Skip to content

Add management API for services (token auth, datasets, studies, progress, results) - #102

Open
maubreville wants to merge 3 commits into
mainfrom
feature/management-api
Open

maubreville wants to merge 3 commits into
mainfrom
feature/management-api

Conversation

@maubreville

@maubreville maubreville commented Oct 23, 2026 •

Copy link
Copy Markdown
Collaborator

Closes #101

What

Backward-compatible management API so services (here: the muROMI dataset manager) can create and follow studies:

  • token auth (rest_framework.authtoken; SessionAuthentication stays first so unauthenticated requests still return 403, not 401)
  • POST /v1/datasets/ (zip upload, rejects non-zip), GET/POST /v1/uis/, GET /v1/groups/, POST /v1/studies/ (validates end_date > pub_date)
  • GET /v1/studies/{id}/progress/ – per reviewer: classified / finished
  • GET /v1/export/{id}/results/ – latest answer per reviewer and image, JSON
  • all new endpoints staff-only; README section added
  • staff study overview (needed because a study's link opens the swipe view, which is a 404 for anyone outside the study's group): GET /v1/studies/all/, richer progress (study details, answer distribution), staff in the auth status, and pages /#/admin/studies and /#/admin/studies/:id (menu entry for staff only). Regenerated docs/openapi.yaml and api.v1.ts (yarn api + eslint, so the diff is only the additions)

Deploy notes

  • python manage.py migrate (creates the authtoken table)
  • python manage.py drf_create_token <staff-user> for the service
  • reverse proxy: raise client_max_body_size so batch archives can be uploaded
  • no changes to existing models or endpoints, no new dependencies (authtoken ships with DRF)

Testing

manage.py test app.tests: 16 tests pass (10 new in test_manage.py: token required, non-staff refused, non-zip rejected, study creation, date validation, progress incl. "latest answer wins" and group members not yet started, results, overview of all studies, staff flag). Frontend: vue-tsc, eslint and vite build pass; the overview pages were checked in Chrome against a local backend (staff see the menu entry and the data, a reviewer gets neither and a 403 from the API). Also exercised end to end with the muROMI dataset manager against a local instance (230 real crops, three simulated reviewers, automatic import).

🤖 Generated with Claude Code

maubreville and others added 3 commits October 23, 2026 12:17
Token authentication plus endpoints to upload datasets, create studies,
list UIs and groups, follow per-reviewer progress and fetch results as
JSON. Session login and existing endpoints are unchanged (Session stays
the first authenticator so unauthenticated requests still answer 403).
All new endpoints are staff-only.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Opening a study in the web app shows the reviewers' swipe view, which only
members of the study's group can open (everybody else gets "404: No Study
matches the given query"). Staff had no way to see how a study is doing.

- GET /v1/studies/all/ (staff): every study with its progress
- progress now includes study details and the distribution of the answers
- auth status tells whether the user is staff
- frontend: /admin/studies (list) and /admin/studies/:id (reviewer progress,
  answers, CSV/JSON results), linked in the menu for staff only
- regenerated openapi.yaml and the typed client

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

API for services: create datasets/studies, follow reviewer progress, token auth

1 participant