mozilla/oneanddone — pull request #95 by bobsilverberg (2013-12-16 20:41:56+00:00)
Title: Switch API to use auth tokens instead of basic auth

@Osmose: I realized that using basic auth and relying on admin users for the API is going to be a problem for contributors. They wouldn't be able to run the tests themselves and that's a big issue.

This PR changes the auth method to use an api token, which is a feature that is supported by Django REST Framework. An administrator can create an api token for a user via the admin site, and then that user can use the api token to authorize access to the API. I believe this is how the permissions for the Moztrap API work, but I am trying to find out from @camd.

As we won't need the API at all in production, before this goes to production we should look at the best way of disabling the API in production. One option would be to create a [Custom Permission class] (http://django-rest-framework.org/api-guide/permissions#custom-permissions) which looks at the url requested and denies anything with `mozilla` in it. That's just one idea ottomh - I am sure you have better ideas.

Please let me know if you have any issues with this approach / PR as I am currently writing some base tests that make use of the API this way.

Note also that after these changes are applied you'll need to run syncdb and migrate to pick up the new table.