from rest_framework.views import APIView from rest_framework.response import Response from rest_framework import status, viewsets from rest_framework.permissions import AllowAny, IsAdminUser from rest_framework.authentication import SessionAuthentication from drf_spectacular.utils import extend_schema, extend_schema_view from .models import ContactMe from .serializer import ContactMeSerializer from .tasks import send_contact_me_email_task @extend_schema(tags=["advertisement", "public"]) class ContactMePublicView(APIView): permission_classes = [AllowAny] # Avoid CSRF for public endpoint by disabling SessionAuthentication authentication_classes = [] def post(self, request): email = request.data.get("email") message = request.data.get("message") honeypot = request.data.get("hp") # hidden honeypot field # If honeypot is filled, pretend success without processing if honeypot: return Response({"status": "ok"}, status=status.HTTP_200_OK) if not email or not message: return Response({"detail": "Missing email or message."}, status=status.HTTP_400_BAD_REQUEST) # Save to DB cm = ContactMe.objects.create(client_email=email, content=message) # Send email via Celery task try: send_contact_me_email_task.delay(email, message) except Exception: # Fallback to direct call if Celery is not running in DEV send_contact_me_email_task(email, message) return Response({"id": cm.id, "status": "queued"}, status=status.HTTP_201_CREATED) @extend_schema_view( list=extend_schema(tags=["advertisement"], summary="List contact messages (admin)"), retrieve=extend_schema(tags=["advertisement"], summary="Retrieve contact message (admin)"), create=extend_schema(tags=["advertisement"], summary="Create contact message (admin)"), partial_update=extend_schema(tags=["advertisement"], summary="Update contact message (admin)"), update=extend_schema(tags=["advertisement"], summary="Replace contact message (admin)"), destroy=extend_schema(tags=["advertisement"], summary="Delete contact message (admin)"), ) class ContactMeAdminViewSet(viewsets.ModelViewSet): queryset = ContactMe.objects.all().order_by("-sent_at") serializer_class = ContactMeSerializer permission_classes = [IsAdminUser]