feat(settings/base.py): add GITEA_URL config

home/apps.py

@@ -4,3 +4,6 @@ from django.apps import AppConfig
 class HomeConfig(AppConfig):
     default_auto_field = "django.db.models.BigAutoField"
     name = "home"
+
+    def ready(self):
+        import home.signals

home/signals.py

@@ -0,0 +1,39 @@
+import os
+
+import requests
+from django.conf import settings
+from django.contrib.auth.models import User
+from django.db.models.signals import post_save
+from django.dispatch import receiver
+
+
+@receiver(post_save, sender=User)
+def notify_external_service_on_signup(sender, instance, created, **kwargs):
+    pass
+    # if created and not instance.is_staff:
+    #     payload = {
+    #         "user_id": instance.id,
+    #         "username": f"KURSY-{instance.id}",
+    #         "email": instance.email,
+    #         "full_name": f"{instance.first_name} {instance.last_name}".strip(),
+    #         # "must_change_password": True,
+    #         # "password": instance.password,
+    #         "visibility": "private",
+    #     }
+    #     api_url = getattr(settings, "GITEA_URL", None)
+    #     if api_url:
+    #         url = f"{api_url}/admin/users"
+    #         try:
+    #             response = requests.post(
+    #                 url,
+    #                 json=payload,
+    #                 timeout=5,
+    #                 headers={"Authorization": f"token {os.getenv('GITEA_API_TOKEN')}"},
+    #             )
+    #             response.raise_for_status()
+    #             print(f"Successfully created Gitea account for {instance.email}")
+    #         except Exception as e:
+    #             print(
+    #                 f"Failed to create Gitea account for user {instance.email}: {e}\n{response.text}"
+    #             )
+    #             raise e

kursy/oauth_validators.py

@@ -0,0 +1,11 @@
+from oauth2_provider.oauth2_validators import OAuth2Validator
+
+
+class CustomOAuth2Validator(OAuth2Validator):
+    def get_additional_claims(self, request):
+        print("get_additional_claims", request.user)
+        return {
+            "name": " ".join([request.user.first_name, request.user.last_name]),
+            "preferred_username": f"studio77-{request.user.username}",
+            "email": request.user.email,
+        }

kursy/settings/base.py

@@ -58,6 +58,7 @@ INSTALLED_APPS = [
     "allauth.account",
     "allauth.socialaccount",
     "allauth.socialaccount.providers.github",
+    "oauth2_provider",
     "tailwind",
     "theme",
     "widget_tweaks",
@@ -75,6 +76,7 @@ MIDDLEWARE = [
     "wagtail.contrib.redirects.middleware.RedirectMiddleware",
     "allauth.account.middleware.AccountMiddleware",
     "django.middleware.locale.LocaleMiddleware",
+    "oauth2_provider.middleware.OAuth2TokenMiddleware",
 ]
 
 ROOT_URLCONF = "kursy.urls"
@@ -131,6 +133,26 @@ SOCIALACCOUNT_PROVIDERS = {
 
 WSGI_APPLICATION = "kursy.wsgi.application"
 
+OAUTH2_PROVIDER = {
+    "OIDC_ENABLED": True,
+    "OIDC_RPID_ENDPOINT": "http://127.0.0.1:8000/oauth2",
+    "OIDC_ISS_ENDPOINT": "http://127.0.0.1:8000",
+    "PKCE_REQUIRED": False,
+    "OAUTH2_VALIDATOR_CLASS": "kursy.oauth_validators.CustomOAuth2Validator",
+    "SCOPES": {
+        "openid": "OpenID Connect scope",
+        "profile": "User profile scope",
+        "email": "User email scope",
+        "read": "Read scope",
+        "write": "Write scope",
+    },
+    "OIDC_CLAIM_MAPS": {
+        "nickname": "preferred_username",
+        "email": "email",
+    },
+    "DEFAULT_SCOPES": ["openid", "profile", "email"],
+}
+
 
 # Database
 # https://docs.djangoproject.com/en/6.0/ref/settings/#databases
@@ -252,3 +274,6 @@ WAGTAILDOCS_EXTENSIONS = [
 ]
 
 TAILWIND_APP_NAME = "theme"
+
+# Gitea API
+GITEA_URL = "http://localhost:3000/api/v1"

kursy/urls.py

@@ -20,6 +20,7 @@ urlpatterns = [
     path("accounts/profile/", views.profile, name="profile"),
     path("accounts/signup/", views.signup, name="signup"),
     path("i18n/", include("django.conf.urls.i18n")),
+    path("oauth2/", include("oauth2_provider.urls", namespace="oauth2_provider")),
     path("", include("home.urls")),
     path("calendar/", views.calendar, name="calendar"),
     # TODO: move occurrence related urls to home app

pyproject.toml

@@ -8,6 +8,7 @@ dependencies = [
     "django-allauth-ui>=1.8.1",
     "django-allauth[socialaccount]>=65.15.0",
     "django-browser-reload>=1.21.0",
+    "django-oauth-toolkit>=3.2.0",
     "django-tailwind>=4.4.2",
     "django-widget-tweaks>=1.5.1",
     "python-dotenv>=1.2.2",

uv.lock

@@ -308,6 +308,21 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/a5/e4/ec99d52aa04e204e938564b603f4591e2e82e236ed59af664fee35179e75/django_modelcluster-6.4.1-py2.py3-none-any.whl", hash = "sha256:ccc190cd9e22c24900ea2410bff64d444d48f43f0f4aedeed0f6cd94e2536698", size = 29315, upload-time = "2025-12-04T12:21:39.911Z" },
 ]
 
+[[package]]
+name = "django-oauth-toolkit"
+version = "3.2.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "django" },
+    { name = "jwcrypto" },
+    { name = "oauthlib" },
+    { name = "requests" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/a7/95/efd83b35c34b86eb2249d2b54c5eaf383c48f3f19034aa6f3807e37471b6/django_oauth_toolkit-3.2.0.tar.gz", hash = "sha256:c36761ae6810083d95a652e9c820046cde0d45a2e2a5574bbe7202656ec20bb6", size = 114211, upload-time = "2026-01-08T22:03:13.311Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ae/cc/f27a784c0ecd13335abd9ef85ebb80dbc04945f919da5f496f56e3562751/django_oauth_toolkit-3.2.0-py3-none-any.whl", hash = "sha256:bd2cd2719b010231a2f370f927dbcc740454fb1d0dd7e7f4138f36227363dc26", size = 87077, upload-time = "2026-01-08T22:03:12.123Z" },
+]
+
 [[package]]
 name = "django-permissionedforms"
 version = "0.1"
@@ -456,6 +471,19 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/62/a1/3d680cbfd5f4b8f15abc1d571870c5fc3e594bb582bc3b64ea099db13e56/jinja2-3.1.6-py3-none-any.whl", hash = "sha256:85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67", size = 134899, upload-time = "2025-03-05T20:05:00.369Z" },
 ]
 
+[[package]]
+name = "jwcrypto"
+version = "1.5.6"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "cryptography" },
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/e1/db/870e5d5fb311b0bcf049630b5ba3abca2d339fd5e13ba175b4c13b456d08/jwcrypto-1.5.6.tar.gz", hash = "sha256:771a87762a0c081ae6166958a954f80848820b2ab066937dc8b8379d65b1b039", size = 87168, upload-time = "2024-03-06T19:58:31.831Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/cd/58/4a1880ea64032185e9ae9f63940c9327c6952d5584ea544a8f66972f2fda/jwcrypto-1.5.6-py3-none-any.whl", hash = "sha256:150d2b0ebbdb8f40b77f543fb44ffd2baeff48788be71f67f03566692fd55789", size = 92520, upload-time = "2024-03-06T19:58:29.765Z" },
+]
+
 [[package]]
 name = "kursy"
 version = "0.1.0"
@@ -466,6 +494,7 @@ dependencies = [
     { name = "django-allauth", extra = ["socialaccount"] },
     { name = "django-allauth-ui" },
     { name = "django-browser-reload" },
+    { name = "django-oauth-toolkit" },
     { name = "django-tailwind" },
     { name = "django-widget-tweaks" },
     { name = "python-dotenv" },
@@ -482,6 +511,7 @@ requires-dist = [
     { name = "django-allauth", extras = ["socialaccount"], specifier = ">=65.15.0" },
     { name = "django-allauth-ui", specifier = ">=1.8.1" },
     { name = "django-browser-reload", specifier = ">=1.21.0" },
+    { name = "django-oauth-toolkit", specifier = ">=3.2.0" },
     { name = "django-tailwind", specifier = ">=4.4.2" },
     { name = "django-widget-tweaks", specifier = ">=1.5.1" },
     { name = "python-dotenv", specifier = ">=1.2.2" },