Context
The Send to Degust flow was fixed in #295 by replacing broken Robox form scraping with a direct multipart requests upload to Degust. That fix deliberately uses anonymous Degust uploads (no upload_token), because a single app-wide DEGUST_UPLOAD_TOKEN is not viable in a multi-user app.
Degust supports per-user programmatic uploads via an upload token created at /users/me on the Degust instance (FAQ):
curl 'https://degust.erc.monash.edu/upload' \
-F 'upload_token=<user_token>' \
-F 'filename=@counts.tsv'
When a token is supplied, uploads are associated with that Degust user account (ownership, session management, etc.) rather than being anonymous.
Problem
Laxy has no place to store a per-user Degust upload token today. UserProfile only has image_url; there is no arbitrary JSON/metadata field on the user or profile models. Storing a shared token in environment config would attach all users' uploads to one Degust account.
Proposed direction (for a follow-up change)
Add per-user storage and wire it into Send to Degust:
- Schema — extend the user profile with a flexible metadata field, e.g.
UserProfile.metadata (JSONField, default {}), with a documented key such as degust_upload_token. (Alternatively User.metadata if we prefer extending User directly; UserProfile is the existing extension point.)
- API — allow the authenticated user to set/clear their token via the profile API (GET/PATCH on
/api/v1/user/profile/ or similar). Treat the token as sensitive (do not log it; consider masking in responses).
- UI — optional field on the User Profile page: paste token from Degust
/users/me, save, clear.
- Send to Degust — when uploading, use
request.user.profile.metadata.get("degust_upload_token") if present; otherwise fall back to anonymous upload (current behaviour).
Out of scope for the #295 bugfix
This issue is deferred to avoid a database migration in the current bugfix branch. Anonymous upload + caching the returned Degust session URL on File.metadata["degust_url"] remains the interim behaviour.
Acceptance criteria
Related
Context
The Send to Degust flow was fixed in #295 by replacing broken Robox form scraping with a direct multipart
requestsupload to Degust. That fix deliberately uses anonymous Degust uploads (noupload_token), because a single app-wideDEGUST_UPLOAD_TOKENis not viable in a multi-user app.Degust supports per-user programmatic uploads via an upload token created at
/users/meon the Degust instance (FAQ):When a token is supplied, uploads are associated with that Degust user account (ownership, session management, etc.) rather than being anonymous.
Problem
Laxy has no place to store a per-user Degust upload token today.
UserProfileonly hasimage_url; there is no arbitrary JSON/metadata field on the user or profile models. Storing a shared token in environment config would attach all users' uploads to one Degust account.Proposed direction (for a follow-up change)
Add per-user storage and wire it into Send to Degust:
UserProfile.metadata(JSONField, default{}), with a documented key such asdegust_upload_token. (AlternativelyUser.metadataif we prefer extendingUserdirectly;UserProfileis the existing extension point.)/api/v1/user/profile/or similar). Treat the token as sensitive (do not log it; consider masking in responses)./users/me, save, clear.request.user.profile.metadata.get("degust_upload_token")if present; otherwise fall back to anonymous upload (current behaviour).Out of scope for the #295 bugfix
This issue is deferred to avoid a database migration in the current bugfix branch. Anonymous upload + caching the returned Degust session URL on
File.metadata["degust_url"]remains the interim behaviour.Acceptance criteria
Related