Don't allow global search of users without login anymore

Apparently login requirement for the user lookup was added to make
scraping harder. It doesn't seem like the most interesting data
honestly, but this adds the requirement back for global user search.

Instead it will allow anonymous searching of users involved in a certain
commitfest. Those you could scrape from the commitfest page anyway.

Finally this adds a logged in requirement for the global search page.
Otherwise people will run into the same problem there as they did on the
commitfest page previously: the search box would not autocomplete
without giving feedback as to why to the user. Since the global search
page is only really useful for power users, having it require a login
seems fine.

Author: JelteF

pgcommitfest/commitfest/forms.py

@@ -24,8 +24,17 @@ class CommitFestFilterForm(forms.Form):
     reviewer = forms.ChoiceField(required=False, label="Reviewer (type to search)")
     sortkey = forms.IntegerField(required=False)
 
-    def __init__(self, data, *args, **kwargs):
+    def __init__(self, data, commitfest=None, *args, **kwargs):
         super(CommitFestFilterForm, self).__init__(data, *args, **kwargs)
+        self.commitfest = commitfest
+
+        # Update selectize_fields with cf parameter if commitfest is provided
+        if commitfest:
+            self.selectize_fields = {
+                "author": f"/lookups/user?cf={commitfest.id}",
+                "reviewer": f"/lookups/user?cf={commitfest.id}",
+                "tag": None,
+            }
 
         self.fields["sortkey"].widget = forms.HiddenInput()
 

pgcommitfest/commitfest/lookups.py

@@ -1,22 +1,40 @@
 from django.contrib.auth.models import User
 from django.db.models import Q
-from django.http import Http404, HttpResponse
+from django.http import Http404, HttpResponse, HttpResponseForbidden
 
 import json
 
 
 def userlookup(request):
     query = request.GET.get("query", None)
+    cf = request.GET.get("cf", None)
+
     if not query:
         raise Http404()
 
+    # Start with base filters for active users matching the query
     users = User.objects.filter(
         Q(is_active=True),
         Q(username__icontains=query)
         | Q(first_name__icontains=query)
         | Q(last_name__icontains=query),
     )
 
+    # If no commitfest filter is provided, require login
+    if not cf:
+        if not request.user.is_authenticated:
+            return HttpResponseForbidden(
+                "Login required when not filtering by commitfest"
+            )
+    else:
+        # Filter users to only those who have participated in the specified commitfest
+        # This includes authors, reviewers, and committers of patches in that commitfest
+        users = users.filter(
+            Q(patch_author__commitfests__id=cf)
+            | Q(patch_reviewer__commitfests__id=cf)
+            | Q(committer__patch__commitfests__id=cf)
+        ).distinct()
+
     return HttpResponse(
         json.dumps(
             {

pgcommitfest/commitfest/tests/conftest.py

@@ -0,0 +1,136 @@
+"""Shared test fixtures for commitfest tests."""
+
+from django.contrib.auth.models import User
+
+from datetime import date
+
+import pytest
+
+from pgcommitfest.commitfest.models import CommitFest
+
+
+@pytest.fixture
+def alice():
+    """Create test user Alice."""
+    return User.objects.create_user(
+        username="alice",
+        first_name="Alice",
+        last_name="Anderson",
+        email="alice@example.com",
+    )
+
+
+@pytest.fixture
+def bob():
+    """Create test user Bob."""
+    return User.objects.create_user(
+        username="bob",
+        first_name="Bob",
+        last_name="Brown",
+        email="bob@example.com",
+    )
+
+
+@pytest.fixture
+def charlie():
+    """Create test user Charlie."""
+    return User.objects.create_user(
+        username="charlie",
+        first_name="Charlie",
+        last_name="Chen",
+        email="charlie@example.com",
+    )
+
+
+@pytest.fixture
+def dave():
+    """Create test user Dave."""
+    return User.objects.create_user(
+        username="dave",
+        first_name="Dave",
+        last_name="Davis",
+        email="dave@example.com",
+    )
+
+
+@pytest.fixture
+def users(alice, bob, charlie, dave):
+    """Create all test users and return as a dictionary."""
+    return {
+        "alice": alice,
+        "bob": bob,
+        "charlie": charlie,
+        "dave": dave,
+    }
+
+
+@pytest.fixture
+def open_cf():
+    """Create an open commitfest."""
+    return CommitFest.objects.create(
+        name="2025-01",
+        status=CommitFest.STATUS_OPEN,
+        startdate=date(2025, 1, 1),
+        enddate=date(2025, 1, 31),
+        draft=False,
+    )
+
+
+@pytest.fixture
+def in_progress_cf():
+    """Create an in-progress commitfest."""
+    return CommitFest.objects.create(
+        name="2024-11",
+        status=CommitFest.STATUS_INPROGRESS,
+        startdate=date(2024, 11, 1),
+        enddate=date(2024, 11, 30),
+        draft=False,
+    )
+
+
+@pytest.fixture
+def recent_closed_cf():
+    """Create a recently closed commitfest."""
+    return CommitFest.objects.create(
+        name="2024-09",
+        status=CommitFest.STATUS_CLOSED,
+        startdate=date(2024, 9, 1),
+        enddate=date(2024, 9, 30),
+        draft=False,
+    )
+
+
+@pytest.fixture
+def old_closed_cf():
+    """Create an old closed commitfest."""
+    return CommitFest.objects.create(
+        name="2024-07",
+        status=CommitFest.STATUS_CLOSED,
+        startdate=date(2024, 7, 1),
+        enddate=date(2024, 7, 31),
+        draft=False,
+    )
+
+
+@pytest.fixture
+def draft_cf():
+    """Create a draft commitfest."""
+    return CommitFest.objects.create(
+        name="2025-03-draft",
+        status=CommitFest.STATUS_OPEN,
+        startdate=date(2025, 3, 1),
+        enddate=date(2025, 3, 31),
+        draft=True,
+    )
+
+
+@pytest.fixture
+def commitfests(open_cf, in_progress_cf, recent_closed_cf, old_closed_cf, draft_cf):
+    """Create all test commitfests and return as a dictionary."""
+    return {
+        "open": open_cf,
+        "in_progress": in_progress_cf,
+        "recent_previous": recent_closed_cf,
+        "old_previous": old_closed_cf,
+        "draft": draft_cf,
+    }

pgcommitfest/commitfest/tests/test_apiv1.py

@@ -1,61 +1,13 @@
-from django.test import override_settings
-
 import json
-from datetime import date
 
 import pytest
 
-from pgcommitfest.commitfest.models import CommitFest
-
 pytestmark = pytest.mark.django_db
 
 
-@pytest.fixture
-def commitfests():
-    """Create test commitfests with various statuses."""
-    return {
-        "open": CommitFest.objects.create(
-            name="2025-01",
-            status=CommitFest.STATUS_OPEN,
-            startdate=date(2025, 1, 1),
-            enddate=date(2025, 1, 31),
-            draft=False,
-        ),
-        "in_progress": CommitFest.objects.create(
-            name="2024-11",
-            status=CommitFest.STATUS_INPROGRESS,
-            startdate=date(2024, 11, 1),
-            enddate=date(2024, 11, 30),
-            draft=False,
-        ),
-        "recent_previous": CommitFest.objects.create(
-            name="2024-09",
-            status=CommitFest.STATUS_CLOSED,
-            startdate=date(2024, 9, 1),
-            enddate=date(2024, 9, 30),
-            draft=False,
-        ),
-        "old_previous": CommitFest.objects.create(
-            name="2024-07",
-            status=CommitFest.STATUS_CLOSED,
-            startdate=date(2024, 7, 1),
-            enddate=date(2024, 7, 31),
-            draft=False,
-        ),
-        "draft": CommitFest.objects.create(
-            name="2025-03-draft",
-            status=CommitFest.STATUS_OPEN,
-            startdate=date(2025, 3, 1),
-            enddate=date(2025, 3, 31),
-            draft=True,
-        ),
-    }
-
-
 def test_needs_ci_endpoint(client, commitfests):
     """Test the /api/v1/commitfests/needs_ci endpoint returns correct data."""
-    with override_settings(AUTO_CREATE_COMMITFESTS=False):
-        response = client.get("/api/v1/commitfests/needs_ci")
+    response = client.get("/api/v1/commitfests/needs_ci")
 
     # Check response metadata
     assert response.status_code == 200