config/urls.py

"""
URL configuration for config project.
"""

import os

from django.conf import settings
from django.contrib import admin
from django.http import FileResponse, HttpResponseNotFound
from django.urls import include, path
from auth_api.views import (
    CookieTokenObtainPairView,
    CookieTokenRefreshView,
)
from auth_api import views as auth_views


from drf_spectacular.views import (
    SpectacularAPIView,
    SpectacularRedocView,
    SpectacularSwaggerView,
)


def serve_video(request, filepath):
    """
    Single endpoint to serve ANY video from the static directory.
    Handles: videos/preguntas/final_audio_0.mp4, final_bienvenida.mp4, etc.
    """
    full_path = os.path.join(settings.BASE_DIR, "static", "videos", filepath)

    # Security: prevent directory traversal
    real_path = os.path.realpath(full_path)
    static_videos_root = os.path.realpath(os.path.join(settings.BASE_DIR, "static", "videos"))
    if not real_path.startswith(static_videos_root):
        return HttpResponseNotFound("Invalid path")

    if os.path.exists(full_path) and os.path.isfile(full_path):
        return FileResponse(open(full_path, "rb"), content_type="video/mp4")
    return HttpResponseNotFound("Video not found")


urlpatterns = [
    path("admin/", admin.site.urls),

    # ── Dashboard Admin Cookie-based Auth ───────────────────────────────────
    # Login validates role='admin', sets HttpOnly cookies. No tokens in JS.
    path("api/auth/login/", auth_views.login_view, name="auth-login"),
    path("api/auth/logout/", auth_views.logout_view, name="auth-logout"),
    path("api/auth/refresh/", auth_views.refresh_view, name="auth-refresh"),
    path("api/auth/me/", auth_views.me_admin_view, name="auth-me"),

    # ── JWT token endpoints (used by Frontend Alumno via cookies) ───────────
    path("api/token/", CookieTokenObtainPairView.as_view(), name="token_obtain_pair"),
    path("api/token/refresh/", CookieTokenRefreshView.as_view(), name="token_refresh"),

    # ── Interview app ────────────────────────────────────────────────────────
    path("api/", include("interview.urls")),
    
    # ── KYC app ────────────────────────────────────────────────────────
    path("api/kyc/", include("kyc_api.urls")),

    # ── Proctoring Admin Review API ──────────────────────────────────────
    path("api/proctoring/", include("proctoring_api.urls")),

    # ── OpenAPI / Swagger Documentation ────────────────────────────────────
    path("api/schema/", SpectacularAPIView.as_view(), name="schema"),
    path("api/docs/", SpectacularSwaggerView.as_view(url_name="schema"), name="swagger-ui"),
    path("api/redoc/", SpectacularRedocView.as_view(url_name="schema"), name="redoc"),

    # ── Video serving ────────────────────────────────────────────────────────
    path(
        "api/videos/<path:filepath>",
        serve_video,
        name="serve-video",
    ),
]

from django.urls import re_path
from django.views.static import serve

# Force serve media in both dev and production (Hugging Face Spaces)
urlpatterns += [
    re_path(r'^api/media/(?P<path>.*)$', serve, {
        'document_root': settings.MEDIA_ROOT,
    }),
]