Merge pull request #3 from alichass/master

Replacing rest_framework_jwt with django-rest-framework-simplejwt

.circleci/config.yml

@@ -12,9 +12,9 @@ jobs:
     executor: docker/docker
     steps:
       - checkout
-      - run: pip install -q --user coveralls djangorestframework==$DRF Django==$DJANGO_VERSION
       - run: pip install --user -r dev-requirements.txt
       - run: pip install --user -r dj_rest_auth/tests/requirements.pip
+      - run: pip install -q --user coveralls djangorestframework==$DRF Django==$DJANGO_VERSION
       - run:
           command: coverage run --source=dj_rest_auth setup.py test
           name: Test

demo/requirements.pip

@@ -1,5 +1,6 @@
 django>=1.9.0
 dj-rest-auth==0.1.4
 djangorestframework>=3.7.0
+djangorestframework-simplejwt==4.4.0
 django-allauth>=0.24.1
 django-rest-swagger==2.0.7

dev-requirements.txt

@@ -1,5 +1,5 @@
 --editable .
 responses>=0.5.0
-djangorestframework-jwt
+djangorestframework-simplejwt==4.4.0
 django-allauth
 coveralls>=1.11.1

dj_rest_auth/app_settings.py

@@ -34,3 +34,6 @@ PasswordResetConfirmSerializer = serializers.get(
 )
 
 PasswordChangeSerializer = import_callable(serializers.get('PASSWORD_CHANGE_SERIALIZER', DefaultPasswordChangeSerializer))
+
+JWT_AUTH_COOKIE = getattr(settings, 'JWT_AUTH_COOKIE', None)
+

dj_rest_auth/registration/views.py

@@ -49,7 +49,8 @@ class RegisterView(CreateAPIView):
         if getattr(settings, 'REST_USE_JWT', False):
             data = {
                 'user': user,
-                'token': self.token
+                'access_token': self.access_token,
+                'refresh_token': self.refresh_token
             }
             return JWTSerializer(data).data
         else:
@@ -68,7 +69,7 @@ class RegisterView(CreateAPIView):
     def perform_create(self, serializer):
         user = serializer.save(self.request)
         if getattr(settings, 'REST_USE_JWT', False):
-            self.token = jwt_encode(user)
+            self.access_token, self.refresh_token = jwt_encode(user)
         else:
             create_token(self.token_model, user, serializer)
 

dj_rest_auth/serializers.py

@@ -135,7 +135,8 @@ class JWTSerializer(serializers.Serializer):
     """
     Serializer for JWT authentication.
     """
-    token = serializers.CharField()
+    access_token = serializers.CharField()
+    refresh_token = serializers.CharField()
     user = serializers.SerializerMethodField()
 
     def get_user(self, obj):

dj_rest_auth/tests/requirements.pip

@@ -1,5 +1,4 @@
 django-allauth>=0.25.0
 responses>=0.3.0
 flake8==2.4.0
-djangorestframework-jwt>=1.7.2
+djangorestframework-simplejwt==4.4.0
-djangorestframework>=3.6.4

dj_rest_auth/tests/settings.py

@@ -68,7 +68,7 @@ TEMPLATES = [
 REST_FRAMEWORK = {
     'DEFAULT_AUTHENTICATION_CLASSES': (
         'rest_framework.authentication.SessionAuthentication',
-        'rest_framework_jwt.authentication.JSONWebTokenAuthentication',
+        'dj_rest_auth.utils.JWTCookieAuthentication',
     )
 }
 
@@ -94,8 +94,6 @@ INSTALLED_APPS = [
 
     'dj_rest_auth',
     'dj_rest_auth.registration',
-
-    'rest_framework_jwt'
 ]
 
 SECRET_KEY = "38dh*skf8sjfhs287dh&^hd8&3hdg*j2&sd"

dj_rest_auth/tests/test_api.py

@@ -152,8 +152,8 @@ class APIBasicTests(TestsMixin, TestCase):
         get_user_model().objects.create_user(self.USERNAME, '', self.PASS)
 
         self.post(self.login_url, data=payload, status_code=200)
-        self.assertEqual('token' in self.response.json.keys(), True)
+        self.assertEqual('access_token' in self.response.json.keys(), True)
-        self.token = self.response.json['token']
+        self.token = self.response.json['access_token']
 
     def test_login_by_email(self):
         # starting test without allauth app
@@ -382,7 +382,7 @@ class APIBasicTests(TestsMixin, TestCase):
             "password": self.PASS
         }
         self.post(self.login_url, data=payload, status_code=200)
-        self.token = self.response.json['token']
+        self.token = self.response.json['access_token']
         self.get(self.user_url, status_code=200)
 
         self.patch(self.user_url, data=self.BASIC_USER_DATA, status_code=200)
@@ -426,7 +426,7 @@ class APIBasicTests(TestsMixin, TestCase):
         self.post(self.register_url, data={}, status_code=400)
 
         result = self.post(self.register_url, data=self.REGISTRATION_DATA, status_code=201)
-        self.assertIn('token', result.data)
+        self.assertIn('access_token', result.data)
         self.assertEqual(get_user_model().objects.all().count(), user_count + 1)
 
         self._login()
@@ -514,3 +514,47 @@ class APIBasicTests(TestsMixin, TestCase):
 
         self.post(self.login_url, data=payload, status_code=status.HTTP_200_OK)
         self.get(self.logout_url, status_code=status.HTTP_405_METHOD_NOT_ALLOWED)
+
+    @override_settings(REST_USE_JWT=True)
+    @override_settings(JWT_AUTH_COOKIE='jwt-auth')
+    def test_login_jwt_sets_cookie(self):
+        payload = {
+            "username": self.USERNAME,
+            "password": self.PASS
+        }
+        get_user_model().objects.create_user(self.USERNAME, '', self.PASS)
+        resp = self.post(self.login_url, data=payload, status_code=200)
+        self.assertTrue('jwt-auth' in resp.cookies.keys())
+
+
+    @override_settings(REST_USE_JWT=True)
+    @override_settings(JWT_AUTH_COOKIE='jwt-auth')
+    def test_logout_jwt_deletes_cookie(self):
+        payload = {
+            "username": self.USERNAME,
+            "password": self.PASS
+        }
+        get_user_model().objects.create_user(self.USERNAME, '', self.PASS)
+        self.post(self.login_url, data=payload, status_code=200)
+        resp = self.post(self.logout_url, status=200)
+        self.assertEqual('', resp.cookies.get('jwt-auth').value)
+
+
+    @override_settings(REST_USE_JWT=True)
+    @override_settings(JWT_AUTH_COOKIE='jwt-auth')
+    @override_settings(REST_FRAMEWORK=dict(
+        DEFAULT_AUTHENTICATION_CLASSES=[
+            'dj_rest_auth.utils.JWTCookieAuthentication'
+        ]
+    ))
+    @override_settings(REST_SESSION_LOGIN=False)
+    def test_cookie_authentication(self):
+        payload = {
+            "username": self.USERNAME,
+            "password": self.PASS
+        }
+        get_user_model().objects.create_user(self.USERNAME, '', self.PASS)
+        resp = self.post(self.login_url, data=payload, status_code=200)
+        self.assertEqual(['jwt-auth'], list(resp.cookies.keys()))
+        resp = self.get('/protected-view/')
+        self.assertEquals(resp.status_code, 200)

dj_rest_auth/tests/test_social.py

@@ -17,9 +17,6 @@ except ImportError:
     from django.core.urlresolvers import reverse
 
 
-
-
-
 @override_settings(ROOT_URLCONF="tests.urls")
 class TestSocialAuth(TestsMixin, TestCase):
 
@@ -305,7 +302,7 @@ class TestSocialAuth(TestsMixin, TestCase):
         }
 
         self.post(self.fb_login_url, data=payload, status_code=200)
-        self.assertIn('token', self.response.json.keys())
+        self.assertIn('access_token', self.response.json.keys())
         self.assertIn('user', self.response.json.keys())
 
         self.assertEqual(get_user_model().objects.all().count(), users_count + 1)

dj_rest_auth/tests/urls.py

@@ -11,10 +11,21 @@ from dj_rest_auth.urls import urlpatterns
 from django.conf.urls import include, url
 from django.views.generic import TemplateView
 from rest_framework.decorators import api_view
+from rest_framework.views import APIView
+from rest_framework.response import Response
+from rest_framework import permissions
 
 from . import django_urls
 
 
+class ExampleProtectedView(APIView):
+    permission_classes = [permissions.IsAuthenticated]
+
+
+    def get(self, *args, **kwargs):
+        return Response(dict(success=True))
+
+
 class FacebookLogin(SocialLoginView):
     adapter_class = FacebookOAuth2Adapter
 
@@ -64,6 +75,7 @@ urlpatterns += [
     url(r'^social-login/facebook/connect/$', FacebookConnect.as_view(), name='fb_connect'),
     url(r'^social-login/twitter/connect/$', TwitterConnect.as_view(), name='tw_connect'),
     url(r'^socialaccounts/$', SocialAccountListView.as_view(), name='social_account_list'),
+    url(r'^protected-view/$', ExampleProtectedView.as_view()),
     url(r'^socialaccounts/(?P<pk>\d+)/disconnect/$', SocialAccountDisconnectView.as_view(),
         name='social_account_disconnect'),
     url(r'^accounts/', include('allauth.socialaccount.urls'))

dj_rest_auth/utils.py

@@ -17,12 +17,40 @@ def default_create_token(token_model, user, serializer):
 
 def jwt_encode(user):
     try:
-        from rest_framework_jwt.settings import api_settings
+        from rest_framework_simplejwt.serializers import TokenObtainPairSerializer
     except ImportError:
-        raise ImportError("djangorestframework_jwt needs to be installed")
+        raise ImportError("rest-framework-simplejwt needs to be installed")
 
-    jwt_payload_handler = api_settings.JWT_PAYLOAD_HANDLER
+    refresh = TokenObtainPairSerializer.get_token(user)
-    jwt_encode_handler = api_settings.JWT_ENCODE_HANDLER
+    return refresh.access_token, refresh
 
-    payload = jwt_payload_handler(user)
+
-    return jwt_encode_handler(payload)
+try:
+    from rest_framework_simplejwt.authentication import JWTAuthentication
+
+    class JWTCookieAuthentication(JWTAuthentication):
+        """
+        An authentication plugin that hopefully authenticates requests through a JSON web
+        token provided in a request cookie (and through the header as normal, with a
+        preference to the header).
+        """
+        def authenticate(self, request):
+            from django.conf import settings
+            cookie_name = getattr(settings, 'JWT_AUTH_COOKIE', None)
+            header = self.get_header(request)
+            if header is None:
+                if cookie_name:
+                    raw_token = request.COOKIES.get(cookie_name)
+                else:
+                    return None
+            else:
+                raw_token = self.get_raw_token(header)
+                
+            if raw_token is None:
+                return None
+
+            validated_token = self.get_validated_token(raw_token)
+            return self.get_user(validated_token), validated_token
+
+except ImportError:
+    pass

dj_rest_auth/views.py

@@ -59,7 +59,7 @@ class LoginView(GenericAPIView):
         self.user = self.serializer.validated_data['user']
 
         if getattr(settings, 'REST_USE_JWT', False):
-            self.token = jwt_encode(self.user)
+            self.access_token, self.refresh_token = jwt_encode(self.user)
         else:
             self.token = create_token(self.token_model, self.user,
                                       self.serializer)
@@ -73,7 +73,8 @@ class LoginView(GenericAPIView):
         if getattr(settings, 'REST_USE_JWT', False):
             data = {
                 'user': self.user,
-                'token': self.token
+                'access_token': self.access_token,
+                'refresh_token': self.refresh_token
             }
             serializer = serializer_class(instance=data,
                                           context={'request': self.request})
@@ -83,14 +84,17 @@ class LoginView(GenericAPIView):
 
         response = Response(serializer.data, status=status.HTTP_200_OK)
         if getattr(settings, 'REST_USE_JWT', False):
-            from rest_framework_jwt.settings import api_settings as jwt_settings
+            cookie_name = getattr(settings, 'JWT_AUTH_COOKIE', None)
-            if jwt_settings.JWT_AUTH_COOKIE:
+            from rest_framework_simplejwt.settings import api_settings as jwt_settings
+            if cookie_name:
                 from datetime import datetime
-                expiration = (datetime.utcnow() + jwt_settings.JWT_EXPIRATION_DELTA)
+                expiration = (datetime.utcnow() + jwt_settings.ACCESS_TOKEN_LIFETIME)
-                response.set_cookie(jwt_settings.JWT_AUTH_COOKIE,
+                response.set_cookie(
-                                    self.token,
+                    cookie_name,
-                                    expires=expiration,
+                    self.access_token,
-                                    httponly=True)
+                    expires=expiration,
+                    httponly=True
+                )
         return response
 
     def post(self, request, *args, **kwargs):
@@ -134,9 +138,9 @@ class LogoutView(APIView):
         response = Response({"detail": _("Successfully logged out.")},
                             status=status.HTTP_200_OK)
         if getattr(settings, 'REST_USE_JWT', False):
-            from rest_framework_jwt.settings import api_settings as jwt_settings
+            cookie_name = getattr(settings, 'JWT_AUTH_COOKIE', None)
-            if jwt_settings.JWT_AUTH_COOKIE:
+            if cookie_name:
-                response.delete_cookie(jwt_settings.JWT_AUTH_COOKIE)
+                response.delete_cookie(cookie_name)
         return response
 
 

docs/configuration.rst

@@ -46,8 +46,8 @@ Configuration
 
 - **REST_SESSION_LOGIN** - Enable session login in Login API view (default: True)
 
-- **REST_USE_JWT** - Enable JWT Authentication instead of Token/Session based. This is built on top of django-rest-framework-jwt http://getblimp.github.io/django-rest-framework-jwt/, which must also be installed. (default: False)
+- **REST_USE_JWT** - Enable JWT Authentication instead of Token/Session based. This is built on top of djangorestframework-simplejwt https://github.com/SimpleJWT/django-rest-framework-simplejwt, which must also be installed. (default: False)
-
+- **JWT_AUTH_COOKIE** - The cookie name/key.
 - **OLD_PASSWORD_FIELD_ENABLED** - set it to True if you want to have old password verification on password change enpoint (default: False)
 
 - **LOGOUT_ON_PASSWORD_CHANGE** - set to False if you want to keep the current user logged in after a password change

docs/installation.rst

@@ -248,12 +248,23 @@ JSON Web Token (JWT) Support (optional)
 
 By default ``dj-rest-auth`` uses Django's Token-based authentication. If you want to use JWT authentication, follow these steps:
 
-1. Install `djangorestframework-jwt <http://getblimp.github.io/django-rest-framework-jwt/>`_
+1. Install `djangorestframework-simplejwt <https://github.com/SimpleJWT/django-rest-framework-simplejwt/>`_
-    - ``djangorestframework-jwt`` is currently the only supported JWT library.
+    - ``djangorestframework-simplejwt`` is currently the only supported JWT library.
-2. The ``JWT_PAYLOAD_HANDLER`` and ``JWT_ENCODE_HANDLER`` settings are imported from the ``django-rest-framework-jwt`` settings object.
-    - Refer to `the library's documentation <http://getblimp.github.io/django-rest-framework-jwt/#additional-settings>`_ for information on using different encoders.
 
-3. Add the following configuration value to your settings file to enable JWT authentication.
+2. Add a simple_jwt auth configuration to the list of authentication classes.
+
+.. code-block:: python
+
+    REST_FRAMEWORK = {
+        ...
+        'DEFAULT_AUTHENTICATION_CLASSES': (
+            ...
+            'dj_rest_auth.utils.JWTCookieAuthentication',
+        )
+        ...
+    }
+
+3. Add the following configuration value to your settings file to enable JWT authentication in dj-rest-auth.
 
 .. code-block:: python
 

setup.py

@@ -12,7 +12,7 @@ f.close()
 
 setup(
     name='dj-rest-auth',
-    version='0.1.4',
+    version='0.2.0',
     author='iMerica',
     author_email='imichael@pm.me',
     url='http://github.com/jazzband/dj-rest-auth',
@@ -32,7 +32,7 @@ setup(
     tests_require=[
         'responses>=0.5.0',
         'django-allauth>=0.25.0',
-        'djangorestframework-jwt>=1.9.0',
+        'djangorestframework-simplejwt>=4.4.0 ',
         'coveralls>=1.11.1'
     ],
     test_suite='runtests.runtests',