sandstorm.patch

diff --git a/Pipfile b/Pipfile
index 3fccb52..2725ed6 100644
--- a/Pipfile
+++ b/Pipfile
@@ -17,12 +17,12 @@ faker = "*"
 gunicorn = "*"
 pillow = "*"
 plotly = "*"
-psycopg2-binary = "*"
 python-dotenv = "*"
 pyyaml = "*"
 uritemplate = "*"
 whitenoise = "*"
 django-taggit = "==2.1.0"
+django-sandstorm = {editable = true,git = "https://github.com/cdubz/django-sandstorm.git"}
 
 [dev-packages]
 coveralls = "*"
diff --git a/babybuddy/forms.py b/babybuddy/forms.py
index 9c91cb5..0a500f9 100644
--- a/babybuddy/forms.py
+++ b/babybuddy/forms.py
@@ -1,31 +1,10 @@
 # -*- coding: utf-8 -*-
 from django import forms
-from django.contrib.auth.forms import PasswordChangeForm, UserCreationForm
 from django.contrib.auth.models import User
 
 from .models import Settings
 
 
-class UserAddForm(UserCreationForm):
-    class Meta:
-        model = User
-        fields = [
-            "username",
-            "first_name",
-            "last_name",
-            "email",
-            "is_staff",
-            "is_active",
-        ]
-
-    def save(self, commit=True):
-        user = super(UserAddForm, self).save(commit=False)
-        user.is_superuser = True
-        if commit:
-            user.save()
-        return user
-
-
 class UserUpdateForm(forms.ModelForm):
     class Meta:
         model = User
@@ -45,11 +24,6 @@ class UserForm(forms.ModelForm):
         fields = ["first_name", "last_name", "email"]
 
 
-class UserPasswordForm(PasswordChangeForm):
-    class Meta:
-        fields = ["old_password", "new_password1", "new_password2"]
-
-
 class UserSettingsForm(forms.ModelForm):
     class Meta:
         model = Settings
diff --git a/babybuddy/management/commands/migrate.py b/babybuddy/management/commands/migrate.py
index c9b732a..acfab3d 100644
--- a/babybuddy/management/commands/migrate.py
+++ b/babybuddy/management/commands/migrate.py
@@ -1,5 +1,4 @@
 # -*- coding: utf-8 -*-
-from django.contrib.auth.models import User
 from django.core.management.commands import migrate
 
 
@@ -8,10 +7,3 @@ class Command(migrate.Command):
 
     def handle(self, *args, **kwargs):
         super(Command, self).handle(*args, **kwargs)
-
-        superusers = User.objects.filter(is_superuser=True)
-        if len(superusers) == 0:
-            default_user = User.objects.create_user("admin", password="admin")
-            default_user.is_superuser = True
-            default_user.is_staff = True
-            default_user.save()
diff --git a/babybuddy/settings/sandstorm.py b/babybuddy/settings/sandstorm.py
new file mode 100644
index 0000000..7aa8682
--- /dev/null
+++ b/babybuddy/settings/sandstorm.py
@@ -0,0 +1,38 @@
+from .base import *
+
+
+# Django Sandstorm package configuration.
+
+INSTALLED_APPS.append('django_sandstorm')
+
+MIDDLEWARE.append('django_sandstorm.middleware.SandstormUserMiddleware')
+
+try:
+    csrf_index = MIDDLEWARE.index('django.middleware.csrf.CsrfViewMiddleware')
+    MIDDLEWARE.insert(
+        (csrf_index - 1),
+        'django_sandstorm.middleware.SandstormPreCsrfViewMiddleware'
+    )
+except ValueError:
+    pass
+
+AUTHENTICATION_BACKENDS = [
+    'django.contrib.auth.backends.RemoteUserBackend',
+]
+
+
+# Database
+# https://docs.djangoproject.com/en/3.0/ref/settings/#databases
+
+DATABASES = {
+    'default': {
+        'ENGINE': 'django.db.backends.sqlite3',
+        'NAME': '/var/sqlite3/db.sqlite3',
+    }
+}
+
+
+# Media files (User uploaded content)
+# https://docs.djangoproject.com/en/3.0/topics/files/
+
+MEDIA_ROOT = '/var/media'
diff --git a/babybuddy/templates/babybuddy/nav-dropdown.html b/babybuddy/templates/babybuddy/nav-dropdown.html
index 080276a..34b1a26 100644
--- a/babybuddy/templates/babybuddy/nav-dropdown.html
+++ b/babybuddy/templates/babybuddy/nav-dropdown.html
@@ -345,17 +345,9 @@
                             <div class="dropdown-menu dropdown-menu-right" aria-labelledby="nav-user-menu-link">
                                 <h6 class="dropdown-header">{% trans "User" %}</h6>
                                 <a href="{% url 'babybuddy:user-settings' %}" class="dropdown-item">{% trans "Settings" %}</a>
-                                <a href="{% url 'babybuddy:user-password' %}" class="dropdown-item">{% trans "Password" %}</a>
-                                <form action="{% url 'babybuddy:logout' %}" role="form" method="post">
-                                    {% csrf_token %}
-                                    <button class="dropdown-item">
-                                        {% trans "Logout" %}
-                                    </button>
-                                </form>
                                 <h6 class="dropdown-header">{% trans "Site" %}</h6>
                                 <a href="{% url 'api:api-root' %}" class="dropdown-item">{% trans "API Browser" %}</a>
                                 {% if request.user.is_staff %}
-                                    <a href="{% url 'babybuddy:user-list' %}" class="dropdown-item">{% trans "Users" %}</a>
                                     <a href="{% url 'admin:index' %}" class="dropdown-item">{% trans "Database Admin" %}</a>
                                 {% endif %}
                                 <h6 class="dropdown-header">{% trans "Support" %}</h6>
diff --git a/babybuddy/urls.py b/babybuddy/urls.py
index e2d2e78..efca8f1 100644
--- a/babybuddy/urls.py
+++ b/babybuddy/urls.py
@@ -8,18 +8,26 @@ from django.urls import include, path
 from . import views
 
 app_patterns = [
-    path("login/", auth_views.LoginView.as_view(), name="login"),
-    path("logout/", views.LogoutView.as_view(), name="logout"),
+    path('login/', auth_views.LoginView.as_view(), name='login'),
+
+    path('', views.RootRouter.as_view(), name='root-router'),
+    path('welcome/', views.Welcome.as_view(), name='welcome'),
+
+    path('users/', views.UserList.as_view(), name='user-list'),
+    path(
+        'users/<int:pk>/edit/',
+        views.UserUpdate.as_view(),
+        name='user-update'
+    ),
     path(
-        "password_reset/", auth_views.PasswordResetView.as_view(), name="password_reset"
+        'user/settings/',
+        views.UserSettings.as_view(),
+        name='user-settings'
     ),
     path("", views.RootRouter.as_view(), name="root-router"),
     path("welcome/", views.Welcome.as_view(), name="welcome"),
     path("users/", views.UserList.as_view(), name="user-list"),
-    path("users/add/", views.UserAdd.as_view(), name="user-add"),
     path("users/<int:pk>/edit/", views.UserUpdate.as_view(), name="user-update"),
-    path("users/<int:pk>/delete/", views.UserDelete.as_view(), name="user-delete"),
-    path("user/password/", views.UserPassword.as_view(), name="user-password"),
     path("user/settings/", views.UserSettings.as_view(), name="user-settings"),
 ]
 
diff --git a/babybuddy/views.py b/babybuddy/views.py
index a53cde1..0c64790 100644
--- a/babybuddy/views.py
+++ b/babybuddy/views.py
@@ -1,7 +1,5 @@
 # -*- coding: utf-8 -*-
 from django.contrib import messages
-from django.contrib.auth import update_session_auth_hash
-from django.contrib.auth.forms import PasswordChangeForm
 from django.contrib.auth.models import User
 from django.contrib.auth.views import LogoutView as LogoutViewBase
 from django.contrib.messages.views import SuccessMessageMixin
@@ -12,7 +10,6 @@ from django.template import loader
 from django.urls import reverse, reverse_lazy
 from django.utils import translation
 from django.utils.decorators import method_decorator
-from django.utils.text import format_lazy
 from django.utils.translation import gettext as _, gettext_lazy
 from django.views import csrf
 from django.views.decorators.cache import never_cache
@@ -93,18 +90,8 @@ class UserList(StaffOnlyMixin, BabyBuddyFilterView):
     filterset_fields = ("username", "first_name", "last_name", "email")
 
 
-class UserAdd(StaffOnlyMixin, PermissionRequiredMixin, SuccessMessageMixin, CreateView):
-    model = User
-    template_name = "babybuddy/user_form.html"
-    permission_required = ("admin.add_user",)
-    form_class = forms.UserAddForm
-    success_url = reverse_lazy("babybuddy:user-list")
-    success_message = gettext_lazy("User %(username)s added!")
-
-
-class UserUpdate(
-    StaffOnlyMixin, PermissionRequiredMixin, SuccessMessageMixin, UpdateView
-):
+class UserUpdate(StaffOnlyMixin, PermissionRequiredMixin,
+                 SuccessMessageMixin, UpdateView):
     model = User
     template_name = "babybuddy/user_form.html"
     permission_required = ("admin.change_user",)
@@ -113,40 +100,6 @@ class UserUpdate(
     success_message = gettext_lazy("User %(username)s updated.")
 
 
-class UserDelete(
-    StaffOnlyMixin, PermissionRequiredMixin, DeleteView, SuccessMessageMixin
-):
-    model = User
-    template_name = "babybuddy/user_confirm_delete.html"
-    permission_required = ("admin.delete_user",)
-    success_url = reverse_lazy("babybuddy:user-list")
-
-    def get_success_message(self, cleaned_data):
-        return format_lazy(gettext_lazy("User {user} deleted."), user=self.get_object())
-
-
-class UserPassword(LoginRequiredMixin, View):
-    """
-    Handles user password changes.
-    """
-
-    form_class = forms.UserPasswordForm
-    template_name = "babybuddy/user_password_form.html"
-
-    def get(self, request):
-        return render(
-            request, self.template_name, {"form": self.form_class(request.user)}
-        )
-
-    def post(self, request):
-        form = PasswordChangeForm(request.user, request.POST)
-        if form.is_valid():
-            user = form.save()
-            update_session_auth_hash(request, user)
-            messages.success(request, _("Password updated."))
-        return render(request, self.template_name, {"form": form})
-
-
 class UserSettings(LoginRequiredMixin, View):
     """
     Handles both the User and Settings models.