I am facing authorization issues with my django app.
Context: I have a django app that provides an option for the users to authorize their miro accounts and access their miro boards within the app. It has the following view for authorization and callbacks:
@login_required
def miro_authorize(request):
profile = request.user.profile
if not profile.miro_client_id or not profile.miro_client_secret:
messages.error(request, "Please update your Miro Client ID and Client Secret in your profile.")
return redirect('profile')
# Redirect the user to Miro's OAuth2 authorization page
redirect_uri = settings.MIRO_REDIRECT_URI
scope = "boards:write boards:read"
miro_auth_url = f"https://miro.com/oauth/authorize?response_type=code&client_id={profile.miro_client_id}&redirect_uri={redirect_uri}&scope={scope}"
return redirect(miro_auth_url)
@login_required
def miro_callback(request):
code = request.GET.get('code')
profile = request.user.profile
if not code:
messages.error(request, "No authorization code found.")
return redirect('profile')
# Exchange code for an access token
token_url = "https://api.miro.com/v1/oauth/token"
redirect_uri = settings.MIRO_REDIRECT_URI
data = {
'grant_type': 'authorization_code',
'code': code,
'redirect_uri': redirect_uri,
'client_id': profile.miro_client_id,
'client_secret': profile.miro_client_secret
}
try:
# Step 1: Fetch Access Token
token_response = requests.post(token_url, data=data)
token_response.raise_for_status()
token_data = token_response.json()
# Save the tokens
profile.miro_access_token = token_data.get('access_token')
profile.miro_refresh_token = token_data.get('refresh_token')
profile.save()
# Step 2: Fetch User's Miro ID from /v2/me
headers = {
'Authorization': f'Bearer {profile.miro_access_token}'
}
user_info_url = "https://api.miro.com/v1/users/me"
user_response = requests.get(user_info_url, headers=headers)
user_response.raise_for_status()
user_data = user_response.json()
# Save the Miro User ID to the profile
profile.miro_user_id = user_data.get('id') # Extract user ID
profile.save()
# Step 3: Fetch user-specific boards
user_boards_url = "https://api.miro.com/v2/boards"
boards_response = requests.get(user_boards_url, headers=headers)
boards_response.raise_for_status()
boards_data = boards_response.json()
# Filter boards by 'createdBy' matching the user's Miro ID
user_owned_boards = [
board for board in boards_data.get('data', [])
if board.get('createdBy') == profile.miro_user_id
]
# Optionally, store filtered boards in the profile or session
request.session['miro_boards'] = user_owned_boards
messages.success(request, "Miro account connected successfully! Your boards are now visible.")
return redirect('profile')
except requests.exceptions.RequestException as e:
messages.error(request, f"Error connecting to Miro: {str(e)}")
return redirect('profile')
The issue that I am facing is, my users are able to see the teams and the boards that I created for myself in the app. Ideally, they should be seeing only the teams and the boards that they created. Can anyone help me identify what am I doing wrong?
For additional context, here is the Django template:
<div class="row g-4 py-5">
<div class="col d-flex align-items-start">
<div>
<h2 class="mb-3 border-bottom" style="color: black">Your Conversational Flows</h2>
<p class="col d-flex align-items-start">To see your conversational flows or to create one:</p>
<p class="col d-flex align-items-start"><a href="{% url 'miro_authorize' %}">Authorize Miro</a></p>
</div>
</div>
Following are the Django Urls:
path('miro/authorize/', miro_authorize, name='miro_authorize'),
path('miro/callback/', miro_callback, name='miro_callback'),
Following is my user profile model:
# Create your models here.
class Profile(models.Model):
user = models.OneToOneField(User, on_delete=models.CASCADE)
miro_client_id = models.CharField(max_length=255, blank=True, null=True, verbose_name="Miro Client ID")
miro_client_secret = models.TextField(blank=True, null=True, verbose_name="Miro Client Secret")
miro_access_token = models.CharField(max_length=255, null=True, blank=True)
miro_refresh_token = models.CharField(max_length=255, null=True, blank=True)
miro_team_id = models.CharField(max_length=255, blank=True, null=True)
miro_user_id = models.CharField(max_length=255, blank=True, null=True, verbose_name="Miro User ID") # New field
