From 62b6f07c0eb60310f2237fdf41f72ee05d7fb733 Mon Sep 17 00:00:00 2001 From: mohsentaba Date: Sat, 23 May 2026 10:47:23 +0330 Subject: [PATCH] livesession recording file smart authorization and logging added. --- apps/course/views/live_session.py | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/apps/course/views/live_session.py b/apps/course/views/live_session.py index 557dcdd..fa34c59 100644 --- a/apps/course/views/live_session.py +++ b/apps/course/views/live_session.py @@ -6,7 +6,7 @@ from django.utils import timezone from rest_framework import status from rest_framework.generics import GenericAPIView -from rest_framework.permissions import IsAuthenticated +from rest_framework.permissions import IsAuthenticated, AllowAny from rest_framework.authentication import TokenAuthentication from rest_framework.response import Response from drf_yasg.utils import swagger_auto_schema @@ -599,7 +599,7 @@ class CourseLiveSessionTokenAPIView(GenericAPIView): class CourseLiveSessionRecordedFileAPIView(GenericAPIView): - permission_classes = [IsAuthenticated] + permission_classes = [AllowAny] authentication_classes = [TokenAuthentication] serializer_class = LiveSessionRecordingSerializer @@ -621,7 +621,9 @@ class CourseLiveSessionRecordedFileAPIView(GenericAPIView): } ) def patch(self, request, room_slug, *args, **kwargs): - logger.info(f"[LiveSession Recorded File] Request from user_id={request.user.id} for room_slug={room_slug}") + logger.info(f"[LiveSession Recorded File] Request headers: {dict(request.headers)}") + user_id = request.user.id if request.user else None + logger.info(f"[LiveSession Recorded File] Request from user_id={user_id} for room_slug={room_slug}") import re match = re.search(r'\d+', room_slug) @@ -634,14 +636,19 @@ class CourseLiveSessionRecordedFileAPIView(GenericAPIView): course = get_object_or_404(Course, id=course_id) - if not request.user.can_manage_course(course): - logger.warning(f"[LiveSession Recorded File] Permission denied - user_id={request.user.id} course_id={course_id}") - raise AppAPIException({'message': 'You do not have permission to update this course.'}, status_code=status.HTTP_403_FORBIDDEN) + # If user is authenticated, enforce permissions. + # Otherwise, allow the background recording service to proceed. + if request.user and request.user.is_authenticated: + if not request.user.can_manage_course(course): + logger.warning(f"[LiveSession Recorded File] Permission denied - user_id={request.user.id} course_id={course_id}") + raise AppAPIException({'message': 'You do not have permission to update this course.'}, status_code=status.HTTP_403_FORBIDDEN) + else: + logger.info(f"[LiveSession Recorded File] Allowing unauthenticated recording registration for room_slug={room_slug}") try: session = course.live_sessions.latest('-started_at') except CourseLiveSession.DoesNotExist: - logger.warning(f"[LiveSession Recorded File] No active session found - course_id={course_id} user_id={request.user.id}") + logger.warning(f"[LiveSession Recorded File] No active session found - course_id={course_id}") raise AppAPIException({'message': 'No live session found for this course.'}, status_code=status.HTTP_404_NOT_FOUND) logger.info(f"[LiveSession Recorded File] Latest session found - session_id={session.id} course_id={course_id}") @@ -657,7 +664,7 @@ class CourseLiveSessionRecordedFileAPIView(GenericAPIView): file_time=serializer.validated_data.get('file_time'), ) - logger.info(f"[LiveSession Recorded File] Recording created successfully - recording_id={recording.id} session_id={session.id} user_id={request.user.id}") + logger.info(f"[LiveSession Recorded File] Recording created successfully - recording_id={recording.id} session_id={session.id}") return Response({ 'id': recording.id,