Web Auth Serializers

File: api/nextango/apps/web_auth/serializers.py Last Updated: 2026-07-09

Overview

web_auth has two kinds of serializers. Four are read-only response serializers for WebSession, OTPCode, SessionPermission, and User, used to shape API responses. Three are plain Serializer (not ModelSerializer) input validators used by the customer registration views.

WebSessionSerializer

Exposes what an active WebSession model.

Field	read_only	Description
`id`	yes	Session UUID
`session_type`	yes	`demo` or `dashboard`
`is_guest`	yes	Whether the session has no linked user
`email`	yes	Guest email, null for authenticated sessions
`user_id`	yes	`user.id`, null for guest sessions
`user_email`	yes	`user.email`, sourced from the related user
`user_name`	yes	`user.name`, sourced from the related user
`created_at`	yes	Session creation timestamp
`expires_at`	yes	Session expiration timestamp
`last_activity`	yes	Last activity timestamp

All fields are read-only. session_key, ip_address, and user_agent are intentionally excluded from the response.

OTPCodeSerializer

Exposes OTPCode metadata for monitoring and debugging without ever exposing the code itself.

Field	read_only	Description
`email`	yes	Recipient email
`purpose`	yes	OTP purpose
`created_at`	yes	Creation timestamp
`expires_at`	yes	Expiration timestamp
`verified`	yes	Whether the code has been consumed
`attempts`	yes	Failed verification attempts

code is never included. OTP codes reach the client only through email delivery in OTPService.

SessionPermissionSerializer

Exposes a SessionPermission rule.

Field	read_only	Description
`session_type`	yes	`demo` or `dashboard`
`endpoint_pattern`	yes	Regex pattern matched against the request path
`http_methods`	yes	Allowed HTTP methods
`description`	yes	Human-readable explanation

Enforcement happens in WebSessionAuthMiddleware, not in this serializer.

UserBasicSerializer

Exposes essential user identity and role information in authentication responses, without password or sync internals.

Field	read_only	Description
`id`	yes	User UUID
`email`	yes	User email
`name`	yes	Display name
`first_name`	yes	First name
`last_name`	yes	Last name
`status`	yes	Account status
`roles`	yes	Computed from `user.get_all_roles()`
`primary_role`	yes	Computed from `user.get_primary_role()`
`loyalty_points`	yes	Computed by scanning `user_roles_data` for the `roleCustomer` entry and reading `loyaltyPoints`; returns 0 if the user has no customer role data
`has_password`	yes	Whether the user has a password set
`is_superuser`	yes	Superuser flag

Excludes password hash, Sanity sync fields, and audit timestamps.

Registration Input Serializers

These three are plain Serializer classes (not ModelSerializer) used to validate request bodies for the customer registration views. They are writable, not read-only.

InitiateRegistrationSerializer

Field	Required	Description
`email`	yes	Normalized to lowercase and trimmed; must be 255 characters or fewer
`name`	no	Full display name; if provided, must be at least 2 characters after trimming
`first_name`	no	Trimmed if provided
`last_name`	no	Trimmed if provided

Used by InitiateRegistrationView.

VerifyRegistrationSerializer

Field	Required	Description
`email`	yes	Normalized to lowercase and trimmed
`otp_code`	yes	Exactly 6 digits
`registration_token`	yes	Must start with `reg_`

Used by VerifyRegistrationView.

ResendOTPSerializer

Field	Required	Description
`email`	yes	Normalized to lowercase and trimmed
`registration_token`	yes	Must start with `reg_`

Used by ResendOTPView.