From 192f9871258dc266b8a8c47b1ec87474f7136954 Mon Sep 17 00:00:00 2001
From: Shihaam Abdul Rahman <shihaam@shihaam.me>
Date: Sun, 2 Aug 2026 19:58:00 +0500
Subject: [PATCH] handle service error

---
 api/urls.py  |  2 ++
 api/views.py | 40 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+)

diff --git a/api/urls.py b/api/urls.py
index 5415739..f4918a9 100644
--- a/api/urls.py
+++ b/api/urls.py
@@ -22,6 +22,7 @@ from .views import (
     UserUpdateAPIView,
     UserRejectAPIView,
     AgreementUpdateAPIView,
+    PersonVerifyAPIView,
 )
 
 
@@ -47,6 +48,7 @@ urlpatterns = [
         name="user-agreement-update",
     ),
     path("users/<int:pk>/reject/", UserRejectAPIView.as_view(), name="user-reject"),
+    path("person/<str:id_card>/", PersonVerifyAPIView.as_view(), name="person-verify"),
     path("healthcheck/", healthcheck, name="healthcheck"),
     path("atolls/", ListAtollView.as_view(), name="atolls"),
     path("atolls/new/", CreateAtollView.as_view(), name="atoll-new"),
diff --git a/api/views.py b/api/views.py
index 85efbf2..6414971 100644
--- a/api/views.py
+++ b/api/views.py
@@ -615,3 +615,43 @@ class RetrieveUpdateDestroyIslandView(
         if name and Island.objects.filter(name=name).exclude(pk=instance.pk).exists():
             return Response({"message": "Island name already exists."}, status=400)
         return super().update(request, *args, **kwargs)
+
+
+class PersonVerifyAPIView(StaffEditorPermissionMixin, generics.GenericAPIView):
+    """
+    Admin-gated proxy to the external Person verification API.
+
+    The SPA frontend can no longer call the external person-verify service
+    directly (it would leak an internal infra host to the browser), so the
+    backend owns the integration. Returns the upstream JSON as-is.
+
+    GET /api/auth/person/<id_card>/
+    """
+
+    def get(self, request, id_card: str, *args, **kwargs):
+        import requests
+        from decouple import config
+
+        PERSON_VERIFY_BASE_URL = config("PERSON_VERIFY_BASE_URL", default="")  # type: ignore
+        if not PERSON_VERIFY_BASE_URL:
+            return Response(
+                {"detail": "PERSON_VERIFY_BASE_URL is not set."},
+                status=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            )
+        try:
+            upstream = requests.get(
+                f"{PERSON_VERIFY_BASE_URL}/api/person/{id_card}", timeout=10
+            )
+        except requests.RequestException as exc:
+            return Response(
+                {"detail": f"Failed to reach person verification service: {exc}"},
+                status=status.HTTP_502_BAD_GATEWAY,
+            )
+        try:
+            data = upstream.json()
+        except ValueError:
+            return Response(
+                {"detail": "Invalid response from person verification service."},
+                status=status.HTTP_502_BAD_GATEWAY,
+            )
+        return Response(data, status=upstream.status_code)