36054ac329
Server-authoritative attribution: on each scene PUT the server diffs incoming annotation groups and stamps createdBy/editedBy (+ timestamps) from request.user, ignoring client-sent stamps so authorship can't be forged. Each save also writes a Revision (user, time, +N ~N −N summary, snapshot of the annotation layer), visible in the admin and via /revisions/. Projects gain collaborators so several users can edit one project and get distinct attribution. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
80 lines
3 KiB
Python
80 lines
3 KiB
Python
import json
|
|
|
|
from django.db.models import Q
|
|
from django.http import FileResponse, HttpResponseNotAllowed, JsonResponse
|
|
from django.shortcuts import get_object_or_404
|
|
from django.utils import timezone
|
|
from django.views.decorators.csrf import csrf_exempt
|
|
|
|
from .attribution import annotation_layer, apply_attribution
|
|
from .models import Project, Revision
|
|
|
|
|
|
def _auth(request):
|
|
"""None if logged in, else a 401 JSON response (so fetch() doesn't get a
|
|
login redirect)."""
|
|
if not request.user.is_authenticated:
|
|
return JsonResponse({"detail": "authentication required"}, status=401)
|
|
return None
|
|
|
|
|
|
def _visible(request):
|
|
"""Projects the user owns or collaborates on."""
|
|
return Project.objects.filter(
|
|
Q(owner=request.user) | Q(collaborators=request.user)).distinct()
|
|
|
|
|
|
def _owned(request, pk):
|
|
return get_object_or_404(_visible(request), pk=pk)
|
|
|
|
|
|
def projects(request):
|
|
"""GET /api/projects/ — the projects the user owns or collaborates on."""
|
|
if (resp := _auth(request)):
|
|
return resp
|
|
rows = _visible(request).values("id", "name", "fps", "updated", "owner__username")
|
|
return JsonResponse(list(rows), safe=False)
|
|
|
|
|
|
@csrf_exempt # dev convenience: session-auth API without a CSRF token round-trip
|
|
def scene(request, pk):
|
|
"""GET/PUT /api/projects/<pk>/scene/ — read or replace the timeline scene."""
|
|
if (resp := _auth(request)):
|
|
return resp
|
|
project = _owned(request, pk)
|
|
if request.method == "GET":
|
|
return JsonResponse({"fps": project.fps, "scene": project.scene})
|
|
if request.method == "PUT":
|
|
data = json.loads(request.body or "{}")
|
|
summary = None
|
|
if "scene" in data:
|
|
project.scene, summary, _ = apply_attribution(
|
|
project.scene, data["scene"], request.user.get_username(),
|
|
timezone.now().isoformat())
|
|
Revision.objects.create(project=project, user=request.user,
|
|
summary=summary,
|
|
annotations=annotation_layer(project.scene))
|
|
if "fps" in data:
|
|
project.fps = data["fps"]
|
|
project.save(update_fields=["scene", "fps", "updated"])
|
|
return JsonResponse({"ok": True, "updated": project.updated, "summary": summary})
|
|
return HttpResponseNotAllowed(["GET", "PUT"])
|
|
|
|
|
|
def revisions(request, pk):
|
|
"""GET /api/projects/<pk>/revisions/ — the save history (who/when/what)."""
|
|
if (resp := _auth(request)):
|
|
return resp
|
|
project = _owned(request, pk)
|
|
rows = project.revisions.values("id", "user__username", "created", "summary")
|
|
return JsonResponse(list(rows), safe=False)
|
|
|
|
|
|
def otio(request, pk):
|
|
"""GET /api/projects/<pk>/otio/ — serve the uploaded OTIO file."""
|
|
if (resp := _auth(request)):
|
|
return resp
|
|
project = _owned(request, pk)
|
|
if not project.otio:
|
|
return JsonResponse({"detail": "no otio uploaded"}, status=404)
|
|
return FileResponse(project.otio.open("rb"), content_type="application/json")
|