🔐 Django Authentication System

A robust Django authentication system built with Django REST Framework (DRF), featuring comprehensive user management and security features for modern web applications.

📋 Table of Contents

• Features
• Technologies
• Installation
• Configuration
• API Documentation
• Authentication Endpoints
• User Management Endpoints
• Authorization
• License

✨ Features

• 🔐 Email-based Registration with domain restrictions
• ✅ Account Activation via email verification
• 🔑 JWT Authentication with access and refresh tokens
• 🛡️ Rate Limiting on critical endpoints
• 🔒 Token Blacklisting for secure logout
• 🔁 Password Reset functionality
• 📜 OpenAPI 3.0 Documentation with Swagger UI
• 🧪 API-First Design for frontend integration

🛠️ Technologies

• Backend: Django 5.2+, Django REST Framework
• Authentication: SimpleJWT (rest_framework_simplejwt)
• Documentation: drf-spectacular + drf-spectacular-sidecar
• Database: SQLite (configurable for PostgreSQL/MySQL)
• Python: 3.12+

⚙️ Installation

1. Clone the Repository

git clone https://github.com/Chibuikee/authsysbackend.git
cd authsysbackend

2. Set Up Virtual Environment

python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

3. Install Dependencies

pip install -r requirements.txt

4. Configure Environment Variables

Create a .env file in the project root with the following variables:

TOKEN_EXPIRY=72000
BASE_URL=http://localhost:8000
FRONT_END_URL=http://localhost:3000/auth
PORT=8000
EMAIL_HOST=smtp.gmail.com
EMAIL_PORT=465
EMAIL_USE_TLS=False
EMAIL_USE_SSL=True
EMAIL_HOST_USER=your-email@gmail.com
EMAIL_HOST_PASSWORD=your-app-password
DEFAULT_FROM_EMAIL=your-email@gmail.com
SECRET_KEY=your-secret-key
ALLOWED_DOMAIN=worldover.org

5. Database Setup

# Run migrations
python manage.py migrate

# Create superuser
python manage.py createsuperuser

# Collect static files
python manage.py collectstatic

6. Start Development Server

python manage.py runserver

📖 API Documentation

Access the interactive API documentation at:

• Swagger UI: http://localhost:8000/api/docs/
• OpenAPI Schema: http://localhost:8000/api/schema/

🔐 Authentication Endpoints

Base URL: api/v1/auth/

Sign Up

POST /sign-up

Register a new user account with email verification required.

Request Body:

{
  "email": "user@worldover.org",
  "full_name": "John Doe",
  "password": "Password123!",
  "confirm_password": "Password123!"
}

Response:

{
  "message": "Account created. Please confirm your email."
}

Login

POST /login

Authenticate user and receive JWT tokens.

Request Body:

{
  "email": "user@worldover.org",
  "password": "Password123!"
}

Response:

{
  "access": "<access_token>",
  "refresh": "<refresh_token>"
}

Refresh Token

POST /token/refresh

Obtain a new access token using the refresh token.

Request Body:

{
  "refresh": "<refresh_token>"
}

Response:

{
  "access": "<new_access_token>"
}

Confirm Account

POST /confirm-account

Activate user account using email verification token.

Request Body:

{
  "token": "<confirmation_token>"
}

Response:

{
  "message": "Account activated successfully",
  "user_id": "1",
  "email": "user@worldover.org",
  "is_confirmed": true
}

Forgot Password

POST /users/forgotpassword/

Initiate password reset process.

Authentication: Required (Bearer Token)

Request Body:

{
  "email": "user@worldover.org"
}

Response:

{
  "message": "Password reset email sent",
  "email": "user@worldover.org",
  "success": true
}

Reset Password

POST /reset-password/

Complete password reset using verification token.

Request Body:

{
  "token": "<reset_token>",
  "new_password": "NewPass123!",
  "confirm_password": "NewPass123!"
}

Response:

{
  "message": "Password reset successful."
}

👥 User Management Endpoints

Get User Information

GET /users/<id>

Retrieve specific user's profile information.

Authentication: Required (Bearer Token)

Response:

{
  "id": 1,
  "unique_id": "abc123",
  "is_confirmed": true,
  "is_active": true,
  "full_name": "John Doe",
  "email": "user@worldover.org",
  "account_approved": true
}

🔐 Authorization

For protected endpoints, include the JWT access token in the request headers:

Authorization: Bearer <access_token>

🛡️ Security Features

• Domain Restrictions: Only users with approved domain emails can register
• Rate Limiting: Prevents abuse on critical endpoints like signup, login, and token refresh
• Token Blacklisting: Secure logout functionality that invalidates tokens
• Email Verification: Ensures valid email addresses during registration
• Password Validation: Enforces strong password requirements
• JWT Security: Short-lived access tokens with secure refresh mechanism

🔧 Configuration Notes

• The system is configured to only accept registrations from the worldover.org domain
• Email configuration uses Gmail SMTP (configure your app password)
• Token expiry is set to 72000 seconds (20 hours) by default
• Frontend URL is configured for CORS and email links

📄 License

Contact worldover.org