added staging & prod https support to core.settings

.woodpecker.yaml

@@ -1,6 +1,16 @@
+services:
+  - name: postgres
+    image: postgres:16
+    environment:
+      POSTGRES_DB: python_tdd_test
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: postgres
+
 steps:
-  - name: test-UTs
+  - name: test-UTs-n-ITs
     image: python:3.13-slim
+    environment:
+      DATABASE_URL: postgresql://postgres:postgres@postgres/python_tdd_test
     commands:
       - pip install -r requirements.txt
       - cd ./src

infra/deploy-playbook.yaml

@@ -50,37 +50,6 @@
     - name: Reset ssh connection to allow the user/group change to take effect
       ansible.builtin.meta: reset_connection
 
-    - name: Build container image locally
-      community.docker.docker_image:
-        name: gamearray
-        source: build
-        state: present
-        build:
-          path: /mnt/d/cosmovault/latticework/oreilly/percival/python-tdd
-          platform: linux/amd64
-        force_source: true
-      delegate_to: 127.0.0.1
-
-    - name: Export container image locally
-      community.docker.docker_image:
-        name: gamearray
-        archive_path: /tmp/gamearray-img.tar
-        source: local
-      delegate_to: 127.0.0.1
-
-    - name: Upload image to server
-      ansible.builtin.copy:
-        src: /tmp/gamearray-img.tar
-        dest: /tmp/gamearray-img.tar
-
-    - name: Import container image on server
-      community.docker.docker_image:
-        name: gamearray
-        load_path: /tmp/gamearray-img.tar
-        source: load
-        force_source: true
-        state: present
-
     - name: Ensure .secret-key files exists
       # the intention is that this only happens once per server
       ansible.builtin.copy:
@@ -120,27 +89,45 @@
         cmd: docker login gitea.earthmanrpg.me -u discoman -p {{ gitea_registry_token }}
       no_log: true
 
-    - name: Ensure db.sqlite3 file exists outside container
-      ansible.builtin.file:
-        path: "{{ ansible_env.HOME }}/db.sqlite3"
-        state: touch
-        owner: 1234 # so nonroot user can access it in container
-      become: true # needed for ownership change
+    - name: Create Docker network
+      community.docker.docker_network:
+        name: gamearray_net
+        state: present
+
+    - name: Create Postgres data volume
+      community.docker.docker_volume:
+        name: gamearray_postgres_data
+        state: present
+
+    - name: Start Postgres container
+      community.docker.docker_container:
+        name: gamearray_postgres
+        image: postgres:16
+        state: started
+        restart_policy: unless-stopped
+        networks:
+          - name: gamearray_net
+        volumes:
+          - gamearray_postgres_data:/var/lib/postgresql/data
+        env:
+          POSTGRES_DB: gamearray
+          POSTGRES_USER: gamearray
+          POSTGRES_PASSWORD: "{{ postgres_password }}"
 
     - name: Run container
       community.docker.docker_container:
         name: gamearray
-        image: gamearray
+        image: gitea.earthmanrpg.me/discoman/gamearray:latest
         state: started
         recreate: true
         env:
           DJANGO_DEBUG_FALSE: "1"
           DJANGO_SECRET_KEY: "{{ secret_key.content | b64decode }}"
           DJANGO_ALLOWED_HOST: "{{ django_allowed_host }}"
-          DJANGO_DB_PATH: "/home/nonroot/db.sqlite3"
-          EMAIL_HOST_USER: "{{ email_host_user }}"
-          EMAIL_HOST_PASSWORD: "{{ email_host_password }}"
+          DATABASE_URL: "postgresql://gamearray:{{ postgres_password }}@gamearray_postgres/gamearray"
           MAILGUN_API_KEY: "{{  mailgun_api_key }}"
+        networks:
+          - name: gamearray_net
         ports:
           127.0.0.1:8888:8888
 
@@ -160,7 +147,7 @@
     - name: Run migration inside container
       community.docker.docker_container_exec:
         container: gamearray
-        command: ./manage.py migrate
+        command: python manage.py migrate
 
   handlers:
     - name: Restart nginx

infra/deploy.sh.j2

@@ -13,6 +13,7 @@ docker rm gamearray 2>/dev/null || true
 echo "==> Starting new container..."
 docker run -d --name gamearray \
     --env-file /opt/gamearray/gamearray.env \
+    --network gamearray_net \
     -p 127.0.0.1:8888:8888 \
     "$IMAGE"
 

infra/gamearray.env.j2

@@ -1,7 +1,5 @@
 DJANGO_DEBUG_FALSE=1
 DJANGO_SECRET_KEY={{ secret_key.content | b64decode }}
 DJANGO_ALLOWED_HOST={{ django_allowed_host }}
-DJANGO_DB_PATH=/home/nonroot/db.sqlite3
-EMAIL_HOST_USER={{ email_host_user }}
-EMAIL_HOST_PASSWORD={{ email_host_password }}
+DATABASE_URL=postgresql://gamearray:{{ postgres_password }}@gamearray_postgres/gamearray
 MAILGUN_API_KEY={{ mailgun_api_key }}

infra/group_vars/staging/vault.yaml

@@ -1,28 +1,23 @@
 $ANSIBLE_VAULT;1.1;AES256
-36653566363731653435616430626663303038623766663561363231333163336165623863613964
-6164383861643530366438623465613565373032396331350a666163636431636663353162383531
-34306534656430653533303530613764336438616536343534663236333665323837636337333334
-3432643436636265610a313465396435616263386631353336326464333930613865313934313032
-38353362623937643234333466323063336535623666613366633263623034616638653566666463
-66323032653034376663623933306162313832643038653764643864666433376236643163663637
-63626334393963343934666665373764393066383866616461333063633664363436613031663036
-61343939343633393138666637646137376537393335663032383839306365613764303833323338
-33343936333730373362393466373238636666343762373134633962383237623335373634656330
-37363039393261313034306166656563333461353034646234323462623631393338383461363961
-33356564633637333630663464613265666264393435363238383530333861636365616362316130
-38353464343064616463636535316339336430323866303161393065363830356431386430666534
-61353961666333313536616661636631643630373337633262653662393863336264636431366634
-32323533383963393435343935616135663262633634356631363632396233383839326365396333
-64333232626465643438313132323661386235313063303036303631376537353666313532323766
-63633834336631633364333334373461333836666630353363343365323033653234356536643939
-30316538663230653636316532393931333936613733336366326239633362353666636436636136
-64656134663733376630316536616138613234383838316138616433353531396363316462626133
-62383431396465333634623066333565643332613935653532613536646632346533383362393330
-38646562393762346434663666313431363037636463306435663263386336343461303839346365
-63326432643662353830383736613636643866363765366132653563363036316265646531623433
-30303131323165653564333331353233373731333539346163613564343331373931633365633631
-66396332653436376430626564316639623362383635633134343234626462333162336464656438
-65393062333631373836303662326436333265373033353339356334633666363065636164343239
-64623535663633653130643764656539643339633061646437643366376261383137613439323934
-37343338336130313339356531333038613334393736353365366662313262653737623533616366
-346430623266646464353639386266313339
+33616230376431343735626631623932393166343538653732383533323436326335343463646664
+6565373531623465613661613533376231373837326438300a393665613839646231633737313938
+64633035336663313163333634623732323537326363646132313136376131636666636538323066
+3037373930303537320a313062646166353862633836373466316261363939633433663039323866
+62333739303662343836306538393734343830366336323265393138343438363533353166383031
+32313461313137643039376237346633316466646136353038633861333031663164656233366634
+38303363383130376264373861393863623330623733643135643461383132613339376633353031
+32313863323039646534633733383661333361313832333830383066633130396239626661643264
+65636335303339613432326533343337366261356632313639623634386633383836333733663536
+39383361353530646166643531333535356636326535383534326237666638326137616162646261
+65316466323335653932636338653565383038313531383638393839313736643739363037353230
+35653632353531656435396663316537333133653632366437613339303033333536643937353166
+64363037653733303332643931343362303261643432366531326262383465313965633064356338
+31336333373665373035656533633864316139303934623030383934393434356334643962666163
+33343739366336613263333764306365333566363536616662383733616237396563346132336633
+38663239613339376335386233386330396634323033343332366130616162666339393861306336
+35383566383831356530633130313732356331616164646132626665646235396635386237313538
+38656631336261646530303761643334303937613036363766303637376262373466316431323731
+38666462313639353131303134646434646135366136343361353932326165626666306361393431
+62646238323265346263386363373462313766616333326366366461346436383064336535376339
+31356566356336386262393831616631666233633930393263623563386265343237323133313832
+3430363635363332303963316530663765613666306233376463

infra/nginx.conf.j2

@@ -1,6 +1,6 @@
 server {
     listen 80;
-    server_name {{ django_allowed_host }};
+    server_name {{ django_allowed_host | replace(',', ' ')}};
 
     location /static/ {
         alias /var/www/gamearray/static/;

requirements.dev.txt

@@ -3,7 +3,9 @@ attrs==25.4.0
 certifi==2025.11.12
 cffi==2.0.0
 charset-normalizer==3.4.4
+coverage
 cssselect==1.3.0
+dj-database-url
 Django==6.0
 django-stubs==5.2.8
 django-stubs-ext==5.2.8

requirements.txt

@@ -1,8 +1,10 @@
 cssselect==1.3.0
 Django==6.0
+dj-database-url
 django-stubs==5.2.8
 django-stubs-ext==5.2.8
 gunicorn==23.0.0
 lxml==6.0.2
+psycopg2-binary
 requests==2.31.0
 whitenoise==6.11.0

src/.coveragerc

@@ -0,0 +1,8 @@
+[run]
+source = apps
+omit =
+    */migrations/*
+    */tests/*
+
+[report]
+show_missing = true

src/apps/dashboard/migrations/0003_list_shared_with.py

@@ -0,0 +1,20 @@
+# Generated by Django 6.0 on 2026-02-18 18:13
+
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('dashboard', '0002_list_owner'),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='list',
+            name='shared_with',
+            field=models.ManyToManyField(blank=True, related_name='shared_lists', to=settings.AUTH_USER_MODEL),
+        ),
+    ]

src/apps/dashboard/models.py

@@ -10,6 +10,12 @@ class List(models.Model):
         on_delete=models.CASCADE,
     )
 
+    shared_with = models.ManyToManyField(
+        "lyric.User",
+        related_name="shared_lists",
+        blank=True,
+    )
+
     @property
     def name(self):
         return self.item_set.first().text

src/apps/dashboard/tests/integrated/test_forms.py

@@ -1,18 +1,15 @@
 from django.test import TestCase
-from ..forms import (
+
+from apps.dashboard.forms import (
     DUPLICATE_ITEM_ERROR,
     EMPTY_ITEM_ERROR,
     ExistingListItemForm,
     ItemForm,
 )
-from ..models import Item, List
+from apps.dashboard.models import Item, List
+
 
 class ItemFormTest(TestCase):
-    def test_form_validation_for_blank_items(self):
-        form = ItemForm(data={"text": ""})
-        self.assertFalse(form.is_valid())
-        self.assertEqual(form.errors["text"], [EMPTY_ITEM_ERROR])
-
     def test_form_save_handles_saving_to_a_list(self):
         mylist = List.objects.create()
         form = ItemForm(data={"text": "do re mi"})

src/apps/dashboard/tests/integrated/test_models.py

@@ -1,14 +1,12 @@
 from django.core.exceptions import ValidationError
 from django.db.utils import IntegrityError
 from django.test import TestCase
-from ..models import Item, List
+
+from apps.dashboard.models import Item, List
 from apps.lyric.models import User
 
-class ItemModelTest(TestCase):
-    def test_default_text(self):
-        item = Item()
-        self.assertEqual(item.text, "")
 
+class ItemModelTest(TestCase):
     def test_item_is_related_to_list(self):
         mylist = List.objects.create()
         item = Item()
@@ -42,10 +40,6 @@ class ItemModelTest(TestCase):
         item = Item(list=list2, text="nojk")
         item.full_clean() # should not raise
 
-    def test_string_representation(self):
-        item = Item(text="sample text")
-        self.assertEqual(str(item), "sample text")
-
 class ListModelTest(TestCase):
         def test_get_absolute_url(self):
             mylist = List.objects.create()

src/apps/dashboard/tests/integrated/test_views.py

@@ -1,14 +1,17 @@
 import lxml.html
+from unittest import skip
+
 from django.test import TestCase
 from django.utils import html
-from unittest import skip
-from ..forms import (
+
+from apps.dashboard.forms import (
     DUPLICATE_ITEM_ERROR,
     EMPTY_ITEM_ERROR,
 )
-from ..models import Item, List
+from apps.dashboard.models import Item, List
 from apps.lyric.models import User
 
+
 class HomePageTest(TestCase):
     def test_uses_home_template(self):
         response = self.client.get('/')
@@ -180,3 +183,30 @@ class MyListsTest(TestCase):
         response = self.client.get(f"/apps/dashboard/users/{user1.id}/")
         # assert 403
         self.assertEqual(response.status_code, 403)
+
+class ShareListTest(TestCase):
+    def test_post_to_share_list_url_redirects_to_list(self):
+        our_list = List.objects.create()
+        alice = User.objects.create(email="alice@example.com")
+        response = self.client.post(
+            f"/apps/dashboard/{our_list.id}/share_list",
+            data={"recipient": "alice@example.com"},
+        )
+        self.assertRedirects(response, f"/apps/dashboard/{our_list.id}/")
+
+    def test_post_with_email_adds_user_to_shared_with(self):
+        our_list = List.objects.create()
+        alice = User.objects.create(email="alice@example.com")
+        self.client.post(
+            f"/apps/dashboard/{our_list.id}/share_list",
+            data={"recipient": "alice@example.com"},
+        )
+        self.assertIn(alice, our_list.shared_with.all())
+
+    def test_post_with_nonexistent_email_redirects_to_list(self):
+        our_list = List.objects.create()
+        response = self.client.post(
+            f"/apps/dashboard/{our_list.id}/share_list",
+            data={"recipient": "nobody@example.com"},
+        )
+        self.assertRedirects(response, f"/apps/dashboard/{our_list.id}/")

src/apps/dashboard/tests/unit/test_forms.py

@@ -0,0 +1,13 @@
+from django.test import SimpleTestCase
+
+from apps.dashboard.forms import (
+    EMPTY_ITEM_ERROR,
+    ItemForm,
+)
+
+
+class SimpleItemFormTest(SimpleTestCase):
+    def test_form_validation_for_blank_items(self):
+        form = ItemForm(data={"text": ""})
+        self.assertFalse(form.is_valid())
+        self.assertEqual(form.errors["text"], [EMPTY_ITEM_ERROR])

src/apps/dashboard/tests/unit/test_models.py

@@ -0,0 +1,13 @@
+from django.test import SimpleTestCase
+
+from apps.dashboard.models import Item
+
+
+class SimpleItemModelTest(SimpleTestCase):
+    def test_default_text(self):
+        item = Item()
+        self.assertEqual(item.text, "")
+
+    def test_string_representation(self):
+        item = Item(text="sample text")
+        self.assertEqual(str(item), "sample text")

src/apps/dashboard/urls.py

@@ -5,4 +5,5 @@ urlpatterns = [
     path('new_list', views.new_list, name='new_list'),
     path('<int:list_id>/', views.view_list, name='view_list'),
     path('users/<uuid:user_id>/', views.my_lists, name='my_lists'),
+    path('<int:list_id>/share_list', views.share_list, name="share_list"),
 ]

src/apps/dashboard/views.py

@@ -37,3 +37,12 @@ def my_lists(request, user_id):
     if request.user.id != owner.id:
         return HttpResponseForbidden()
     return render(request, "apps/dashboard/my_lists.html", {"owner": owner})
+
+def share_list(request, list_id):
+    our_list = List.objects.get(id=list_id)
+    try:
+        recipient = User.objects.get(email=request.POST["recipient"])
+        our_list.shared_with.add(recipient)
+    except User.DoesNotExist:
+        pass
+    return redirect(our_list)

src/apps/lyric/admin.py

@@ -1,3 +1,6 @@
 from django.contrib import admin
+from .models import Token, User
 
-# Register your models here.
+
+admin.site.register(User)
+admin.site.register(Token)

src/apps/lyric/authentication.py

@@ -13,7 +13,7 @@ class PasswordlessAuthenticationBackend:
         try:
             return User.objects.get(email=token.email)
         except User.DoesNotExist:
-            return User.objects.create(email=token.email)
+            return User.objects.create_user(email=token.email)
 
     def get_user(self, user_id):
         try:

src/apps/lyric/migrations/0001_initial.py

@@ -1,4 +1,4 @@
-# Generated by Django 6.0 on 2026-02-08 01:19
+# Generated by Django 6.0 on 2026-02-20 00:48
 
 import uuid
 from django.db import migrations, models
@@ -15,9 +15,16 @@ class Migration(migrations.Migration):
         migrations.CreateModel(
             name='User',
             fields=[
+                ('password', models.CharField(max_length=128, verbose_name='password')),
+                ('last_login', models.DateTimeField(blank=True, null=True, verbose_name='last login')),
                 ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
                 ('email', models.EmailField(max_length=254, unique=True)),
+                ('is_staff', models.BooleanField(default=False)),
+                ('is_superuser', models.BooleanField(default=False)),
             ],
+            options={
+                'abstract': False,
+            },
         ),
         migrations.CreateModel(
             name='Token',

src/apps/lyric/models.py

@@ -1,16 +1,38 @@
 import uuid
+
+from django.contrib.auth.base_user import AbstractBaseUser, BaseUserManager
 from django.db import models
 
+
+class UserManager(BaseUserManager):
+    def create_user(self, email):
+        user = self.model(email=email)
+        user.set_unusable_password()
+        user.save(using=self._db)
+        return user
+
+    def create_superuser(self, email, password):
+        user = self.model(email=email, is_staff=True, is_superuser=True)
+        user.set_password(password)
+        user.save(using=self._db)
+        return user
+
 class Token(models.Model):
     email = models.EmailField()
     uid = models.UUIDField(primary_key=True, default=uuid.uuid4, editable=False)
 
-class User(models.Model):
+class User(AbstractBaseUser):
     id = models.UUIDField(primary_key=True, default=uuid.uuid4, editable=False)
     email = models.EmailField(unique=True)
+    is_staff = models.BooleanField(default=False)
+    is_superuser = models.BooleanField(default=False)
 
+    objects = UserManager()
     REQUIRED_FIELDS = []
     USERNAME_FIELD = "email"
 
-    is_authenticated = True
-    is_anonymous =False
+    def has_perm(self, perm, obj=None):
+        return self.is_superuser
+    
+    def has_module_perms(self, app_label):
+        return self.is_superuser

src/apps/lyric/tests/integrated/test_authentication.py

@@ -2,17 +2,11 @@ import uuid
 from django.http import HttpRequest
 from django.test import TestCase
 
-from ..authentication import PasswordlessAuthenticationBackend
-from ..models import Token, User
+from apps.lyric.authentication import PasswordlessAuthenticationBackend
+from apps.lyric.models import Token, User
 
 
 class AuthenticateTest(TestCase):
-    def test_returns_None_if_token_is_invalid_uuid(self):
-        result = PasswordlessAuthenticationBackend().authenticate(
-            HttpRequest(), "no-such-token"
-        )
-        self.assertIsNone(result)
-
     def test_returns_None_if_token_uuid_not_found(self):
         uid = uuid.uuid4()
         result = PasswordlessAuthenticationBackend().authenticate(

src/apps/lyric/tests/integrated/test_models.py

@@ -1,7 +1,9 @@
 import uuid
 from django.contrib import auth
 from django.test import TestCase
-from ..models import Token, User
+
+from apps.lyric.models import Token, User
+
 
 class UserModelTest(TestCase):
     def test_model_is_configured_for_django_auth(self):
@@ -9,6 +11,7 @@ class UserModelTest(TestCase):
     
     def test_user_is_valid_with_email_only(self):
         user = User(email="a@b.cde")
+        user.set_unusable_password()
         user.full_clean() # should not raise
 
     def test_id_is_primary_key(self):
@@ -21,3 +24,19 @@ class TokenModelTest(TestCase):
         token2 = Token.objects.create(email="v@w.xyz")
         self.assertNotEqual(token1.pk, token2.pk)
         self.assertIsInstance(token1.pk, uuid.UUID)
+
+class UserManagerTest(TestCase):
+    def test_create_superuser_sets_is_staff_and_is_superuser(self):
+        user = User.objects.create_superuser(
+            email="admin@example.com",
+            password="correct-password",
+        )
+        self.assertTrue(user.is_staff)
+        self.assertTrue(user.is_superuser)
+
+    def test_create_superuser_sets_usable_password(self):
+        user = User.objects.create_superuser(
+            email="admin@example.com",
+            password="correct-password",
+        )
+        self.assertTrue(user.check_password("correct-password"))

src/apps/lyric/tests/integrated/test_views.py

@@ -1,7 +1,10 @@
 from django.contrib import auth
 from django.test import TestCase
 from unittest import mock
-from ..models import Token
+
+from apps.lyric.models import Token
+
+
 
 class SendLoginEmailViewTest(TestCase):
     def test_redirects_to_home_page(self):
@@ -19,7 +22,7 @@ class SendLoginEmailViewTest(TestCase):
         self.assertEqual(mock_post.called, True)
         data = mock_post.call_args.kwargs["data"]
         self.assertEqual(data["subject"], "A magic login link to your Dashboard")
-        self.assertEqual(data["from"], "adman@howdy.earthmanrpg.me")
+        self.assertEqual(data["from"], "adman@howdy.earthmanrpg.com")
         self.assertEqual(data["to"], "discoman@example.com")
 
     def test_adds_success_message(self):

src/apps/lyric/tests/unit/test_authentication.py

@@ -0,0 +1,31 @@
+from django.http import HttpRequest
+from django.test import SimpleTestCase
+
+from apps.lyric.authentication import PasswordlessAuthenticationBackend
+from apps.lyric.models import User
+
+
+class SimpleAuthenticateTest(SimpleTestCase):
+    def test_returns_None_if_token_is_invalid_uuid(self):
+        result = PasswordlessAuthenticationBackend().authenticate(
+            HttpRequest(), "no-such-token"
+        )
+        self.assertIsNone(result)
+
+    def test_returns_None_if_no_uuid(self):
+        result = PasswordlessAuthenticationBackend().authenticate(HttpRequest())
+        self.assertIsNone(result)
+
+class UserPermissionsTest(SimpleTestCase):
+    def test_superuser_has_perm(self):
+        user = User(is_superuser=True)
+        self.assertTrue(user.has_perm("any.permission"))
+
+    def test_superuser_has_module_perms(self):
+        user = User(is_superuser=True)
+        self.assertTrue(user.has_module_perms("any_app"))
+
+    def test_non_superuser_has_no_perm(self):
+        user = User(is_superuser=False)
+        self.assertFalse(user.has_perm("any.permission"))
+

src/apps/lyric/views.py

@@ -18,7 +18,7 @@ def send_login_email(request):
         f"https://api.mailgun.net/v3/{settings.MAILGUN_DOMAIN}/messages",
         auth=("api", settings.MAILGUN_API_KEY),
         data={
-            "from": "adman@howdy.earthmanrpg.me",
+            "from": "adman@howdy.earthmanrpg.com",
             "to": email,
             "subject": "A magic login link to your Dashboard",
             "text": message_body,

src/core/settings.py

@@ -12,6 +12,7 @@ https://docs.djangoproject.com/en/6.0/ref/settings/
 
 from pathlib import Path
 import os
+import dj_database_url
 
 # Build paths inside the project like this: BASE_DIR / 'subdir'.
 BASE_DIR = Path(__file__).resolve().parent.parent
@@ -26,20 +27,25 @@ if 'DJANGO_DEBUG_FALSE' in os.environ:
     DEBUG = False
     SECRET_KEY = os.environ['DJANGO_SECRET_KEY']
     ALLOWED_HOSTS = [host.strip() for host in os.environ['DJANGO_ALLOWED_HOST'].split(',')]
-    db_path = os.environ['DJANGO_DB_PATH']
+    CSRF_TRUSTED_ORIGINS = [f'https://{host.strip()}' for host in os.environ['DJANGO_ALLOWED_HOST'].split(',')]
+    SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
+    SESSION_COOKIE_SECURE = True
+    CSRF_COOKIE_SECURE = True
+    SECURE_HSTS_SECONDS = 60
+    SECURE_HSTS_INCLUDE_SUBDOMAINS = True
+    SECURE_HSTS_PRELOAD = True
 else:
     DEBUG = True
     # SECURITY WARNING: keep the secret key used in production secret!
     SECRET_KEY = 'django-insecure-&9b_h=qpjy=sshhnsyg98&jp7(t6*v78__y%h2l$b#_@6z$-9r'
     ALLOWED_HOSTS = []
-    db_path = BASE_DIR / 'db.sqlite3'
 
 
 # Application definition
 
 INSTALLED_APPS = [
     # Django apps
-    # 'django.contrib.admin',
+    'django.contrib.admin',
     'django.contrib.auth',
     'django.contrib.contenttypes',
     'django.contrib.sessions',
@@ -90,12 +96,16 @@ ASGI_APPLICATION = 'core.asgi.application'
 # Database
 # https://docs.djangoproject.com/en/6.0/ref/settings/#databases
 
-DATABASES = {
+DATABASE_URL = os.environ.get('DATABASE_URL')
+if DATABASE_URL:
+    DATABASES = {'default': dj_database_url.config(conn_max_age=600)}
+else:
+    DATABASES = {
         'default': {
             'ENGINE': 'django.db.backends.sqlite3',
-        'NAME': db_path,
+            'NAME': BASE_DIR / 'db.sqlite3',
+        }
     }
-}
 
 
 # Password validation
@@ -119,6 +129,7 @@ AUTH_PASSWORD_VALIDATORS = [
 AUTH_USER_MODEL = "lyric.User"
 
 AUTHENTICATION_BACKENDS = [
+    "django.contrib.auth.backends.ModelBackend",
     "apps.lyric.authentication.PasswordlessAuthenticationBackend",
 ]
 
@@ -155,12 +166,6 @@ LOGGING = {
     },
 }
 
-# Email Settings
-EMAIL_HOST = "smtp.mailgun.org"
-EMAIL_HOST_USER = os.environ.get("EMAIL_HOST_USER") # switch back to .environ[] when collectstatic moved outside docker build process
-EMAIL_HOST_PASSWORD = os.environ.get("EMAIL_HOST_PASSWORD") # switch back to .environ[]
-EMAIL_PORT = 587
-EMAIL_USE_TLS = True
 # Mailgun API settings (for HTTP API instead of SMTP)
 MAILGUN_API_KEY = os.environ.get("MAILGUN_API_KEY")
-MAILGUN_DOMAIN = "howdy.earthmanrpg.me" # Your Mailgun domain
+MAILGUN_DOMAIN = "howdy.earthmanrpg.com" # Your Mailgun domain

src/core/urls.py

@@ -1,10 +1,10 @@
-# from django.contrib import admin
+from django.contrib import admin
 from django.http import HttpResponse
 from django.urls import include, path
 from apps.dashboard import views as dash_views
 
 urlpatterns = [
-    # path('admin/', admin.site.urls),
+    path('admin/', admin.site.urls),
     path('', dash_views.home_page, name='home'),
     path('apps/dashboard/', include('apps.dashboard.urls')),
     path('apps/lyric/', include('apps.lyric.urls')),

src/functional_tests/base.py

@@ -2,6 +2,7 @@ import os
 import time
 
 from datetime import datetime
+from django.conf import settings
 from django.contrib.staticfiles.testing import StaticLiveServerTestCase
 from pathlib import Path
 from selenium import webdriver
@@ -9,7 +10,9 @@ from selenium.common.exceptions import WebDriverException
 from selenium.webdriver.common.by import By
 from selenium.webdriver.common.keys import Keys
 
-from .container_commands import reset_database
+from .container_commands import create_session_on_server, reset_database
+from .management.commands.create_session import create_pre_authenticated_session
+
 
 
 MAX_WAIT = 10
@@ -70,24 +73,26 @@ class FunctionalTest(StaticLiveServerTestCase):
             f"{self.__class__.__name__}.{self._testMethodName}-{timestamp}.{extension}"
         )
 
+
     @wait
     def wait_for(self, fn):
         return fn()
         
-    def get_item_input_box(self):
-        return self.browser.find_element(By.ID, "id_text")
-    
-    @wait
-    def wait_for_row_in_list_table(self, row_text):
-        rows = self.browser.find_elements(By.CSS_SELECTOR, "#id_list_table tr")
-        self.assertIn(row_text, [row.text for row in rows])
-
-    def add_list_item(self, item_text):
-        num_rows = len(self.browser.find_elements(By.CSS_SELECTOR, "#id_list_table tr"))
-        self.get_item_input_box().send_keys(item_text)
-        self.get_item_input_box().send_keys(Keys.ENTER)
-        item_number = num_rows + 1
-        self.wait_for_row_in_list_table(f"{item_number}. {item_text}")
+    def create_pre_authenticated_session(self, email):
+        if self.test_server:
+            session_key = create_session_on_server(self.test_server, email)
+        else:
+            session_key = create_pre_authenticated_session(email)
+        ## to set a cookie we need to first visit the domain
+        ## 404 pages load the quickest!
+        self.browser.get(self.live_server_url + "/404_no_such_url/")
+        self.browser.add_cookie(
+            dict(
+                name=settings.SESSION_COOKIE_NAME,
+                value=session_key,
+                path="/",
+            )
+        )
         
     @wait
     def wait_to_be_logged_in(self, email):

src/functional_tests/container_commands.py

@@ -1,5 +1,6 @@
 import subprocess
 
+
 USER = "discoman"
 
 

src/functional_tests/list_page.py

@@ -0,0 +1,52 @@
+from selenium.webdriver.common.by import By
+from selenium.webdriver.common.keys import Keys
+
+from .base import wait
+
+
+class ListPage:
+    def __init__(self, test):
+        self.test = test
+
+    def get_table_rows(self):
+        return self.test.browser.find_elements(By.CSS_SELECTOR, "#id_list_table tr")
+
+    @wait
+    def wait_for_row_in_list_table(self, item_text, item_number):
+        expected_row_text = f"{item_number}. {item_text}"
+        rows = self.get_table_rows()
+        self.test.assertIn(expected_row_text, [row.text for row in rows])
+    
+    def get_item_input_box(self):
+        return self.test.browser.find_element(By.ID, "id_text")
+
+    def add_list_item(self, item_text):
+        new_item_no = len(self.get_table_rows()) + 1
+        self.get_item_input_box().send_keys(item_text)
+        self.get_item_input_box().send_keys(Keys.ENTER)
+        self.wait_for_row_in_list_table(item_text, new_item_no)
+        return self
+    
+    def get_share_box(self):
+        return self.test.browser.find_element(
+            By.CSS_SELECTOR,
+            'input[name="recipient"]',
+        )
+    
+    def get_shared_with_list(self):
+        return self.test.browser.find_elements(
+            By.CSS_SELECTOR,
+            ".list-recipient"
+        )
+    
+    def share_list_with(self, email):
+        self.get_share_box().send_keys(email)
+        self.get_share_box().send_keys(Keys.ENTER)
+        self.test.wait_for(
+            lambda: self.test.assertIn(
+                email, [item.text for item in self.get_shared_with_list()]
+            )
+        )
+
+    def get_list_owner(self):
+        return self.test.browser.find_element(By.ID, "id_list_owner").text

src/functional_tests/management/commands/create_session.py

@@ -1,5 +1,10 @@
 from django.conf import settings
-from django.contrib.auth import BACKEND_SESSION_KEY, SESSION_KEY, get_user_model
+from django.contrib.auth import (
+    BACKEND_SESSION_KEY,
+    HASH_SESSION_KEY,
+    SESSION_KEY,
+    get_user_model,
+)
 from django.contrib.sessions.backends.db import SessionStore
 from django.core.management.base import BaseCommand
 
@@ -15,9 +20,10 @@ class Command(BaseCommand):
         self.stdout.write(session_key)
 
 def create_pre_authenticated_session(email):
-    user = User.objects.create(email=email)
+    user = User.objects.create_user(email=email)
     session = SessionStore()
     session[SESSION_KEY] = str(user.pk)  # Convert UUID to string for JSON serialization
-    session[BACKEND_SESSION_KEY] = settings.AUTHENTICATION_BACKENDS[0]
+    session[BACKEND_SESSION_KEY] = "apps.lyric.authentication.PasswordlessAuthenticationBackend"
+    session[HASH_SESSION_KEY] = user.get_session_auth_hash()
     session.save()
     return session.session_key

src/functional_tests/my_lists_page.py

@@ -0,0 +1,17 @@
+from selenium.webdriver.common.by import By
+
+
+class MyListsPage:
+    def __init__(self, test):
+        self.test = test
+    
+    def go_to_my_lists_page(self, email):
+        self.test.browser.get(self.test.live_server_url)
+        self.test.browser.find_element(By.LINK_TEXT, "My lists").click()
+        self.test.wait_for(
+            lambda: self.test.assertIn(
+                email,
+                self.test.browser.find_element(By.TAG_NAME, "h2").text,
+            )
+        )
+        return self

src/functional_tests/test_admin.py

@@ -0,0 +1,28 @@
+from selenium.webdriver.common.by import By
+
+from .base import FunctionalTest
+from apps.lyric.models import User
+
+
+class AdminLoginTest(FunctionalTest):
+    def setUp(self):
+        super().setUp()
+        self.superuser = User.objects.create_superuser(
+            email="admin@example.com",
+            password="correct-password",
+        )
+
+    def test_can_access_admin(self):
+        self.browser.get(self.live_server_url + "/admin/")
+
+        self.wait_for(lambda: self.browser.find_element(By.ID, "id_username"))
+        self.browser.find_element(By.ID, "id_username").send_keys("admin@example.com")
+        self.browser.find_element(By.ID, "id_password").send_keys("correct-password")
+        self.browser.find_element(By.CSS_SELECTOR, "input[type=submit]").click()
+
+        body = self.wait_for(
+            lambda: self.browser.find_element(By.TAG_NAME, "body")
+        )
+        self.assertIn("Site administration", body.text)
+        self.assertIn("Users", body.text)
+        self.assertIn("Tokens", body.text)

src/functional_tests/test_layout_and_styling.py

@@ -2,23 +2,26 @@ from selenium.webdriver.common.by import By
 from selenium.webdriver.common.keys import Keys
 
 from .base import FunctionalTest
+from .list_page import ListPage
+
 
 class LayoutAndStylingTest(FunctionalTest):
     def test_layout_and_styling(self):
         self.browser.get(self.live_server_url)
+        list_page = ListPage(self)
 
         self.browser.set_window_size(1024, 768)
         # print("Viewport width:", self.browser.execute_script("return window.innerWidth"))
 
-        inputbox = self.get_item_input_box()
+        inputbox = list_page.get_item_input_box()
         self.assertAlmostEqual(
             inputbox.location['x'] + inputbox.size['width'] / 2,
             512,
             delta=10,
         )
 
-        self.add_list_item("testing")
-        inputbox = self.get_item_input_box()
+        list_page.add_list_item("testing")
+        inputbox = list_page.get_item_input_box()
         self.assertAlmostEqual(
             inputbox.location['x'] + inputbox.size['width'] / 2,
             512,

src/functional_tests/test_list_item_validation.py

@@ -2,6 +2,8 @@ from selenium.webdriver.common.by import By
 from selenium.webdriver.common.keys import Keys
 
 from .base import FunctionalTest
+from .list_page import ListPage
+
 
 class ItemValidationTest(FunctionalTest):
     # Helper functions
@@ -11,43 +13,45 @@ class ItemValidationTest(FunctionalTest):
     # Test methods
     def test_cannot_add_empty_list_items(self):
         self.browser.get(self.live_server_url)
-        self.get_item_input_box().send_keys(Keys.ENTER)
+        list_page = ListPage(self)
+        list_page.get_item_input_box().send_keys(Keys.ENTER)
 
         self.wait_for(
             lambda: self.browser.find_element(By.CSS_SELECTOR, "#id_text:invalid")
         )
 
-        self.get_item_input_box().send_keys("Purchase milk")
+        list_page.get_item_input_box().send_keys("Purchase milk")
         self.wait_for(
             lambda: self.browser.find_element(By.CSS_SELECTOR, "#id_text:valid")
         )
 
-        self.get_item_input_box().send_keys(Keys.ENTER)
-        self.wait_for_row_in_list_table("1. Purchase milk")
+        list_page.get_item_input_box().send_keys(Keys.ENTER)
+        list_page.wait_for_row_in_list_table("Purchase milk", 1)
 
-        self.get_item_input_box().send_keys(Keys.ENTER)
+        list_page.get_item_input_box().send_keys(Keys.ENTER)
 
-        self.wait_for_row_in_list_table("1. Purchase milk")
+        list_page.wait_for_row_in_list_table("Purchase milk", 1)
         self.wait_for(
             lambda: self.browser.find_element(By.CSS_SELECTOR, "#id_text:invalid")
         )
 
-        self.get_item_input_box().send_keys("Make tea")
+        list_page.get_item_input_box().send_keys("Make tea")
         self.wait_for(
             lambda: self.browser.find_element(
                 By.CSS_SELECTOR,
                 "#id_text:valid",
             )
         )
-        self.get_item_input_box().send_keys(Keys.ENTER)
-        self.wait_for_row_in_list_table("2. Make tea")
+        list_page.get_item_input_box().send_keys(Keys.ENTER)
+        list_page.wait_for_row_in_list_table("Make tea", 2)
 
     def test_cannot_add_duplicate_items(self):
         self.browser.get(self.live_server_url)
-        self.add_list_item("Witness divinity")
+        list_page = ListPage(self)
+        list_page.add_list_item("Witness divinity")
 
-        self.get_item_input_box().send_keys("Witness divinity")
-        self.get_item_input_box().send_keys(Keys.ENTER)
+        list_page.get_item_input_box().send_keys("Witness divinity")
+        list_page.get_item_input_box().send_keys(Keys.ENTER)
 
         self.wait_for(
             lambda: self.assertEqual(
@@ -58,14 +62,15 @@ class ItemValidationTest(FunctionalTest):
 
     def test_error_messages_are_cleared_on_input(self):
         self.browser.get(self.live_server_url)
-        self.add_list_item("Gobbledygook")
-        self.get_item_input_box().send_keys("Gobbledygook")
-        self.get_item_input_box().send_keys(Keys.ENTER)
+        list_page = ListPage(self)
+        list_page.add_list_item("Gobbledygook")
+        list_page.get_item_input_box().send_keys("Gobbledygook")
+        list_page.get_item_input_box().send_keys(Keys.ENTER)
         self.wait_for(
             lambda: self.assertTrue(self.get_error_element().is_displayed())
         )
 
-        self.get_item_input_box().send_keys("a")
+        list_page.get_item_input_box().send_keys("a")
 
         self.wait_for(
             lambda: self.assertFalse(self.get_error_element().is_displayed())

src/functional_tests/test_login.py

@@ -2,11 +2,14 @@ import re
 from unittest.mock import patch
 from selenium.webdriver.common.by import By
 from selenium.webdriver.common.keys import Keys
+
 from .base import FunctionalTest
 
+
 TEST_EMAIL = "discoman@example.com"
 SUBJECT = "A magic login link to your Dashboard"
 
+
 class LoginTest(FunctionalTest):
     @patch('apps.lyric.views.requests.post')
     def test_login_using_magic_link(self, mock_post):

src/functional_tests/test_my_lists.py

@@ -1,43 +1,22 @@
-from django.conf import settings
 from selenium.webdriver.common.by import By
+
 from .base import FunctionalTest
-from .container_commands import create_session_on_server
-from .management.commands.create_session import create_pre_authenticated_session
+from .list_page import ListPage
+from .my_lists_page import MyListsPage
 
 
 class MyListsTest(FunctionalTest):
-    def create_pre_authenticated_session(self, email):
-        if self.test_server:
-            session_key = create_session_on_server(self.test_server, email)
-        else:
-            session_key = create_pre_authenticated_session(email)
-        ## to set a cookie we need to first visit the domain
-        ## 404 pages load the quickest!
-        self.browser.get(self.live_server_url + "/404_no_such_url/")
-        self.browser.add_cookie(
-            dict(
-                name=settings.SESSION_COOKIE_NAME,
-                value=session_key,
-                path="/",
-            )
-        )
 
     def test_logged_in_users_lists_are_saved_as_my_lists(self):
         self.create_pre_authenticated_session("discoman@example.com")
 
         self.browser.get(self.live_server_url)
-        self.add_list_item("Reticulate splines")
-        self.add_list_item("Regurgitate spines")
+        list_page = ListPage(self)
+        list_page.add_list_item("Reticulate splines")
+        list_page.add_list_item("Regurgitate spines")
         first_list_url = self.browser.current_url
 
-        self.browser.find_element(By.LINK_TEXT, "My lists").click()
-
-        self.wait_for(
-            lambda: self.assertIn(
-                "discoman@example.com",
-                self.browser.find_element(By.CSS_SELECTOR, "h2").text,
-            )
-        )
+        MyListsPage(self).go_to_my_lists_page("discoman@example.com")
 
         self.wait_for(
             lambda: self.browser.find_element(By.LINK_TEXT, "Reticulate splines")
@@ -48,17 +27,14 @@ class MyListsTest(FunctionalTest):
         )
 
         self.browser.get(self.live_server_url)
-        self.add_list_item("Ribbon of death")
+        list_page.add_list_item("Ribbon of death")
         second_list_url = self.browser.current_url
 
         self.browser.find_element(By.LINK_TEXT, "My lists").click()
         self.wait_for(
             lambda: self.browser.find_element(By.LINK_TEXT, "Ribbon of death")
         )
-        self.browser.find_element(By.LINK_TEXT, "Ribbon of death").click()
-        self.wait_for(
-            lambda: self.assertEqual(self.browser.current_url, second_list_url)
-        )
+        MyListsPage(self).go_to_my_lists_page("discoman@example.com")
 
         self.browser.find_element(By.CSS_SELECTOR, "#id_logout").click()
         self.wait_for(

src/functional_tests/test_sharing.py

@@ -0,0 +1,59 @@
+import os
+
+from selenium import webdriver
+from selenium.webdriver.common.by import By
+
+from .base import FunctionalTest
+from .list_page import ListPage
+from .my_lists_page import MyListsPage
+
+
+# Helper fns
+def quit_if_possible(browser):
+    try:
+        browser.quit()
+    except:
+        pass
+
+
+# Test mdls
+class SharingTest(FunctionalTest):
+    def test_can_share_a_list_with_another_user(self):
+        self.create_pre_authenticated_session("discoman@example.com")
+        disco_browser = self.browser
+        self.addCleanup(lambda: quit_if_possible(disco_browser))
+
+        options = webdriver.FirefoxOptions()
+        if os.environ.get("HEADLESS"):
+            options.add_argument("--headless")
+        ali_browser = webdriver.Firefox(options=options)
+        self.addCleanup(lambda: quit_if_possible(ali_browser))
+        self.browser = ali_browser
+        self.create_pre_authenticated_session("alice@example.com")
+
+        self.browser = disco_browser
+        self.browser.get(self.live_server_url)
+        list_page = ListPage(self).add_list_item("Send help")
+
+        share_box = list_page.get_share_box()
+        self.assertEqual(
+            share_box.get_attribute("placeholder"),
+            "friend@example.com",
+        )
+
+        list_page.share_list_with("alice@example.com")
+
+        self.browser = ali_browser
+        MyListsPage(self).go_to_my_lists_page("alice@example.com")
+
+        self.browser.find_element(By.LINK_TEXT, "Send help").click()
+
+        self.wait_for(
+            lambda: self.assertEqual(list_page.get_list_owner(), "discoman@example.com")
+        )
+
+        list_page.add_list_item("At your command, Disco King")
+
+        self.browser = disco_browser
+        self.browser.refresh()
+        list_page.wait_for_row_in_list_table("At your command, Disco King", 2)

src/functional_tests/test_simple_list_creation.py

@@ -2,32 +2,36 @@ from selenium.webdriver.common.by import By
 from selenium.webdriver.common.keys import Keys
 
 from .base import FunctionalTest
+from .list_page import ListPage
+
 
 class NewVisitorTest(FunctionalTest):
     # Test methods
     def test_can_start_a_todo_list(self):
         self.browser.get(self.live_server_url)
+        list_page = ListPage(self)
 
         self.assertIn('Earthman RPG', self.browser.title)
         header_text = self.browser.find_element(By.TAG_NAME, 'h1').text
         self.assertIn('Welcome', header_text)
 
-        inputbox = self.get_item_input_box()
+        inputbox = list_page.get_item_input_box()
         self.assertEqual(inputbox.get_attribute('placeholder'), 'Enter a to-do item')
 
         inputbox.send_keys('Buy peacock feathers')
 
         inputbox.send_keys(Keys.ENTER)
-        self.wait_for_row_in_list_table('1. Buy peacock feathers')
+        list_page.wait_for_row_in_list_table("Buy peacock feathers", 1)
         
-        self.add_list_item("Use peacock feathers to make a fly")
+        list_page.add_list_item("Use peacock feathers to make a fly")
         
-        self.wait_for_row_in_list_table('2. Use peacock feathers to make a fly')
-        self.wait_for_row_in_list_table('1. Buy peacock feathers')
+        list_page.wait_for_row_in_list_table("Use peacock feathers to make a fly", 2)
+        list_page.wait_for_row_in_list_table("Buy peacock feathers", 1)
 
     def test_multiple_users_can_start_lists_at_different_urls(self):
         self.browser.get(self.live_server_url)
-        self.add_list_item("Buy peacock feathers")
+        list_page = ListPage(self)
+        list_page.add_list_item("Buy peacock feathers")
 
         edith_dash_url = self.browser.current_url
         self.assertRegex(edith_dash_url, '/apps/dashboard/.+')
@@ -35,10 +39,11 @@ class NewVisitorTest(FunctionalTest):
         self.browser.delete_all_cookies()
 
         self.browser.get(self.live_server_url)
+        list_page = ListPage(self)
         page_text = self.browser.find_element(By.TAG_NAME, 'body').text
         self.assertNotIn('Buy peacock feathers', page_text)
 
-        self.add_list_item("Buy milk")
+        list_page.add_list_item("Buy milk")
 
         francis_dash_url = self.browser.current_url
         self.assertRegex(francis_dash_url, '/apps/dashboard/.+')

src/templates/apps/dashboard/list.html

@@ -11,6 +11,7 @@
 
 {% block content %}
     <div class="row justify-content-center">
+        <small>List created by: <span id="id_list_owner">{{ list.owner.email }}</span></small>
         <div class="col-lg-6">
             <table id="id_list_table" class="table">
                 {% for item in list.item_set.all %}
@@ -19,6 +20,35 @@
             </table>
         </div>
     </div>
+
+    <div class="row justify-content-center">
+        <div class="col-lg-6">
+
+            <form method="POST" action="{% url "share_list" list.id %}">
+                {% csrf_token %}
+                <input
+                    id="id_recipient"
+                    name="recipient"
+                    class="form-control form-control-lg{% if form.errors %} is-invalid{% endif %}"
+                    placeholder="friend@example.com"
+                    aria-describedby="id_recipient_feedback"
+                    required
+                />
+                {% if form.errors %}
+                    <div id="id_recipient_feedback" class="invalid-feedback">
+                        {{ form.errors.recipient.0 }}
+                    </div>
+                {% endif %}
+
+                <button type="submit" class="btn btn-primary">Share</button>
+            </form>
+            <small>List shared with:
+                {% for user in list.shared_with.all %}
+                    <span class="list-recipient">{{ user.email }}</span>
+                {% endfor %}
+            </small>
+        </div>
+    </div>
 {% endblock content %}
 
 {% block scripts %}

src/templates/apps/dashboard/my_lists.html

@@ -9,4 +9,10 @@
             <li><a href="{{ list.get_absolute_url }}">{{ list.name }}</a></li>
         {% endfor %}
     </ul>
+    <h3>Lists shared with me</h3>
+    <ul>
+        {% for list in owner.shared_lists.all %}
+            <li><a href="{{ list.get_absolute_url }}">{{ list.name }}</a></li>
+        {% endfor %}
+    </ul>
 {% endblock content %}