Add JWT auth with per-user data isolation and account settings.

Users can register, log in, and manage profile/password in a personal account page; server data is scoped by owner across contacts, maps, tags, and import.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/contacts/views.py

@@ -1,6 +1,9 @@
 from rest_framework import viewsets
-from rest_framework.exceptions import ValidationError
+from rest_framework.exceptions import PermissionDenied, ValidationError
 
+from core.access import use_jwt_auth
+from core.drf_mixins import JwtAuthMixin
+from .mixins import OwnerScopedMixin
 from .models import Contact, Relation, NetworkMap, NetworkMapMembership, NetworkMapType
 from .serializers import (
     ContactSerializer,
@@ -11,7 +14,7 @@ from .serializers import (
 )
 
 
-class ContactViewSet(viewsets.ModelViewSet):
+class ContactViewSet(JwtAuthMixin, OwnerScopedMixin, viewsets.ModelViewSet):
     queryset = Contact.objects.all()
     serializer_class = ContactSerializer
 
@@ -23,17 +26,17 @@ class ContactViewSet(viewsets.ModelViewSet):
         return qs
 
 
-class RelationViewSet(viewsets.ModelViewSet):
+class RelationViewSet(JwtAuthMixin, OwnerScopedMixin, viewsets.ModelViewSet):
     queryset = Relation.objects.select_related('source', 'target').all()
     serializer_class = RelationSerializer
 
 
-class NetworkMapViewSet(viewsets.ModelViewSet):
+class NetworkMapViewSet(JwtAuthMixin, OwnerScopedMixin, viewsets.ModelViewSet):
     queryset = NetworkMap.objects.select_related('map_type').all()
     serializer_class = NetworkMapSerializer
 
 
-class NetworkMapTypeViewSet(viewsets.ModelViewSet):
+class NetworkMapTypeViewSet(JwtAuthMixin, OwnerScopedMixin, viewsets.ModelViewSet):
     queryset = NetworkMapType.objects.all()
     serializer_class = NetworkMapTypeSerializer
 
@@ -45,15 +48,39 @@ class NetworkMapTypeViewSet(viewsets.ModelViewSet):
         instance.delete()
 
 
-class NetworkMapMembershipViewSet(viewsets.ModelViewSet):
+class NetworkMapMembershipViewSet(JwtAuthMixin, viewsets.ModelViewSet):
     serializer_class = NetworkMapMembershipSerializer
 
     def get_queryset(self):
         map_id = self.kwargs.get('map_pk')
-        return NetworkMapMembership.objects.filter(
+        qs = NetworkMapMembership.objects.filter(
             map_id=map_id
         ).select_related('contact', 'map')
+        if use_jwt_auth():
+            user = self.request.user
+            if user and user.is_authenticated:
+                return qs.filter(map__owner=user, contact__owner=user)
+            return qs.none()
+        return qs
 
     def perform_create(self, serializer):
         map_id = self.kwargs.get('map_pk')
+        if use_jwt_auth():
+            user = self.request.user
+            if not user or not user.is_authenticated:
+                raise PermissionDenied()
+            network_map = NetworkMap.objects.filter(pk=map_id, owner=user).first()
+            if not network_map:
+                raise PermissionDenied()
+            contact = serializer.validated_data.get('contact')
+            if contact.owner_id != user.id:
+                raise ValidationError({'contact': 'Контакт не принадлежит текущему пользователю.'})
         serializer.save(map_id=map_id)
+
+    def perform_update(self, serializer):
+        if use_jwt_auth():
+            user = self.request.user
+            contact = serializer.validated_data.get('contact', serializer.instance.contact)
+            if contact.owner_id != user.id:
+                raise ValidationError({'contact': 'Контакт не принадлежит текущему пользователю.'})
+        serializer.save()