Web Auth Authentication
File: api/nextango/apps/web_auth/authentication.py
Last Updated: 2026-07-09
Overview
WebSessionAuthentication is a Django REST Framework authentication class that resolves request.user from a WebSession rather than a token. It lets DRF views use standard permission classes like IsAuthenticated while honoring session-cookie authentication.
WebSessionAuthentication
authenticate(request) returns a (user, session) tuple or None, following two paths:
Middleware pre-validation. If WebSessionAuthMiddleware already ran and set request.web_session, this class reuses that result instead of validating again. If the session has a linked user, it returns that user. If the session is a guest session and settings.DEBUG is True, it returns an in-memory mock superuser (never persisted to the database) with a fixed id, so guest sessions can exercise admin-gated endpoints during development. If the session is a guest session and DEBUG is False, it returns (None, session), which DRF treats as anonymous.
Direct validation. If the middleware did not run, this class calls SessionService.validate_session(request) directly and applies the same three-way logic (linked user, dev-mode guest, production guest).
If no valid session is found by either path, authenticate() returns None, and DRF falls through to the next configured authentication class.
Return values
(user, session): authenticated user, session-based auth succeeded(None, session): valid guest session, no linked user, DRF treats the request as anonymousNone: no valid session, DRF tries the next authentication class
Dev-mode mock superuser
Active only when settings.DEBUG is True and the session is a guest session. The mock User object is constructed with a fixed id, is_staff=True, and is_superuser=True, but is never saved to the database. It exists purely so demo sessions can be tested against admin-gated views locally. In production (DEBUG=False), guest sessions never receive elevated permissions.
Relationship to the middleware
WebSessionAuthMiddleware (see middleware.md) validates the session once per request, before the view runs, and sets request.web_session. WebSessionAuthentication runs during DRF's authentication step and reuses that result when present, avoiding a duplicate database query. If the middleware is not configured or was bypassed for a given path, this class still works on its own by validating directly.