Add JWT auth with per-user data isolation and account settings.

Users can register, log in, and manage profile/password in a personal account page; server data is scoped by owner across contacts, maps, tags, and import.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/contacts/bootstrap.py

@@ -0,0 +1,29 @@
+DEFAULT_SECTORS = [
+    {'key': 'work', 'label': 'Работа'},
+    {'key': 'study', 'label': 'Учёба'},
+    {'key': 'hobby', 'label': 'Хобби'},
+    {'key': 'family', 'label': 'Семья'},
+    {'key': 'health', 'label': 'Здоровье'},
+    {'key': 'other', 'label': 'Другое'},
+]
+
+DEFAULT_CIRCLES = [
+    {'key': 'support', 'label': 'Круг поддержки'},
+    {'key': 'productivity', 'label': 'Круг продуктивности'},
+    {'key': 'development', 'label': 'Круг развития'},
+]
+
+
+def ensure_user_defaults(user):
+    """Создаёт тип карты по умолчанию для нового пользователя."""
+    from contacts.models import NetworkMapType
+
+    if NetworkMapType.objects.filter(owner=user, is_default=True).exists():
+        return
+    NetworkMapType.objects.create(
+        owner=user,
+        is_default=True,
+        name='Стандартная',
+        sectors=DEFAULT_SECTORS,
+        circles=DEFAULT_CIRCLES,
+    )

backend/contacts/migrations/0011_add_owner.py

@@ -0,0 +1,111 @@
+from django.conf import settings
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+DEFAULT_SECTORS = [
+    {'key': 'work', 'label': 'Работа'},
+    {'key': 'study', 'label': 'Учёба'},
+    {'key': 'hobby', 'label': 'Хобби'},
+    {'key': 'family', 'label': 'Семья'},
+    {'key': 'health', 'label': 'Здоровье'},
+    {'key': 'other', 'label': 'Другое'},
+]
+
+DEFAULT_CIRCLES = [
+    {'key': 'support', 'label': 'Круг поддержки'},
+    {'key': 'productivity', 'label': 'Круг продуктивности'},
+    {'key': 'development', 'label': 'Круг развития'},
+]
+
+
+def assign_legacy_owner(apps, schema_editor):
+    User = apps.get_model('auth', 'User')
+    Contact = apps.get_model('contacts', 'Contact')
+    Relation = apps.get_model('contacts', 'Relation')
+    NetworkMap = apps.get_model('contacts', 'NetworkMap')
+    NetworkMapType = apps.get_model('contacts', 'NetworkMapType')
+
+    user, created = User.objects.get_or_create(
+        username='legacy',
+        defaults={'email': 'legacy@local.invalid', 'password': '!'},
+    )
+
+    Contact.objects.filter(owner__isnull=True).update(owner=user)
+    Relation.objects.filter(owner__isnull=True).update(owner=user)
+    NetworkMap.objects.filter(owner__isnull=True).update(owner=user)
+    NetworkMapType.objects.filter(owner__isnull=True).update(owner=user)
+
+    if not NetworkMapType.objects.filter(owner=user, is_default=True).exists():
+        default = NetworkMapType.objects.filter(is_default=True).first()
+        if default:
+            default.owner = user
+            default.save(update_fields=['owner'])
+        else:
+            NetworkMapType.objects.create(
+                owner=user,
+                is_default=True,
+                name='Стандартная',
+                sectors=DEFAULT_SECTORS,
+                circles=DEFAULT_CIRCLES,
+            )
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+        ('contacts', '0010_conflictology_on_map_type'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='contact',
+            name='owner',
+            field=models.ForeignKey(
+                blank=True,
+                null=True,
+                on_delete=django.db.models.deletion.CASCADE,
+                related_name='contacts',
+                to=settings.AUTH_USER_MODEL,
+                verbose_name='Владелец',
+            ),
+        ),
+        migrations.AddField(
+            model_name='networkmap',
+            name='owner',
+            field=models.ForeignKey(
+                blank=True,
+                null=True,
+                on_delete=django.db.models.deletion.CASCADE,
+                related_name='network_maps',
+                to=settings.AUTH_USER_MODEL,
+                verbose_name='Владелец',
+            ),
+        ),
+        migrations.AddField(
+            model_name='networkmaptype',
+            name='owner',
+            field=models.ForeignKey(
+                blank=True,
+                null=True,
+                on_delete=django.db.models.deletion.CASCADE,
+                related_name='network_map_types',
+                to=settings.AUTH_USER_MODEL,
+                verbose_name='Владелец',
+            ),
+        ),
+        migrations.AddField(
+            model_name='relation',
+            name='owner',
+            field=models.ForeignKey(
+                blank=True,
+                null=True,
+                on_delete=django.db.models.deletion.CASCADE,
+                related_name='relations',
+                to=settings.AUTH_USER_MODEL,
+                verbose_name='Владелец',
+            ),
+        ),
+        migrations.RunPython(assign_legacy_owner, migrations.RunPython.noop),
+    ]

backend/contacts/mixins.py

@@ -0,0 +1,25 @@
+from rest_framework.exceptions import PermissionDenied
+
+from core.access import use_jwt_auth
+
+
+class OwnerScopedMixin:
+    owner_field = 'owner'
+
+    def get_queryset(self):
+        qs = super().get_queryset()
+        if not use_jwt_auth():
+            return qs
+        user = self.request.user
+        if user and user.is_authenticated:
+            return qs.filter(**{self.owner_field: user})
+        return qs.none()
+
+    def perform_create(self, serializer):
+        if use_jwt_auth():
+            user = self.request.user
+            if not user or not user.is_authenticated:
+                raise PermissionDenied()
+            serializer.save(**{self.owner_field: user})
+            return
+        serializer.save()

backend/contacts/models.py

@@ -1,3 +1,4 @@
+from django.conf import settings
 from django.core.validators import MaxValueValidator, MinValueValidator
 from django.db import models
 
@@ -10,6 +11,14 @@ from core.choices import (
 class Contact(models.Model):
     """Контакт в социальном графе."""
 
+    owner = models.ForeignKey(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.CASCADE,
+        related_name='contacts',
+        null=True,
+        blank=True,
+        verbose_name='Владелец',
+    )
     name = models.CharField(max_length=255, verbose_name='Имя')
     email = models.EmailField(blank=True, verbose_name='Email')
     phone = models.CharField(max_length=50, blank=True, verbose_name='Телефон')
@@ -31,6 +40,14 @@ class Contact(models.Model):
 class NetworkMapType(models.Model):
     """Тип карты сети: настраиваемые секторы и концентрические круги."""
 
+    owner = models.ForeignKey(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.CASCADE,
+        related_name='network_map_types',
+        null=True,
+        blank=True,
+        verbose_name='Владелец',
+    )
     name = models.CharField(max_length=255, verbose_name='Название типа')
     sectors = models.JSONField(default=list, verbose_name='Секторы')
     circles = models.JSONField(default=list, verbose_name='Круги')
@@ -54,6 +71,14 @@ class NetworkMapType(models.Model):
 class NetworkMap(models.Model):
     """Карта сети — отдельный контекст для визуализации подмножества контактов."""
 
+    owner = models.ForeignKey(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.CASCADE,
+        related_name='network_maps',
+        null=True,
+        blank=True,
+        verbose_name='Владелец',
+    )
     name = models.CharField(max_length=255, verbose_name='Название')
     description = models.TextField(blank=True, verbose_name='Описание')
     map_type = models.ForeignKey(
@@ -136,6 +161,14 @@ class NetworkMapMembership(models.Model):
 class Relation(models.Model):
     """Связь между двумя контактами."""
 
+    owner = models.ForeignKey(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.CASCADE,
+        related_name='relations',
+        null=True,
+        blank=True,
+        verbose_name='Владелец',
+    )
     source = models.ForeignKey(
         Contact,
         on_delete=models.CASCADE,

backend/contacts/serializers.py

@@ -1,8 +1,17 @@
 from rest_framework import serializers
+
+from core.access import use_jwt_auth
 from .models import Contact, Relation, NetworkMap, NetworkMapMembership, NetworkMapType
 from .map_type_validation import validate_map_type_payload
 
 
+def scoped_map_types_queryset(request):
+    qs = NetworkMapType.objects.all()
+    if use_jwt_auth() and request and request.user.is_authenticated:
+        return qs.filter(owner=request.user)
+    return qs
+
+
 class ContactSerializer(serializers.ModelSerializer):
     relations_count = serializers.SerializerMethodField()
 
@@ -37,10 +46,22 @@ class RelationSerializer(serializers.ModelSerializer):
         read_only_fields = ['id', 'created_at', 'source_name', 'target_name']
 
     def validate(self, data):
-        if data.get('source') == data.get('target'):
+        request = self.context.get('request')
+        source = data.get('source') or getattr(self.instance, 'source', None)
+        target = data.get('target') or getattr(self.instance, 'target', None)
+
+        if source and target and source == target:
             raise serializers.ValidationError(
                 'Нельзя создать связь контакта с самим собой.'
             )
+
+        if use_jwt_auth() and request and request.user.is_authenticated:
+            user = request.user
+            for contact in (source, target):
+                if contact and contact.owner_id != user.id:
+                    raise serializers.ValidationError(
+                        'Контакт не принадлежит текущему пользователю.'
+                    )
         return data
 
 
@@ -61,8 +82,13 @@ class NetworkMapTypeSerializer(serializers.ModelSerializer):
             raise serializers.ValidationError(errors)
         return data
 
+    def _default_exists(self):
+        request = self.context.get('request')
+        qs = scoped_map_types_queryset(request)
+        return qs.filter(is_default=True).exists()
+
     def create(self, validated_data):
-        if NetworkMapType.objects.filter(is_default=True).exists():
+        if self._default_exists():
             validated_data['is_default'] = False
         return super().create(validated_data)
 
@@ -82,12 +108,22 @@ class NetworkMapSerializer(serializers.ModelSerializer):
         ]
         read_only_fields = ['id', 'created_at', 'updated_at', 'memberships_count']
 
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        request = self.context.get('request')
+        self.fields['map_type'].queryset = scoped_map_types_queryset(request)
+
     def validate(self, data):
+        request = self.context.get('request')
         if not data.get('map_type') and not getattr(self.instance, 'map_type_id', None):
-            default_type = NetworkMapType.objects.filter(is_default=True).first()
+            default_type = scoped_map_types_queryset(request).filter(is_default=True).first()
             if not default_type:
                 raise serializers.ValidationError({'map_type': 'Нет типа карты по умолчанию.'})
             data['map_type'] = default_type
+        map_type = data.get('map_type') or getattr(self.instance, 'map_type', None)
+        if use_jwt_auth() and request and request.user.is_authenticated and map_type:
+            if map_type.owner_id != request.user.id:
+                raise serializers.ValidationError({'map_type': 'Тип карты не принадлежит текущему пользователю.'})
         return data
 
     def get_memberships_count(self, obj):

backend/contacts/views.py

@@ -1,6 +1,9 @@
 from rest_framework import viewsets
-from rest_framework.exceptions import ValidationError
+from rest_framework.exceptions import PermissionDenied, ValidationError
 
+from core.access import use_jwt_auth
+from core.drf_mixins import JwtAuthMixin
+from .mixins import OwnerScopedMixin
 from .models import Contact, Relation, NetworkMap, NetworkMapMembership, NetworkMapType
 from .serializers import (
     ContactSerializer,
@@ -11,7 +14,7 @@ from .serializers import (
 )
 
 
-class ContactViewSet(viewsets.ModelViewSet):
+class ContactViewSet(JwtAuthMixin, OwnerScopedMixin, viewsets.ModelViewSet):
     queryset = Contact.objects.all()
     serializer_class = ContactSerializer
 
@@ -23,17 +26,17 @@ class ContactViewSet(viewsets.ModelViewSet):
         return qs
 
 
-class RelationViewSet(viewsets.ModelViewSet):
+class RelationViewSet(JwtAuthMixin, OwnerScopedMixin, viewsets.ModelViewSet):
     queryset = Relation.objects.select_related('source', 'target').all()
     serializer_class = RelationSerializer
 
 
-class NetworkMapViewSet(viewsets.ModelViewSet):
+class NetworkMapViewSet(JwtAuthMixin, OwnerScopedMixin, viewsets.ModelViewSet):
     queryset = NetworkMap.objects.select_related('map_type').all()
     serializer_class = NetworkMapSerializer
 
 
-class NetworkMapTypeViewSet(viewsets.ModelViewSet):
+class NetworkMapTypeViewSet(JwtAuthMixin, OwnerScopedMixin, viewsets.ModelViewSet):
     queryset = NetworkMapType.objects.all()
     serializer_class = NetworkMapTypeSerializer
 
@@ -45,15 +48,39 @@ class NetworkMapTypeViewSet(viewsets.ModelViewSet):
         instance.delete()
 
 
-class NetworkMapMembershipViewSet(viewsets.ModelViewSet):
+class NetworkMapMembershipViewSet(JwtAuthMixin, viewsets.ModelViewSet):
     serializer_class = NetworkMapMembershipSerializer
 
     def get_queryset(self):
         map_id = self.kwargs.get('map_pk')
-        return NetworkMapMembership.objects.filter(
+        qs = NetworkMapMembership.objects.filter(
             map_id=map_id
         ).select_related('contact', 'map')
+        if use_jwt_auth():
+            user = self.request.user
+            if user and user.is_authenticated:
+                return qs.filter(map__owner=user, contact__owner=user)
+            return qs.none()
+        return qs
 
     def perform_create(self, serializer):
         map_id = self.kwargs.get('map_pk')
+        if use_jwt_auth():
+            user = self.request.user
+            if not user or not user.is_authenticated:
+                raise PermissionDenied()
+            network_map = NetworkMap.objects.filter(pk=map_id, owner=user).first()
+            if not network_map:
+                raise PermissionDenied()
+            contact = serializer.validated_data.get('contact')
+            if contact.owner_id != user.id:
+                raise ValidationError({'contact': 'Контакт не принадлежит текущему пользователю.'})
         serializer.save(map_id=map_id)
+
+    def perform_update(self, serializer):
+        if use_jwt_auth():
+            user = self.request.user
+            contact = serializer.validated_data.get('contact', serializer.instance.contact)
+            if contact.owner_id != user.id:
+                raise ValidationError({'contact': 'Контакт не принадлежит текущему пользователю.'})
+        serializer.save()