Authentication Flow

import { ethers } from 'ethers';

async function connectWallet() {
  // Check if MetaMask is installed
  if (!window.ethereum) {
    throw new Error('Please install MetaMask');
  }
  
  // Request account access
  const provider = new ethers.BrowserProvider(window.ethereum);
  const accounts = await provider.send('eth_requestAccounts', []);
  const address = accounts[0];
  
  return { provider, address };
}

import axios from 'axios';

async function getNonce(address) {
  const response = await axios.get(
    `${API_URL}/api/auth/nonce/`,
    { params: { address } }
  );
  return response.data.nonce;
}

import { SiweMessage } from 'siwe';

async function signMessage(address, nonce, provider) {
  // Create SIWE message
  const domain = window.location.host;
  const origin = window.location.origin;
  
  const siweMessage = new SiweMessage({
    domain,
    address,
    statement: 'Sign in to GenLayer Points',
    uri: origin,
    version: '1',
    chainId: 1,  // Ethereum mainnet
    nonce
  });
  
  const message = siweMessage.prepareMessage();
  
  // Sign with MetaMask
  const signer = await provider.getSigner();
  const signature = await signer.signMessage(message);
  
  return { message, signature };
}

async function login(address, message, signature) {
  const response = await axios.post(
    `${API_URL}/api/auth/login/`,
    { address, message, signature },
    { withCredentials: true }  // Important: include cookies
  );
  
  return response.data;
}

export async function signInWithEthereum() {
  try {
    // 1. Connect wallet
    const { provider, address } = await connectWallet();
    
    // 2. Get nonce
    const nonce = await getNonce(address);
    
    // 3. Sign message
    const { message, signature } = await signMessage(address, nonce, provider);
    
    // 4. Login
    await login(address, message, signature);
    
    // 5. Update auth state
    authState.set({
      isAuthenticated: true,
      address
    });
    
    // 6. Load user data
    await userStore.loadUser();
    
    return true;
  } catch (error) {
    console.error('Authentication failed:', error);
    throw error;
  }
}

from django.views.decorators.csrf import csrf_exempt
from django.http import JsonResponse
import secrets

@csrf_exempt
def get_nonce(request):
    """Generate a random nonce for SIWE authentication."""
    address = request.GET.get('address')
    
    if not address:
        return JsonResponse({'error': 'Address required'}, status=400)
    
    # Generate cryptographically secure random nonce
    nonce = secrets.token_hex(16)
    
    # Store in session
    request.session['siwe_nonce'] = nonce
    request.session['siwe_address'] = address.lower()
    
    return JsonResponse({'nonce': nonce})

from siwe import SiweMessage
from eth_account.messages import encode_defunct
from web3 import Web3
from django.contrib.auth import get_user_model

User = get_user_model()

@csrf_exempt
def login(request):
    """Verify SIWE signature and create session."""
    if request.method != 'POST':
        return JsonResponse({'error': 'POST required'}, status=405)
    
    data = json.loads(request.body)
    address = data.get('address')
    message = data.get('message')
    signature = data.get('signature')
    
    # Validate required fields
    if not all([address, message, signature]):
        return JsonResponse({'error': 'Missing required fields'}, status=400)
    
    try:
        # Parse SIWE message
        siwe_message = SiweMessage.from_message(message)
        
        # Verify the message matches stored nonce
        stored_nonce = request.session.get('siwe_nonce')
        if not stored_nonce or siwe_message.nonce != stored_nonce:
            return JsonResponse({'error': 'Invalid nonce'}, status=400)
        
        # Verify signature
        siwe_message.verify(signature)
        
        # Verify address matches
        if siwe_message.address.lower() != address.lower():
            return JsonResponse({'error': 'Address mismatch'}, status=400)
        
        # Get or create user
        user, created = User.objects.get_or_create(
            address__iexact=address,
            defaults={
                'address': address.lower(),
                'email': f"{address.lower()}@ethereum.local",
                'username': address.lower()[:30]
            }
        )
        
        # Create session
        request.session['authenticated'] = True
        request.session['ethereum_address'] = address.lower()
        request.session['user_id'] = user.id
        
        # Clear nonce
        del request.session['siwe_nonce']
        
        return JsonResponse({
            'success': True,
            'user': {
                'id': user.id,
                'address': user.address,
                'name': user.name
            }
        })
        
    except Exception as e:
        logger.error(f"SIWE verification failed: {str(e)}")
        return JsonResponse({'error': 'Verification failed'}, status=400)

# ethereum_auth/authentication.py
from rest_framework import authentication
from django.contrib.auth import get_user_model

User = get_user_model()

class EthereumAuthentication(authentication.BaseAuthentication):
    """Authenticate requests using session-based Ethereum auth."""
    
    def authenticate(self, request):
        # Check session for authentication
        ethereum_address = request.session.get('ethereum_address')
        authenticated = request.session.get('authenticated', False)
        
        if not ethereum_address or not authenticated:
            return None
        
        try:
            # Get user by address
            user = User.objects.get(address__iexact=ethereum_address)
            return (user, None)
        except User.DoesNotExist:
            return None

# backend/settings.py
REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': [
        'ethereum_auth.authentication.EthereumAuthentication',
    ],
    'DEFAULT_PERMISSION_CLASSES': [
        'rest_framework.permissions.IsAuthenticatedOrReadOnly',
    ],
}