first version

accounts/auth.py

@@ -0,0 +1,29 @@
+from typing import Optional
+
+from django.http import HttpRequest
+from ninja.security import HttpBearer, django_auth
+
+from accounts.models import ApiToken
+
+
+class TokenAuth(HttpBearer):
+    """`Authorization: Bearer <key>` — how the Flutter app authenticates."""
+
+    def authenticate(self, request: HttpRequest, token: str) -> Optional[ApiToken]:
+        try:
+            api_token = ApiToken.objects.select_related("user").get(key=token)
+        except ApiToken.DoesNotExist:
+            return None
+
+        if not api_token.user.is_active:
+            return None
+
+        api_token.touch()
+        # Downstream views read request.user, same as with session auth.
+        request.user = api_token.user
+        return api_token
+
+
+# Bearer first: a request carrying a token never reaches the cookie auth, which
+# would reject it for a missing CSRF token.
+AUTH = [TokenAuth(), django_auth]