`812ace5`

submission feature stable

Authored by

espadonne 9 months ago

SHA: 812ace579119d3923e78b2b76e7c1cd995840fa2
Parents: 908ccc8
Tree: 9135ecf

7 changed files

Status	File	+	-
M	`memorial/admin.py`	106	3
A	`memorial/migrations/0005_contribution.py`	110	0
M	`memorial/models.py`	91	1
M	`memorial/serializers.py`	105	2
M	`memorial/urls.py`	28	2
M	`memorial/views.py`	264	25
M	`vmi_wardead_be/settings.py`	138	36

memorial/admin.pymodified

  from django import forms
  from django.core.files.storage import default_storage
  from django.conf import settings
 -from .models import Conflict, Person
 +from django.utils.html import format_html
 +from django.urls import reverse
 +from django.utils.safestring import mark_safe
 +from .models import Conflict, Person, Contribution
  import os
  @admin.register(Person)
  class PersonAdmin(admin.ModelAdmin):
      form = PersonAdminForm
 -    list_display = ['display_name', 'class_year', 'conflict', 'rank', 'get_death_date_display', 'has_pdf', 'has_description']
 +    list_display = ['display_name', 'class_year', 'conflict', 'rank', 'get_death_date_display', 'has_pdf', 'has_description', 'contribution_count']
      list_filter = ['conflict', 'class_year', 'rank', 'death_date_precision']
      search_fields = ['first_name', 'last_name', 'unit']
      autocomplete_fields = ['conflict']
      def has_description(self, obj):
          return bool(obj.death_description)
      has_description.boolean = True
 -    has_description.short_description = 'Has Description'
 +    has_description.short_description = 'Has Description'
++
 +    def contribution_count(self, obj):
 +        """Show number of contributions"""
 +        total = obj.contributions.count()
 +        approved = obj.contributions.filter(status='approved').count()
 +        pending = obj.contributions.filter(status='pending').count()
++
 +        if pending > 0:
 +            return format_html(
 +                '<span style="color: green;">{}</span> / '
 +                '<span style="color: orange;">{}</span> / '
 +                '<span>{}</span>',
 +                approved, pending, total
 +            )
 +        return f"{approved} / {total}"
 +    contribution_count.short_description = 'Contributions (A/P/T)'
++
++
 +@admin.register(Contribution)
 +class ContributionAdmin(admin.ModelAdmin):
 +    list_display = [
 +        'id', 'person_link', 'contributor_email', 'content_type',
 +        'status_badge', 'submitted_at', 'reviewed_by'
 +    ]
 +    list_filter = ['status', 'content_type', 'submitted_at', 'reviewed_at']
 +    search_fields = [
 +        'person__first_name', 'person__last_name',
 +        'contributor_email', 'content_text'
 +    ]
 +    readonly_fields = [
 +        'person', 'contributor_email', 'content_type', 'content_text',
 +        'image_preview', 'submitted_at', 'reviewed_at', 'reviewed_by'
 +    ]
++
 +    fieldsets = (
 +        ('Contribution Info', {
 +            'fields': ('person', 'contributor_email', 'submitted_at')
 +        }),
 +        ('Content', {
 +            'fields': ('content_type', 'content_text', 'image_preview')
 +        }),
 +        ('Review Status', {
 +            'fields': ('status', 'reviewed_at', 'reviewed_by', 'rejection_reason')
 +        })
 +    )
++
 +    actions = ['approve_contributions', 'reject_contributions']
++
 +    def person_link(self, obj):
 +        """Link to person in admin"""
 +        url = reverse('admin:memorial_person_change', args=[obj.person.id])
 +        return format_html('<a href="{}">{}</a>', url, obj.person.full_display_name)
 +    person_link.short_description = 'Person'
++
 +    def status_badge(self, obj):
 +        """Color-coded status badge"""
 +        colors = {
 +            'pending': '#FFA500',
 +            'approved': '#28a745',
 +            'rejected': '#dc3545'
 +        }
 +        return format_html(
 +            '<span style="background-color: {}; color: white; padding: 3px 10px; '
 +            'border-radius: 3px; font-weight: bold;">{}</span>',
 +            colors.get(obj.status, '#666'),
 +            obj.get_status_display()
 +        )
 +    status_badge.short_description = 'Status'
++
 +    def image_preview(self, obj):
 +        """Preview of uploaded image"""
 +        if obj.content_image:
 +            return mark_safe(
 +                f'<img src="{obj.content_image.url}" '
 +                f'style="max-width: 300px; max-height: 300px;" />'
 +            )
 +        return "No image"
 +    image_preview.short_description = 'Image Preview'
++
 +    def approve_contributions(self, request, queryset):
 +        """Bulk approve action"""
 +        count = 0
 +        for contribution in queryset.filter(status='pending'):
 +            contribution.approve(request.user)
 +            count += 1
 +        self.message_user(request, f"{count} contributions approved.")
 +    approve_contributions.short_description = "Approve selected contributions"
++
 +    def reject_contributions(self, request, queryset):
 +        """Bulk reject action"""
 +        count = 0
 +        for contribution in queryset.filter(status='pending'):
 +            contribution.reject(request.user, "Bulk rejection")
 +            count += 1
 +        self.message_user(request, f"{count} contributions rejected.")
 +    reject_contributions.short_description = "Reject selected contributions"
++
 +    def has_add_permission(self, request):
 +        """Prevent manual addition through admin"""
 +        return False

memorial/migrations/0005_contribution.pyadded

 +# Generated by Django 5.0.6 on 2025-07-18 20:20
++
 +import django.db.models.deletion
 +from django.conf import settings
 +from django.db import migrations, models
++
++
 +class Migration(migrations.Migration):
++
 +    dependencies = [
 +        ("memorial", "0004_person_death_date_precision"),
 +        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
 +    ]
++
 +    operations = [
 +        migrations.CreateModel(
 +            name="Contribution",
 +            fields=[
 +                (
 +                    "id",
 +                    models.BigAutoField(
 +                        auto_created=True,
 +                        primary_key=True,
 +                        serialize=False,
 +                        verbose_name="ID",
 +                    ),
 +                ),
 +                (
 +                    "contributor_email",
 +                    models.EmailField(
 +                        help_text="Email of the person submitting this contribution",
 +                        max_length=254,
 +                    ),
 +                ),
 +                (
 +                    "content_type",
 +                    models.CharField(
 +                        choices=[
 +                            ("text", "Text"),
 +                            ("image", "Image"),
 +                            ("both", "Both"),
 +                        ],
 +                        default="text",
 +                        max_length=10,
 +                    ),
 +                ),
 +                (
 +                    "content_text",
 +                    models.TextField(
 +                        blank=True, help_text="Text content of the contribution"
 +                    ),
 +                ),
 +                (
 +                    "content_image",
 +                    models.ImageField(
 +                        blank=True,
 +                        help_text="Image contribution",
 +                        null=True,
 +                        upload_to="contributions/",
 +                    ),
 +                ),
 +                (
 +                    "status",
 +                    models.CharField(
 +                        choices=[
 +                            ("pending", "Pending"),
 +                            ("approved", "Approved"),
 +                            ("rejected", "Rejected"),
 +                        ],
 +                        default="pending",
 +                        max_length=10,
 +                    ),
 +                ),
 +                ("submitted_at", models.DateTimeField(auto_now_add=True)),
 +                ("reviewed_at", models.DateTimeField(blank=True, null=True)),
 +                ("rejection_reason", models.TextField(blank=True)),
 +                (
 +                    "person",
 +                    models.ForeignKey(
 +                        on_delete=django.db.models.deletion.CASCADE,
 +                        related_name="contributions",
 +                        to="memorial.person",
 +                    ),
 +                ),
 +                (
 +                    "reviewed_by",
 +                    models.ForeignKey(
 +                        blank=True,
 +                        null=True,
 +                        on_delete=django.db.models.deletion.SET_NULL,
 +                        related_name="reviewed_contributions",
 +                        to=settings.AUTH_USER_MODEL,
 +                    ),
 +                ),
 +            ],
 +            options={
 +                "ordering": ["-submitted_at"],
 +                "indexes": [
 +                    models.Index(
 +                        fields=["person", "status"],
 +                        name="memorial_co_person__8f13d8_idx",
 +                    ),
 +                    models.Index(
 +                        fields=["status", "submitted_at"],
 +                        name="memorial_co_status_0bff92_idx",
 +                    ),
 +                ],
 +            },
 +        ),
 +    ]

memorial/models.pymodified

  from django.db import models
  from django.urls import reverse
 +from django.utils import timezone
  class Conflict(models.Model):
              return self.date_of_death.strftime('%B %d, %Y')
      def get_absolute_url(self):
 -        return reverse('person-detail', kwargs={'pk': self.pk})
 +        return reverse('person-detail', kwargs={'pk': self.pk})
++
++
 +class ContributionStatus(models.TextChoices):
 +    PENDING = 'pending', 'Pending'
 +    APPROVED = 'approved', 'Approved'
 +    REJECTED = 'rejected', 'Rejected'
++
++
 +class Contribution(models.Model):
 +    """Community contributions for person records"""
++
 +    # Link to person
 +    person = models.ForeignKey(
 +        'Person',
 +        on_delete=models.CASCADE,
 +        related_name='contributions'
 +    )
++
 +    # Contributor info
 +    contributor_email = models.EmailField(
 +        help_text="Email of the person submitting this contribution"
 +    )
++
 +    # Content
 +    content_type = models.CharField(
 +        max_length=10,
 +        choices=[
 +            ('text', 'Text'),
 +            ('image', 'Image'),
 +            ('both', 'Both'),
 +        ],
 +        default='text'
 +    )
 +    content_text = models.TextField(
 +        blank=True,
 +        help_text="Text content of the contribution"
 +    )
 +    content_image = models.ImageField(
 +        upload_to='contributions/',
 +        blank=True,
 +        null=True,
 +        help_text="Image contribution"
 +    )
++
 +    # Moderation
 +    status = models.CharField(
 +        max_length=10,
 +        choices=ContributionStatus.choices,
 +        default=ContributionStatus.PENDING
 +    )
++
 +    # Timestamps
 +    submitted_at = models.DateTimeField(auto_now_add=True)
 +    reviewed_at = models.DateTimeField(null=True, blank=True)
++
 +    # Review info
 +    reviewed_by = models.ForeignKey(
 +        'auth.User',
 +        on_delete=models.SET_NULL,
 +        null=True,
 +        blank=True,
 +        related_name='reviewed_contributions'
 +    )
 +    rejection_reason = models.TextField(blank=True)
++
 +    class Meta:
 +        ordering = ['-submitted_at']
 +        indexes = [
 +            models.Index(fields=['person', 'status']),
 +            models.Index(fields=['status', 'submitted_at']),
 +        ]
++
 +    def __str__(self):
 +        return f"Contribution for {self.person} by {self.contributor_email} ({self.status})"
++
 +    def approve(self, user):
 +        """Approve this contribution"""
 +        self.status = ContributionStatus.APPROVED
 +        self.reviewed_by = user
 +        self.reviewed_at = timezone.now()
 +        self.save()
++
 +    def reject(self, user, reason=''):
 +        """Reject this contribution"""
 +        self.status = ContributionStatus.REJECTED
 +        self.reviewed_by = user
 +        self.reviewed_at = timezone.now()
 +        self.rejection_reason = reason
 +        self.save()

memorial/serializers.pymodified

  from rest_framework import serializers
 -from .models import Conflict, Person
 +from .models import Conflict, Person, Contribution
  class PersonListSerializer(serializers.ModelSerializer):
          fields = [
              'id', 'name', 'start_year', 'end_year',
              'description', 'casualty_count', 'order', 'casualties'
 -        ]
 +        ]
++
++
 +# Contribution serializers
 +class ContributionSerializer(serializers.ModelSerializer):
 +    """Base serializer for contributions"""
 +    contributor_email = serializers.EmailField(required=True)
 +    reviewed_by_username = serializers.CharField(
 +        source='reviewed_by.username',
 +        read_only=True
 +    )
++
 +    class Meta:
 +        model = Contribution
 +        fields = [
 +            'id', 'person', 'contributor_email', 'content_type',
 +            'content_text', 'content_image', 'status', 'submitted_at',
 +            'reviewed_at', 'reviewed_by', 'reviewed_by_username',
 +            'rejection_reason'
 +        ]
 +        read_only_fields = [
 +            'id', 'status', 'submitted_at', 'reviewed_at',
 +            'reviewed_by', 'rejection_reason'
 +        ]
++
++
 +class ContributionCreateSerializer(serializers.ModelSerializer):
 +    """Serializer for creating contributions"""
 +    content_image = serializers.ImageField(required=False, allow_null=True)
++
 +    class Meta:
 +        model = Contribution
 +        fields = ['contributor_email', 'content_type', 'content_text', 'content_image']
++
 +    def validate(self, data):
 +        """Ensure content matches content_type"""
 +        content_type = data.get('content_type')
++
 +        if content_type in ['text', 'both'] and not data.get('content_text'):
 +            raise serializers.ValidationError(
 +                "Text content is required for text contributions"
 +            )
++
 +        if content_type in ['image', 'both'] and not data.get('content_image'):
 +            raise serializers.ValidationError(
 +                "Image is required for image contributions"
 +            )
++
 +        return data
++
++
 +class ContributionPublicSerializer(serializers.ModelSerializer):
 +    """Public view of approved contributions only"""
 +    contributor_display = serializers.SerializerMethodField()
++
 +    class Meta:
 +        model = Contribution
 +        fields = [
 +            'id', 'content_type', 'content_text', 'content_image',
 +            'submitted_at', 'contributor_display'
 +        ]
++
 +    def get_contributor_display(self, obj):
 +        """Partially mask email for privacy"""
 +        email = obj.contributor_email
 +        parts = email.split('@')
 +        if len(parts) == 2:
 +            name = parts[0]
 +            if len(name) > 2:
 +                masked = name[0] + '*' * (len(name) - 2) + name[-1]
 +            else:
 +                masked = name[0] + '*'
 +            return f"{masked}@{parts[1]}"
 +        return "Anonymous"
++
++
 +class ContributionReviewSerializer(serializers.Serializer):
 +    """Serializer for approving/rejecting contributions"""
 +    action = serializers.ChoiceField(choices=['approve', 'reject'])
 +    rejection_reason = serializers.CharField(required=False, allow_blank=True)
++
 +    def validate(self, data):
 +        if data['action'] == 'reject' and not data.get('rejection_reason'):
 +            raise serializers.ValidationError(
 +                "Rejection reason is required when rejecting a contribution"
 +            )
 +        return data
++
++
 +class PersonDetailSerializerWithContributions(PersonDetailSerializer):
 +    """Person details including approved contributions"""
 +    contributions = ContributionPublicSerializer(many=True, read_only=True)
++
 +    class Meta(PersonDetailSerializer.Meta):
 +        fields = PersonDetailSerializer.Meta.fields + ['contributions']
++
 +    def to_representation(self, instance):
 +        data = super().to_representation(instance)
 +        # Only show approved contributions
 +        data['contributions'] = ContributionPublicSerializer(
 +            instance.contributions.filter(status='approved'),
 +            many=True
 +        ).data
 +        return data

memorial/urls.pymodified

 +# memorial/urls.py
  from django.urls import path, include
  from rest_framework.routers import DefaultRouter
 -from .views import ConflictViewSet, PersonViewSet, memorial_index, search_filters, test_s3_connection
 +from rest_framework_nested import routers as nested_routers
 +from .views import (
 +    ConflictViewSet, PersonViewSet, ContributionViewSet,
 +    memorial_index, search_filters, test_s3_connection,
 +    pending_contributions, contribution_stats,
 +    create_contribution, get_csrf_token
 +)
 +# Main router
  router = DefaultRouter()
  router.register('conflicts', ConflictViewSet)
  router.register('persons', PersonViewSet)
 +# Nested router for person contributions (admin only except creation)
 +persons_router = nested_routers.NestedDefaultRouter(router, 'persons', lookup='person')
 +persons_router.register('contributions', ContributionViewSet, basename='person-contributions')
++
  urlpatterns = [
 -    path('', include(router.urls)),
 +    # CSRF token endpoint (must be first for frontend)
 +    path('csrf/', get_csrf_token, name='csrf-token'),
++
 +    # Public endpoints
      path('index/', memorial_index, name='memorial-index'),
      path('search-filters/', search_filters, name='search-filters'),
++
 +    # Contribution creation (public with throttling and CSRF)
 +    path('persons/<int:person_id>/contributions/', create_contribution, name='create-contribution'),
++
 +    # Admin-only endpoints
 +    path('contributions/pending/', pending_contributions, name='pending-contributions'),
 +    path('contributions/stats/', contribution_stats, name='contribution-stats'),
      path('test-s3/', test_s3_connection, name='test-s3'),
++
 +    # Include routers
 +    path('', include(router.urls)),
 +    path('', include(persons_router.urls)),
+ ]

memorial/views.pymodified

 -from rest_framework import viewsets, status
 -from rest_framework.decorators import action, api_view
 +from rest_framework import viewsets, status, permissions
 +from rest_framework.decorators import action, api_view, permission_classes, authentication_classes, parser_classes
  from rest_framework.response import Response
 -from django.http import HttpResponse, HttpResponseRedirect
 +from rest_framework.parsers import MultiPartParser, FormParser
 +from rest_framework.authentication import SessionAuthentication
 +from rest_framework.throttling import AnonRateThrottle, UserRateThrottle
 +from django.views.decorators.csrf import ensure_csrf_cookie
 +from django.middleware.csrf import get_token
 +from django.http import HttpResponse, HttpResponseRedirect, JsonResponse
  from django.db.models import Q
 +from django.core.exceptions import ValidationError
 +from django.core.files.uploadedfile import UploadedFile
  from datetime import datetime
  import boto3
  from botocore.exceptions import ClientError
  from django.conf import settings
 -from .models import Conflict, Person
 +from PIL import Image
 +import io
++
 +from .models import Conflict, Person, Contribution
  from .serializers import (
      ConflictSerializer, ConflictDetailSerializer,
      PersonListSerializer, PersonDetailSerializer,
 -    PersonSearchSerializer
 +    PersonSearchSerializer, PersonDetailSerializerWithContributions,
 +    ContributionSerializer, ContributionCreateSerializer,
 +    ContributionPublicSerializer, ContributionReviewSerializer
+ )
 +# Constants for contribution validation
 +MAX_IMAGE_SIZE = 10 * 1024 * 1024  # 10MB
 +ALLOWED_IMAGE_TYPES = ['image/jpeg', 'image/png', 'image/gif', 'image/webp']
 +MAX_IMAGE_DIMENSIONS = (4000, 4000)  # Max width/height
++
++
  class ConflictViewSet(viewsets.ReadOnlyModelViewSet):
      """API endpoints for conflicts"""
      queryset = Conflict.objects.all()
              return PersonListSerializer
          elif self.action == 'search':
              return PersonSearchSerializer
 -        return PersonDetailSerializer
 +        return PersonDetailSerializerWithContributions
      def get_queryset(self):
          queryset = super().get_queryset()
          if conflict_id is not None:
              queryset = queryset.filter(conflict_id=conflict_id)
 -            # For conflict-specific queries, order by class year ascending (earliest first), then name
              return queryset.extra(
                  select={'class_year_null': 'class_year IS NULL'},
                  order_by=['class_year_null', 'class_year', 'last_name', 'first_name']
+             )
 -        # Allow ordering by different fields via query param
          order_by = self.request.query_params.get('order_by', 'name')
          if order_by == 'class_year':
 -            # Order by class year ascending (earliest first), then name
              return queryset.order_by('class_year', 'last_name', 'first_name')
          else:
 -            # Default ordering by name
              return queryset.order_by('last_name', 'first_name')
      @action(detail=False, methods=['get'])
                  except ValueError:
                      pass
 -        # Order results - by class year ascending (earliest first) then name
          queryset = queryset.extra(
              select={'class_year_null': 'class_year IS NULL'},
              order_by=['class_year_null', 'class_year', 'last_name', 'first_name']
+         )
 -        # Paginate if needed (for now, return all for infinite scroll)
          serializer = PersonSearchSerializer(queryset, many=True)
          return Response({
              'count': queryset.count(),
                  import os
                  file_path = os.path.join(settings.MEDIA_ROOT, person.pdf_key)
                  response = FileResponse(open(file_path, 'rb'), content_type='application/pdf')
 -                # FIXED: Allow iframe embedding for PDF viewer
                  response['X-Frame-Options'] = 'SAMEORIGIN'
                  return response
              except FileNotFoundError:
                  region_name=settings.AWS_S3_REGION_NAME
+             )
 -            # Generate presigned URL
              presigned_url = s3_client.generate_presigned_url(
                  'get_object',
                  Params={
                  ExpiresIn=3600  # URL expires in 1 hour
+             )
 -            # FIXED: Return a redirect response instead of JSON
 -            # This allows the iframe to load the PDF directly from S3
              response = HttpResponseRedirect(presigned_url)
 -            # Allow iframe embedding for PDF viewer
              response['X-Frame-Options'] = 'SAMEORIGIN'
              return response
          except ClientError as e:
 -            print(f"Error generating presigned URL: {e}")
              return Response(
                  {"error": "Failed to generate PDF URL"},
                  status=status.HTTP_500_INTERNAL_SERVER_ERROR
+             )
++
 +    @action(detail=True, methods=['get'])
 +    def contributions(self, request, pk=None):
 +        """Get approved contributions for a person"""
 +        person = self.get_object()
 +        contributions = person.contributions.filter(status='approved')
 +        serializer = ContributionPublicSerializer(contributions, many=True)
 +        return Response({
 +            'count': contributions.count(),
 +            'results': serializer.data
 +        })
++
++
 +class ContributionViewSet(viewsets.ModelViewSet):
 +    """API endpoints for contributions - Admin only except for creation"""
 +    queryset = Contribution.objects.all()
 +    parser_classes = (MultiPartParser, FormParser)
++
 +    def get_serializer_class(self):
 +        if self.action == 'create':
 +            return ContributionCreateSerializer
 +        elif self.action == 'review':
 +            return ContributionReviewSerializer
 +        return ContributionSerializer
++
 +    def get_permissions(self):
 +        """
 +        Anyone can create contributions (with throttling)
 +        Only admin can list, update, or delete
 +        """
 +        if self.action == 'create':
 +            return [permissions.AllowAny()]
 +        return [permissions.IsAdminUser()]
++
 +    def get_throttles(self):
 +        """Apply throttling to creation"""
 +        if self.action == 'create':
 +            return [AnonRateThrottle()]
 +        return []
++
 +    def validate_image(self, image_file):
 +        """Validate uploaded image"""
 +        if image_file.size > MAX_IMAGE_SIZE:
 +            raise ValidationError(f"Image size must be less than {MAX_IMAGE_SIZE // 1024 // 1024}MB")
++
 +        if image_file.content_type not in ALLOWED_IMAGE_TYPES:
 +            raise ValidationError(f"Image type must be one of: {', '.join(ALLOWED_IMAGE_TYPES)}")
++
 +        try:
 +            img = Image.open(image_file)
 +            img.verify()
++
 +            image_file.seek(0)
 +            img = Image.open(image_file)
++
 +            if img.width > MAX_IMAGE_DIMENSIONS[0] or img.height > MAX_IMAGE_DIMENSIONS[1]:
 +                raise ValidationError(
 +                    f"Image dimensions must be less than {MAX_IMAGE_DIMENSIONS[0]}x{MAX_IMAGE_DIMENSIONS[1]}"
 +                )
++
 +            image_file.seek(0)
++
 +        except Exception as e:
 +            raise ValidationError(f"Invalid image file: {str(e)}")
++
 +    def create(self, request, *args, **kwargs):
 +        """Create a new contribution with validation"""
 +        person_id = self.kwargs.get('person_pk')
++
 +        if not person_id:
 +            return Response(
 +                {"error": "Person ID not found in URL"},
 +                status=status.HTTP_400_BAD_REQUEST
 +            )
++
 +        try:
 +            person = Person.objects.get(pk=person_id)
 +        except Person.DoesNotExist:
 +            return Response(
 +                {"error": "Person not found"},
 +                status=status.HTTP_404_NOT_FOUND
 +            )
++
 +        serializer = self.get_serializer(data=request.data)
 +        serializer.is_valid(raise_exception=True)
++
 +        # Validate image if provided
 +        image = request.FILES.get('content_image')
 +        if image:
 +            try:
 +                self.validate_image(image)
 +            except ValidationError as e:
 +                return Response(
 +                    {"error": str(e)},
 +                    status=status.HTTP_400_BAD_REQUEST
 +                )
++
 +        contribution = serializer.save(person=person)
++
 +        return Response(
 +            ContributionSerializer(contribution).data,
 +            status=status.HTTP_201_CREATED
 +        )
++
 +    @action(detail=True, methods=['post'], permission_classes=[permissions.IsAdminUser])
 +    def review(self, request, pk=None):
 +        """Approve or reject a contribution"""
 +        contribution = self.get_object()
 +        serializer = self.get_serializer(data=request.data)
 +        serializer.is_valid(raise_exception=True)
++
 +        action = serializer.validated_data['action']
++
 +        if action == 'approve':
 +            contribution.approve(request.user)
 +        else:  # reject
 +            rejection_reason = serializer.validated_data.get('rejection_reason', '')
 +            contribution.reject(request.user, rejection_reason)
++
 +        return Response(ContributionSerializer(contribution).data)
++
 +    def list(self, request, *args, **kwargs):
 +        """List contributions with filtering (admin only)"""
 +        queryset = self.get_queryset()
++
 +        status_filter = request.query_params.get('status')
 +        if status_filter:
 +            queryset = queryset.filter(status=status_filter)
++
 +        person_id = request.query_params.get('person')
 +        if person_id:
 +            queryset = queryset.filter(person_id=person_id)
++
 +        queryset = queryset.order_by('-submitted_at')
++
 +        serializer = self.get_serializer(queryset, many=True)
 +        return Response({
 +            'count': queryset.count(),
 +            'results': serializer.data
 +        })
  @api_view(['GET'])
      data = []
      for conflict in conflicts:
 -        # Order by class year ascending (earliest first), then by name
 -        # Use raw SQL ordering to put nulls last
          casualties = Person.objects.filter(conflict=conflict).extra(
              select={'class_year_null': 'class_year IS NULL'},
              order_by=['class_year_null', 'class_year', 'last_name', 'first_name']
          'class_years': list(class_years)
      })
++
 +# Admin-only views for managing contributions
 +@api_view(['GET'])
 +@permission_classes([permissions.IsAdminUser])
 +def pending_contributions(request):
 +    """Get all pending contributions for admin review"""
 +    contributions = Contribution.objects.filter(status='pending').order_by('-submitted_at')
++
 +    data = []
 +    for contrib in contributions:
 +        contrib_data = ContributionSerializer(contrib).data
 +        contrib_data['person_details'] = PersonListSerializer(contrib.person).data
 +        data.append(contrib_data)
++
 +    return Response({
 +        'count': contributions.count(),
 +        'results': data
 +    })
++
++
 +@api_view(['GET'])
 +@permission_classes([permissions.IsAdminUser])
 +def contribution_stats(request):
 +    """Get statistics about contributions"""
 +    from django.db.models import Count
++
 +    stats = Contribution.objects.aggregate(
 +        total=Count('id'),
 +        pending=Count('id', filter=Q(status='pending')),
 +        approved=Count('id', filter=Q(status='approved')),
 +        rejected=Count('id', filter=Q(status='rejected'))
 +    )
++
 +    recent = Contribution.objects.order_by('-submitted_at')[:10]
++
 +    return Response({
 +        'stats': stats,
 +        'recent': ContributionSerializer(recent, many=True).data
 +    })
++
++
  @api_view(['GET'])
 +@permission_classes([permissions.IsAdminUser])
  def test_s3_connection(request):
 -    """Test S3 configuration in production"""
 +    """Test S3 configuration in production - Admin only"""
      try:
          import boto3
          from django.conf import settings
 -        # Check if credentials are set
          if not settings.AWS_ACCESS_KEY_ID:
              return Response({
                  "error": "AWS_ACCESS_KEY_ID not configured",
                  "bucket": settings.AWS_STORAGE_BUCKET_NAME
              })
 -        # Try to connect to S3
          s3_client = boto3.client(
              's3',
              aws_access_key_id=settings.AWS_ACCESS_KEY_ID,
              region_name=settings.AWS_S3_REGION_NAME
+         )
 -        # List objects
          response = s3_client.list_objects_v2(
              Bucket=settings.AWS_STORAGE_BUCKET_NAME,
              MaxKeys=5
              "error": str(e),
              "type": type(e).__name__,
              "debug": settings.DEBUG
 -        }, status=500)
 +        }, status=500)
++
++
 +@api_view(['POST'])
 +@parser_classes([MultiPartParser, FormParser])
 +@permission_classes([permissions.AllowAny])
 +def create_contribution(request, person_id):
 +    """Simple endpoint to create a contribution with CSRF and throttling"""
 +    # Apply throttling
 +    throttle = AnonRateThrottle()
 +    if not throttle.allow_request(request, None):
 +        return Response(
 +            {"error": "Rate limit exceeded. Please try again later."},
 +            status=status.HTTP_429_TOO_MANY_REQUESTS
 +        )
++
 +    try:
 +        person = Person.objects.get(pk=person_id)
 +    except Person.DoesNotExist:
 +        return Response(
 +            {"error": "Person not found"},
 +            status=status.HTTP_404_NOT_FOUND
 +        )
++
 +    serializer = ContributionCreateSerializer(data=request.data)
 +    if not serializer.is_valid():
 +        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
++
 +    # Validate image if provided
 +    image = request.FILES.get('content_image')
 +    if image:
 +        if image.size > MAX_IMAGE_SIZE:
 +            return Response(
 +                {"error": f"Image size must be less than {MAX_IMAGE_SIZE // 1024 // 1024}MB"},
 +                status=status.HTTP_400_BAD_REQUEST
 +            )
++
 +        if image.content_type not in ALLOWED_IMAGE_TYPES:
 +            return Response(
 +                {"error": f"Image type must be one of: {', '.join(ALLOWED_IMAGE_TYPES)}"},
 +                status=status.HTTP_400_BAD_REQUEST
 +            )
++
 +    contribution = serializer.save(person=person)
++
 +    return Response(
 +        ContributionSerializer(contribution).data,
 +        status=status.HTTP_201_CREATED
 +    )
++
 +@api_view(['GET'])
 +@ensure_csrf_cookie
 +def get_csrf_token(request):
 +    """Get CSRF token for frontend"""
 +    return JsonResponse({
 +        'csrfToken': get_token(request)
 +    })

vmi_wardead_be/settings.pymodified

  # SECURITY WARNING: don't run with debug turned on in production!
  DEBUG = config('DEBUG', default=False, cast=bool)
 -ALLOWED_HOSTS = ['localhost', '127.0.0.1', '.up.railway.app']  # Railway domains
+-
 -# CSRF Trusted Origins for Railway
 -CSRF_TRUSTED_ORIGINS = [
 -    'https://*.up.railway.app',
 -    'http://localhost:3000',
 -    'http://127.0.0.1:3000',
 -]
 +# Production-ready allowed hosts
 +if DEBUG:
 +    ALLOWED_HOSTS = ['localhost', '127.0.0.1', '.up.railway.app']
 +else:
 +    ALLOWED_HOSTS = [
 +        '.up.railway.app',
 +        'vmimemorial.com',
 +        'www.vmimemorial.com',
 +        config('ALLOWED_HOST', default=''),  # Allow custom domain via env var
 +    ]
 +    # Remove empty strings
 +    ALLOWED_HOSTS = [host for host in ALLOWED_HOSTS if host]
++
 +# CSRF Trusted Origins
 +if DEBUG:
 +    CSRF_TRUSTED_ORIGINS = [
 +        'http://localhost:3000',
 +        'http://127.0.0.1:3000',
 +        'https://*.up.railway.app',
 +    ]
 +else:
 +    CSRF_TRUSTED_ORIGINS = [
 +        'https://vmimemorial.com',
 +        'https://www.vmimemorial.com',
 +        'https://*.up.railway.app',
 +    ]
  # Application definition
+-
  INSTALLED_APPS = [
      'django.contrib.admin',
      'django.contrib.auth',
  MIDDLEWARE = [
      'django.middleware.security.SecurityMiddleware',
 -    'whitenoise.middleware.WhiteNoiseMiddleware',  # Add this for static files
 -    'corsheaders.middleware.CorsMiddleware',  # Add this before CommonMiddleware
 +    'whitenoise.middleware.WhiteNoiseMiddleware',
 +    'corsheaders.middleware.CorsMiddleware',
      'django.contrib.sessions.middleware.SessionMiddleware',
      'django.middleware.common.CommonMiddleware',
      'django.middleware.csrf.CsrfViewMiddleware',
  # Database
 -# https://docs.djangoproject.com/en/5.0/ref/settings/#databases
+-
  DATABASES = {
      'default': dj_database_url.parse(config('DATABASE_URL'))
+ }
  # Password validation
 -# https://docs.djangoproject.com/en/5.0/ref/settings/#auth-password-validators
+-
  AUTH_PASSWORD_VALIDATORS = [
+     {
          'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
  # Internationalization
 -# https://docs.djangoproject.com/en/5.0/topics/i18n/
+-
  LANGUAGE_CODE = 'en-us'
+-
 -TIME_ZONE = 'America/New_York'  # Adjust for VMI's location
+-
 +TIME_ZONE = 'America/New_York'  # VMI's location
  USE_I18N = True
+-
  USE_TZ = True
 -# Static files (CSS, JavaScript, Images)
 -# https://docs.djangoproject.com/en/5.0/howto/static-files/
+-
 +# Static files
  STATIC_URL = 'static/'
  STATIC_ROOT = BASE_DIR / 'staticfiles'
  # Default primary key field type
 -# https://docs.djangoproject.com/en/5.0/ref/settings/#default-auto-field
+-
  DEFAULT_AUTO_FIELD = 'django.db.models.BigAutoField'
 -# CORS settings for Next.js frontend
 -CORS_ALLOWED_ORIGINS = [
 -    "http://localhost:3000",
 -    "http://127.0.0.1:3000",
 -    "https://vmimemorial.com",
 -    "https://www.vmimemorial.com",
 +# CORS settings - Environment-dependent
 +if DEBUG:
 +    CORS_ALLOW_ALL_ORIGINS = False
 +    CORS_ALLOWED_ORIGINS = [
 +        "http://localhost:3000",
 +        "http://127.0.0.1:3000",
 +    ]
 +else:
 +    CORS_ALLOW_ALL_ORIGINS = False
 +    CORS_ALLOWED_ORIGINS = [
 +        "https://vmimemorial.com",
 +        "https://www.vmimemorial.com",
 +    ]
++
 +CORS_ALLOW_CREDENTIALS = True
 +CORS_ALLOWED_METHODS = [
 +    'DELETE',
 +    'GET',
 +    'OPTIONS',
 +    'PATCH',
 +    'POST',
 +    'PUT',
 +]
 +CORS_ALLOWED_HEADERS = [
 +    'accept',
 +    'accept-encoding',
 +    'authorization',
 +    'content-type',
 +    'dnt',
 +    'origin',
 +    'user-agent',
 +    'x-csrftoken',
 +    'x-requested-with',
+ ]
++
  # REST Framework settings
  REST_FRAMEWORK = {
      'DEFAULT_PAGINATION_CLASS': 'rest_framework.pagination.PageNumberPagination',
      'PAGE_SIZE': 100,
      'DEFAULT_PERMISSION_CLASSES': [
          'rest_framework.permissions.IsAuthenticatedOrReadOnly',
 -    ]
 +    ],
 +    'DEFAULT_AUTHENTICATION_CLASSES': [
 +        'rest_framework.authentication.SessionAuthentication',
 +    ],
 +    'DEFAULT_THROTTLE_CLASSES': [
 +        'rest_framework.throttling.AnonRateThrottle',
 +        'rest_framework.throttling.UserRateThrottle'
 +    ],
 +    'DEFAULT_THROTTLE_RATES': {
 +        'anon': '60/hour',    # Anonymous users: 60 requests per hour
 +        'user': '1000/hour'   # Authenticated users: 1000 per hour
 +    }
+ }
 +# Contribution-specific settings
 +CONTRIBUTION_IMAGE_MAX_SIZE = 10 * 1024 * 1024  # 10MB
 +CONTRIBUTION_ALLOWED_IMAGE_TYPES = ['image/jpeg', 'image/png', 'image/gif', 'image/webp']
 +CONTRIBUTION_IMAGE_MAX_DIMENSIONS = (4000, 4000)
++
  # AWS S3 Configuration
  AWS_ACCESS_KEY_ID = config('AWS_ACCESS_KEY_ID', default='')
  AWS_SECRET_ACCESS_KEY = config('AWS_SECRET_ACCESS_KEY', default='')
  AWS_S3_FILE_OVERWRITE = False
  AWS_S3_SIGNATURE_VERSION = 's3v4'
 -# Media files
 +# Media files configuration
  MEDIA_URL = '/media/'
  MEDIA_ROOT = BASE_DIR / 'media'
      DEFAULT_FILE_STORAGE = 'storages.backends.s3boto3.S3Boto3Storage'
      MEDIA_URL = f'https://{AWS_S3_CUSTOM_DOMAIN}/'
  else:
 -    # Use local file storage in development
      DEFAULT_FILE_STORAGE = 'django.core.files.storage.FileSystemStorage'
  # Security settings for production
  if not DEBUG:
 +    # Security headers and HTTPS
      SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
      SECURE_SSL_REDIRECT = True
 +    SECURE_HSTS_SECONDS = 31536000  # 1 year
 +    SECURE_HSTS_INCLUDE_SUBDOMAINS = True
 +    SECURE_HSTS_PRELOAD = True
++
 +    # Cookie security
      SESSION_COOKIE_SECURE = True
 -    CSRF_COOKIE_SECURE = True
 +    CSRF_COOKIE_SECURE = True
 +    SESSION_COOKIE_HTTPONLY = True
 +    CSRF_COOKIE_HTTPONLY = True
++
 +    # Content security
 +    SECURE_CONTENT_TYPE_NOSNIFF = True
 +    SECURE_BROWSER_XSS_FILTER = True
 +    X_FRAME_OPTIONS = 'DENY'  # Prevent clickjacking (except for PDF viewer)
++
 +    # Additional security
 +    SECURE_REFERRER_POLICY = 'strict-origin-when-cross-origin'
++
 +# Logging configuration for production
 +if not DEBUG:
 +    LOGGING = {
 +        'version': 1,
 +        'disable_existing_loggers': False,
 +        'handlers': {
 +            'console': {
 +                'class': 'logging.StreamHandler',
 +            },
 +        },
 +        'root': {
 +            'handlers': ['console'],
 +            'level': 'INFO',
 +        },
 +        'loggers': {
 +            'django': {
 +                'handlers': ['console'],
 +                'level': 'INFO',
 +                'propagate': False,
 +            },
 +            'memorial': {
 +                'handlers': ['console'],
 +                'level': 'INFO',
 +                'propagate': False,
 +            },
 +        },
 +    }
++
 +# Email settings (for future contribution notifications)
 +EMAIL_BACKEND = 'django.core.mail.backends.console.EmailBackend' if DEBUG else 'django.core.mail.backends.smtp.EmailBackend'
 +if not DEBUG:
 +    EMAIL_HOST = config('EMAIL_HOST', default='')
 +    EMAIL_PORT = config('EMAIL_PORT', default=587, cast=int)
 +    EMAIL_USE_TLS = config('EMAIL_USE_TLS', default=True, cast=bool)
 +    EMAIL_HOST_USER = config('EMAIL_HOST_USER', default='')
 +    EMAIL_HOST_PASSWORD = config('EMAIL_HOST_PASSWORD', default='')
 +    DEFAULT_FROM_EMAIL = config('DEFAULT_FROM_EMAIL', default='noreply@vmimemorial.com')
 +    ADMIN_EMAIL = config('ADMIN_EMAIL', default='admin@vmimemorial.com')