Introduce API method to return a user's API key by logging in.

This makes it easier for mobile clients to use the API by enabling them to
present the user with a familiar username / password prompt, rather than
by asking them for their API key.

(imported from commit 6ed06cfe86f87e7aef54a4be7835fb7bf8d7f209)

humbug/urls.py

@@ -31,6 +31,10 @@ urlpatterns = patterns('',
     url(r'^api/v1/subscribe$', 'zephyr.views.api_subscribe', name='api_subscribe'),
     url(r'^api/v1/send_message$', 'zephyr.views.api_send_message', name='api_send_message'),
 
+    # This is an unformatted view used by clients before using the API.
+    # It requires username/password GET parameters.
+    url(r'^api/v1/fetch_api_key$', 'zephyr.views.api_fetch_key', name='api_fetch_key'),
+
     url(r'^robots\.txt$', 'django.views.generic.simple.redirect_to', {'url': '/static/public/robots.txt'}),
     url(r'^static/(?P<path>.*)$', 'django.views.static.serve',
         {'document_root': os.path.join(settings.SITE_ROOT, '../zephyr/static-access-control')}),

zephyr/views.py

@@ -2,7 +2,7 @@ from django.conf import settings
 from django.contrib.auth import authenticate, login
 from django.contrib.auth.decorators import login_required
 from django.core.urlresolvers import reverse
-from django.http import HttpResponse, HttpResponseRedirect, HttpResponseBadRequest
+from django.http import HttpResponse, HttpResponseRedirect, HttpResponseBadRequest, HttpResponseForbidden
 from django.shortcuts import render_to_response
 from django.template import RequestContext
 from django.shortcuts import render
@@ -599,3 +599,16 @@ def json_stream_exists(request):
         return json_error("Invalid characters in stream name")
     exists = bool(get_stream(stream, UserProfile.objects.get(user=request.user).realm))
     return json_success({"exists": exists})
+
+def api_fetch_key(request):
+    try:
+        username = request.GET['username']
+        password = request.GET['password']
+    except KeyError:
+        return HttpResponseBadRequest("You must specify the username and password via GET.")
+    user = authenticate(username=username, password=password)
+    if user is None:
+        return HttpResponseForbidden("Your username or password is incorrect.")
+    if not user.is_active:
+        return HttpResponseForbidden("Your account has been disabled.")
+    return HttpResponse(user.userprofile.api_key)