customerwebsitebackend/api/views.py

import logging
import json
import urllib.request
import urllib.error
from django.conf import settings
from django.core.cache import cache
from rest_framework import status, permissions
from rest_framework.response import Response
from rest_framework.views import APIView
from django.contrib.auth.models import User
from .serializers import UserRegisterSerializer

audit_logger = logging.getLogger('audit')

class UserRegisterView(APIView):
    permission_classes = [permissions.AllowAny]

    def post(self, request):
        serializer = UserRegisterSerializer(data=request.data)
        if serializer.is_valid():
            serializer.save()
            audit_logger.info(f"AUDIT - User Register: Username '{serializer.validated_data.get('username')}' registered successfully.")
            return Response({"message": "User registered successfully"}, status=status.HTTP_201_CREATED)
        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)

class UserProfileView(APIView):
    permission_classes = [permissions.IsAuthenticated]

    def get(self, request):
        user = request.user
        profile = getattr(user, 'customer_profile', None)
        return Response({
            "username": user.username,
            "email": user.email,
            "phone": profile.phone if profile else "",
            "address": profile.default_address if profile else ""
        })

    def put(self, request):
        user = request.user
        profile = getattr(user, 'customer_profile', None)
        user.email = request.data.get('email', user.email)
        user.save()
        if profile:
            profile.phone = request.data.get('phone', profile.phone)
            profile.default_address = request.data.get('address', profile.default_address)
            profile.save()
        return Response({"message": "Profile updated successfully"})

class SendWhatsAppOTPView(APIView):
    permission_classes = [permissions.AllowAny]

    def post(self, request):
        mobile_number = request.data.get('mobile_number')
        otp_code = request.data.get('otp_code')
        template_name = request.data.get('template_name', 'mobile_number_verification')

        if not mobile_number or not otp_code:
            return Response({"error": "mobile_number and otp_code are required"}, status=status.HTTP_400_BAD_REQUEST)

        audit_logger.info(f"AUDIT - Send WhatsApp OTP: mobile '{mobile_number}', OTP '{otp_code}'")

        # Store OTP in backend cache for 5 minutes (300 seconds)
        clean_phone = str(mobile_number).replace('+', '').strip()
        cache.set(f"whatsapp_otp_{clean_phone}", str(otp_code), timeout=300)

        whatsapp_service_url = getattr(settings, 'WHATSAPP_SERVICE_URL', 'http://betawhatsapp.tradhox.com/api/send/')
        payload = {
            "mobile_number": mobile_number,
            "otp_code": otp_code,
            "template_name": template_name
        }

        try:
            req_data = json.dumps(payload).encode('utf-8')
            req = urllib.request.Request(
                whatsapp_service_url,
                data=req_data,
                headers={'Content-Type': 'application/json', 'User-Agent': 'TradhoxBackend/1.0'}
            )
            with urllib.request.urlopen(req, timeout=10) as resp:
                status_code = resp.status
                body_bytes = resp.read()
                try:
                    res_data = json.loads(body_bytes.decode('utf-8'))
                except Exception:
                    res_data = {"text": body_bytes.decode('utf-8', errors='ignore')}

            if status_code == 200 and res_data.get('status') != 'error':
                return Response({
                    "status": "success",
                    "message": f"WhatsApp OTP dispatched to {mobile_number}",
                    "mobile_number": mobile_number,
                    "gateway_response": res_data
                }, status=status.HTTP_200_OK)
            else:
                audit_logger.warning(f"WhatsApp gateway response for {mobile_number}: {status_code} {res_data}")
                return Response({
                    "status": "success",
                    "message": f"WhatsApp OTP request submitted for {mobile_number}",
                    "mobile_number": mobile_number,
                    "gateway_response": res_data
                }, status=status.HTTP_200_OK)
        except urllib.error.HTTPError as e:
            err_body = e.read().decode('utf-8', errors='ignore')
            try:
                err_data = json.loads(err_body)
            except Exception:
                err_data = {"text": err_body}
            audit_logger.warning(f"WhatsApp gateway HTTPError {e.code} for {mobile_number}: {err_data}")
            return Response({
                "status": "warning",
                "message": f"WhatsApp gateway returned status {e.code}",
                "gateway_response": err_data,
                "mobile_number": mobile_number
            }, status=status.HTTP_200_OK)
        except Exception as e:
            audit_logger.error(f"WhatsApp service connection error for {mobile_number}: {e}")
            return Response({
                "status": "error",
                "message": f"Could not reach WhatsApp service gateway: {str(e)}",
                "mobile_number": mobile_number
            }, status=status.HTTP_500_INTERNAL_SERVER_ERROR)

class VerifyOTPView(APIView):
    permission_classes = [permissions.AllowAny]

    def post(self, request):
        mobile_number = request.data.get('mobile_number')
        otp_code = request.data.get('otp_code')

        if not mobile_number or not otp_code:
            return Response({"error": "mobile_number and otp_code are required"}, status=status.HTTP_400_BAD_REQUEST)

        clean_phone = str(mobile_number).replace('+', '').strip()
        stored_otp = cache.get(f"whatsapp_otp_{clean_phone}")

        if stored_otp and str(stored_otp).strip() == str(otp_code).strip():
            audit_logger.info(f"AUDIT - OTP Verification SUCCESS: mobile '{mobile_number}'")
            return Response({
                "status": "success",
                "message": "OTP verified successfully"
            }, status=status.HTTP_200_OK)
        else:
            audit_logger.warning(f"AUDIT - OTP Verification FAILED: mobile '{mobile_number}', submitted '{otp_code}', expected '{stored_otp}'")
            return Response({
                "status": "error",
                "message": "Invalid or expired OTP verification code. Access denied."
            }, status=status.HTTP_400_BAD_REQUEST)