[kkamara]

No description provided.

[gitguardian]

⚠️ GitGuardian has uncovered 6 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
36702473	Triggered	Generic Password	2495ab6	api/v1/web/users/tests.py	View secret
36702473	Triggered	Generic Password	2495ab6	api/v1/web/users/tests.py	View secret
36702473	Triggered	Generic Password	2495ab6	api/v1/web/users/tests.py	View secret
36702473	Triggered	Generic Password	2495ab6	api/v1/web/users/tests.py	View secret
36703578	Triggered	Username Password	542040b	api/v1/web/users/tests/test_views.py	View secret
36704861	Triggered	Generic CLI Secret	98802d7	readme.md	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secrets safely. Learn here the best practices.
3. Revoke and rotate these secrets.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

[Copilot]

🟡 Changes recommended

It introduces failing/incorrect tests and includes hard-coded tokens in committed Postman artifacts, both of which should be corrected before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR ports/extends the boilerplate toward a Django + DRF + SimpleJWT backend with a Vite-powered React frontend, adding auth/user endpoints, seeding, and updated developer tooling (Postman, CI).

Changes:

• Add DRF + SimpleJWT configuration and implement v1 API endpoints (including web-specific user endpoints and mobile hello).
• Replace CRA frontend setup with Vite + React Router + Redux Toolkit, adding auth flows, user listing, and settings/avatar UI.
• Add database seeding command/tests and update CI workflow to run migrations + seeding.

File summaries

File	Description
requirements.txt	Add DRF/SimpleJWT, django-vite, faker deps
requirements-docker-production.txt	Mirror prod deps for Docker
readme.md	Add Postman + seeding + Vite frontend steps
python-react-boilerplate.postman_environment.json	Add Postman environment variables
python-react-boilerplate.postman_collection.json	Add Postman collection for API usage
images/profile/.gitignore	Keep default avatar while ignoring other profile images
frontend/vite.config.js	Add Vite build/dev/test configuration
frontend/src/utils/config.js	Minor URL helper formatting tweak
frontend/src/setupTests.js	Configure jest-dom for Vitest
frontend/src/services/productService.js	Remove legacy product service
frontend/src/services/HttpService.js	Replace fetch wrapper with axios-based service + token support
frontend/src/services/AuthServices.js	Remove legacy auth service
frontend/src/services/AuthService.js	Add axios-based auth service (login/register/authorize/logout)
frontend/src/Routes.jsx	New route tree incl. auth-protected routes
frontend/src/Routes.js	Remove legacy routes file
frontend/src/reportWebVitals.js	Remove CRA web-vitals helper
frontend/src/redux/types.js	Replace product action types with auth/users/avatar/settings action groups
frontend/src/redux/store.test.js	Add store slice test
frontend/src/redux/store.js	Migrate store setup to Redux Toolkit
frontend/src/redux/reducers/usersReducer.js	Replace legacy reducer with users reducer
frontend/src/redux/reducers/updateUserSettingsReducer.js	Add settings update reducer
frontend/src/redux/reducers/removeAvatarReducer.js	Add avatar removal reducer
frontend/src/redux/reducers/index.js	Update root reducer slices
frontend/src/redux/reducers/avatarReducer.js	Add avatar upload reducer
frontend/src/redux/reducers/authReducer.js	Add auth reducer
frontend/src/redux/actions/usersActions.js	Add paginated users fetch action
frontend/src/redux/actions/updateUserSettingsActions.js	Add user settings update action
frontend/src/redux/actions/removeAvatarActions.js	Add avatar delete action
frontend/src/redux/actions/productActions.js	Remove legacy product actions
frontend/src/redux/actions/avatarActions.js	Add avatar upload action
frontend/src/redux/actions/authActions.js	Add auth actions (login/authorize/logout/register)
frontend/src/PrivateRoute.js	Remove legacy private route helper
frontend/src/logo.svg	Remove CRA logo asset
frontend/src/index.scss	Add base styles
frontend/src/index.jsx	New Vite entrypoint mounting into #app
frontend/src/index.js	Remove CRA entrypoint
frontend/src/Guard.js	Remove legacy guard helper
frontend/src/components/pages/http/NotFoundComponent.jsx	Add 404 page
frontend/src/components/pages/HomeComponent.jsx	Add authenticated home with users list + pagination
frontend/src/components/pages/HomeComponent.js	Remove legacy home component
frontend/src/components/pages/auth/SettingsComponent.scss	Add settings page styles
frontend/src/components/pages/auth/SettingsComponent.jsx	Add settings + avatar upload/remove UI
frontend/src/components/pages/auth/RegisterComponent.scss	Add register page styles
frontend/src/components/pages/auth/RegisterComponent.jsx	Add register UI + auth redirect logic
frontend/src/components/pages/auth/LogoutComponent.jsx	Add logout page (fires logout action)
frontend/src/components/pages/auth/LoginComponent.scss	Add login page styles
frontend/src/components/pages/auth/LoginComponent.jsx	Add login UI + auth redirect logic
frontend/src/components/layouts/Header.scss	Add header styles
frontend/src/components/layouts/Header.jsx	Add navbar with auth-aware menu
frontend/src/components/layouts/Header.js	Remove legacy header
frontend/src/components/layouts/Footer.scss	Add footer styles
frontend/src/components/layouts/Footer.jsx	Add footer component
frontend/src/components/layouts/ErrorComponent.jsx	Add reusable dismissible error alert
frontend/src/bootstrap.js	Remove CRA bootstrap shim
frontend/src/AuthRoute.jsx	Add auth-protecting route wrapper
frontend/src/App.test.js	Remove CRA sample test
frontend/src/App.jsx	Update app shell for new routes
frontend/README.md	Remove CRA README
frontend/public/robots.txt	Remove CRA robots.txt
frontend/public/manifest.json	Remove CRA manifest
frontend/public/index.html	Remove CRA HTML template
frontend/package.json	Switch scripts/deps to Vite + React 19 + router 7 + toolkit
frontend/license	Add BSD-3 license file (frontend)
frontend/index.html	Add Django template using django-vite tags
frontend/.gitignore	Update ignored outputs/env files
frontend/.gitattributes	Mark vendored except js/jsx for linguist
frontend/.env.example	Add Vite env example
frontend/.editorconfig	Add editorconfig
frontend/.browserslistrc	Add browserslist config
app/views.py	Add CSRF cookie on catchall view
app/urls.py	Add API routes + images serving + catchall
app/tests/test_seed.py	Add tests for new seed command
app/tests/init.py	Add tests package marker
app/settings.py	Configure DRF/SimpleJWT, django-vite, CORS/CSRF tweaks, static dir updates
app/pagination.py	Add custom DRF paginator
app/management/commands/startmodule.py	Add scaffolding command for new API modules
app/management/commands/seed.py	Add DB seeding/undo command using Faker
api/v1/web/users/views.py	Implement web user endpoints incl. pagination and avatar upload/delete
api/v1/web/users/validators.py	Add unique validators
api/v1/web/users/urls.py	Add web users URL routes
api/v1/web/users/tests/test_views.py	Add tests for web users views
api/v1/web/users/services.py	Placeholder services module
api/v1/web/users/serializers.py	Add serializers for register/login/logout/update/user response
api/v1/web/users/init.py	Package marker
api/v1/web/urls.py	Mount web API subroutes
api/v1/web/init.py	Package marker
api/v1/users/views.py	Implement non-web v1 user auth endpoints
api/v1/users/validators.py	Add unique validators
api/v1/users/urls.py	Add v1 users URL routes
api/v1/users/tests/test_views.py	Add v1 users tests
api/v1/users/tests/init.py	Package marker
api/v1/users/services.py	Placeholder services module
api/v1/users/serializers.py	Add v1 serializers
api/v1/users/init.py	Package marker
api/v1/urls.py	Mount v1 API and web namespaces
api/utils.py	Add DRF exception handler + first error helper
api/models/user_profile.py	Add UserProfile model for avatar storage
api/models/init.py	Export model symbols
api/mobile/v1/views.py	Add mobile hello endpoint
api/mobile/v1/urls.py	Add mobile routes
api/mobile/v1/tests/init.py	Add mobile tests package marker
api/mobile/v1/init.py	Package marker
api/mobile/init.py	Package marker
api/migrations/0001_userprofile.py	Add initial migration for UserProfile
api/migrations/init.py	Add migrations package marker
api/apps.py	Add ApiConfig
api/init.py	Package marker
.github/workflows/build.yml	Grant DB privileges; run migrations + seed before tests
.env.example	Update CSRF trusted origins format

Review details

Suppressed comments (3)

api/v1/web/users/tests/test_views.py:51

• The non-integer page test is also reversing web:users:logout_user, which does not exist. It should target the web:users:user endpoint.

            reverse("web:users:logout_user"),

python-react-boilerplate.postman_environment.json:39

• Avoid committing a default Postman environment with a populated mobileToken value; leave it blank/disabled so users explicitly paste their own token.
  python-react-boilerplate.postman_collection.json:317
• This second logout request body also contains a hard-coded refresh token; it should be empty (or a variable) to avoid committing tokens.

• Files reviewed: 99/116 changed files
• Comments generated: 9
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.