore = [
|
|
"RUF012", # Django/Wagtail model attrs (panels, Meta.ordering, ...) are framework conventions, not mutable defaults to guard.
|
|
"RUF005", # Wagtail's `Page.content_panels + [...]` concatenation is the documented idiom.
|
|
]
|
|
|
|
[tool.ruff.lint.per-file-ignores]
|
|
# Settings legitimately use star imports and long generated values.
|
|
"clubmanager/settings/*" = ["F403", "F405", "E501"]
|
|
|
|
[tool.ruff.lint.isort]
|
|
known-first-party = ["authentication", "club", "members", "teams", "events", "news", "pages", "home", "search", "clubmanager"]
|