Dashboard Authentication - Profile Image

The web console shows a profile image for the signed-in user in the navbar’s user menu. smarter.apps.account.models.UserProfile.avatar_url chooses it, in this order:

1. the image that the user uploaded, UserProfile.profile_image;

2. the image that the oauth provider supplied when the user last signed in, UserProfile.profile_image_url: Google’s and LinkedIn’s picture, or GitHub’s avatar_url;

3. a default silhouette, static/images/avatars/default-profile.svg.

To upload an image, click the image in the user menu, or choose Change Profile Image. PNG, JPEG, GIF and WebP files of up to 2 MB are accepted; SVG is not, because it can carry script. Remove Profile Image deletes the upload, and the console falls back to the oauth image, if any. Uploads are stored in Django’s default storage (the platform’s S3 bucket when AWS is configured) under a random file name. Each UserProfile has its own image: for a user with more than one, it is that of the profile that the console acts as, which they choose with the user menu’s Change Profile item. See User Menu React Component.

Views for the authenticated user’s profile image.

smarter.apps.account.views.dashboard.profile_image.PROFILE_IMAGE_CONTENT_TYPES = ('image/png', 'image/jpeg', 'image/gif', 'image/webp')

The image formats that a user may upload.

SVG is excluded because it can carry script.

('image/png', 'image/jpeg', 'image/gif', 'image/webp')

smarter.apps.account.views.dashboard.profile_image.PROFILE_IMAGE_MAX_BYTES = 2097152

The largest profile image that a user may upload, 2 MiB.

class smarter.apps.account.views.dashboard.profile_image.ProfileImageForm(data=None, files=None, auto_id='id_%s', prefix=None, initial=None, error_class=<class 'django.forms.utils.ErrorList'>, label_suffix=None, empty_permitted=False, instance=None, use_required_attribute=None, renderer=None)

Bases: ModelForm

Form for uploading a UserProfile.profile_image, validated as an image by Pillow.

Form fields:

• profile_image: Profile image (ImageField)

clean_profile_image()

Require an image of an allowed format and size.

Returns:

The uploaded file.

Raises:

forms.ValidationError – If no file was sent, or it is too large, or of a format that isn’t allowed.

property media

Return all media required to render the widgets on this form.

class smarter.apps.account.views.dashboard.profile_image.ProfileImageView(**kwargs)

Bases: SmarterAuthenticatedNeverCachedWebView

Upload or remove the authenticated user’s own profile image.

POST a multipart form with a profile_image file to upload one, which replaces any earlier upload. DELETE removes it, and the console falls back to the image from the oauth provider, if any, else the default profile image. Both respond with JSON: {"profile_image_url": <url now shown>} on success, or the form’s errors with status 400.

delete(request, *args, **kwargs)

own_user_profile(request)

Return the authenticated user’s UserProfile, fresh from the database, since it is saved.

It is the profile that the user chose in the user menu, for this session, else their newest. See smarter.apps.account.profile_selection. The view’s setup has already refused a user without one.

Parameters:

request – The request, whose user owns the profile image.

Return type:

UserProfile

Returns:

The UserProfile.

post(request, *args, **kwargs)