From e479c210e2a89b0226fd43cf62c4ce4600398698 Mon Sep 17 00:00:00 2001 From: vickytechkey Date: Sun, 4 Oct 2026 10:48:35 +0530 Subject: [PATCH] feat: add user registration, profile management, and WhatsApp OTP verification API views --- api/views.py | 28 +++++++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) diff --git a/api/views.py b/api/views.py index a47fa58..b9a5ca0 100644 --- a/api/views.py +++ b/api/views.py @@ -119,14 +119,40 @@ class SendWhatsAppOTPView(APIView): mobile_number = request.data.get('mobile_number') otp_code = request.data.get('otp_code') template_name = request.data.get('template_name', 'mobile_number_verification') + purpose = request.data.get('purpose', 'login') if not mobile_number or not otp_code: return Response({"error": "mobile_number and otp_code are required"}, status=status.HTTP_400_BAD_REQUEST) + clean_phone = str(mobile_number).replace('+', '').strip() + raw_10 = clean_phone[-10:] if len(clean_phone) >= 10 else clean_phone + + # Account existence validation + user_exists = False + try: + from orders.models import CustomerProfile + user_exists = User.objects.filter(username__icontains=raw_10).exists() or CustomerProfile.objects.filter(phone__icontains=raw_10).exists() + except Exception as db_err: + audit_logger.warning(f"DB lookup notice for {mobile_number}: {db_err}") + user_exists = False + + if purpose == 'login' and not user_exists: + audit_logger.warning(f"AUDIT - Login attempt for non-existent mobile: '{mobile_number}'") + return Response({ + "status": "error", + "message": "Account not found. Please create a patron account first." + }, status=status.HTTP_404_NOT_FOUND) + + if purpose == 'register' and user_exists: + audit_logger.warning(f"AUDIT - Register attempt for existing mobile: '{mobile_number}'") + return Response({ + "status": "error", + "message": "An account with this mobile number already exists. Please Sign In." + }, status=status.HTTP_400_BAD_REQUEST) + audit_logger.info(f"AUDIT - Send WhatsApp OTP: mobile '{mobile_number}', OTP '{otp_code}'") # Store OTP in backend cache for 5 minutes (300 seconds) - clean_phone = str(mobile_number).replace('+', '').strip() cache.set(f"whatsapp_otp_{clean_phone}", str(otp_code), timeout=300) whatsapp_urls = [