feat: JWT Authentication implementation login & register endpoints

Author: pmutua

core/__init__.py

@@ -0,0 +1,16 @@
+"""
+ASGI config for core project.
+
+It exposes the ASGI callable as a module-level variable named ``application``.
+
+For more information on this file, see
+https://docs.djangoproject.com/en/4.2/howto/deployment/asgi/
+"""
+
+import os
+
+from django.core.asgi import get_asgi_application
+
+os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'core.settings')
+
+application = get_asgi_application()

core/asgi.py

@@ -0,0 +1,138 @@
+"""
+Django settings for core project.
+
+Generated by 'django-admin startproject' using Django 4.2.6.
+
+For more information on this file, see
+https://docs.djangoproject.com/en/4.2/topics/settings/
+
+For the full list of settings and their values, see
+https://docs.djangoproject.com/en/4.2/ref/settings/
+"""
+
+from pathlib import Path
+
+# Build paths inside the project like this: BASE_DIR / 'subdir'.
+BASE_DIR = Path(__file__).resolve().parent.parent
+
+AUTH_USER_MODEL = 'users.User'
+# Quick-start development settings - unsuitable for production
+# See https://docs.djangoproject.com/en/4.2/howto/deployment/checklist/
+
+# SECURITY WARNING: keep the secret key used in production secret!
+SECRET_KEY = 'django-insecure-j95s6tsmb8ppxgv+g-802x8z2#2+x)^#z9vxtc@o(-ho7$^=3z'
+
+# SECURITY WARNING: don't run with debug turned on in production!
+DEBUG = True
+
+ALLOWED_HOSTS = []
+
+
+# Application definition
+
+INSTALLED_APPS = [
+    'django.contrib.admin',
+    'django.contrib.auth',
+    'django.contrib.contenttypes',
+    'django.contrib.sessions',
+    'django.contrib.messages',
+    'django.contrib.staticfiles',
+    'rest_framework',
+    'users',
+]
+
+MIDDLEWARE = [
+    'django.middleware.security.SecurityMiddleware',
+    'django.contrib.sessions.middleware.SessionMiddleware',
+    'django.middleware.common.CommonMiddleware',
+    'django.middleware.csrf.CsrfViewMiddleware',
+    'django.contrib.auth.middleware.AuthenticationMiddleware',
+    'django.contrib.messages.middleware.MessageMiddleware',
+    'django.middleware.clickjacking.XFrameOptionsMiddleware',
+]
+
+
+REST_FRAMEWORK = {
+    # 'EXCEPTION_HANDLER': 'users.exceptions.responses.core_exception_handler',
+    # 'NON_FIELD_ERRORS_KEY': 'error',
+    # 'DEFAULT_FILTER_BACKENDS': ['django_filters.rest_framework.DjangoFilterBackend'],
+    'DEFAULT_AUTHENTICATION_CLASSES': [
+        'users.authentication.backends.JWTAuthentication',
+    ],
+    'DEFAULT_PERMISSION_CLASSES': [
+        'rest_framework.permissions.IsAuthenticated',
+    ],
+}
+
+ROOT_URLCONF = 'core.urls'
+
+TEMPLATES = [
+    {
+        'BACKEND': 'django.template.backends.django.DjangoTemplates',
+        'DIRS': [],
+        'APP_DIRS': True,
+        'OPTIONS': {
+            'context_processors': [
+                'django.template.context_processors.debug',
+                'django.template.context_processors.request',
+                'django.contrib.auth.context_processors.auth',
+                'django.contrib.messages.context_processors.messages',
+            ],
+        },
+    },
+]
+
+WSGI_APPLICATION = 'core.wsgi.application'
+
+
+# Database
+# https://docs.djangoproject.com/en/4.2/ref/settings/#databases
+
+DATABASES = {
+    'default': {
+        'ENGINE': 'django.db.backends.sqlite3',
+        'NAME': BASE_DIR / 'db.sqlite3',
+    }
+}
+
+
+# Password validation
+# https://docs.djangoproject.com/en/4.2/ref/settings/#auth-password-validators
+
+AUTH_PASSWORD_VALIDATORS = [
+    {
+        'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
+    },
+    {
+        'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
+    },
+    {
+        'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
+    },
+    {
+        'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
+    },
+]
+
+
+# Internationalization
+# https://docs.djangoproject.com/en/4.2/topics/i18n/
+
+LANGUAGE_CODE = 'en-us'
+
+TIME_ZONE = 'UTC'
+
+USE_I18N = True
+
+USE_TZ = True
+
+
+# Static files (CSS, JavaScript, Images)
+# https://docs.djangoproject.com/en/4.2/howto/static-files/
+
+STATIC_URL = 'static/'
+
+# Default primary key field type
+# https://docs.djangoproject.com/en/4.2/ref/settings/#default-auto-field
+
+DEFAULT_AUTO_FIELD = 'django.db.models.BigAutoField'

core/settings.py

@@ -0,0 +1,23 @@
+"""
+URL configuration for core project.
+
+The `urlpatterns` list routes URLs to views. For more information please see:
+    https://docs.djangoproject.com/en/4.2/topics/http/urls/
+Examples:
+Function views
+    1. Add an import:  from my_app import views
+    2. Add a URL to urlpatterns:  path('', views.home, name='home')
+Class-based views
+    1. Add an import:  from other_app.views import Home
+    2. Add a URL to urlpatterns:  path('', Home.as_view(), name='home')
+Including another URLconf
+    1. Import the include() function: from django.urls import include, path
+    2. Add a URL to urlpatterns:  path('blog/', include('blog.urls'))
+"""
+from django.contrib import admin
+from django.urls import include,path
+
+urlpatterns = [
+    path('admin/', admin.site.urls),
+    path("auth/", include("users.urls", namespace="users")),
+]

core/urls.py

@@ -0,0 +1,16 @@
+"""
+WSGI config for core project.
+
+It exposes the WSGI callable as a module-level variable named ``application``.
+
+For more information on this file, see
+https://docs.djangoproject.com/en/4.2/howto/deployment/wsgi/
+"""
+
+import os
+
+from django.core.wsgi import get_wsgi_application
+
+os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'core.settings')
+
+application = get_wsgi_application()

core/wsgi.py

@@ -0,0 +1,22 @@
+#!/usr/bin/env python
+"""Django's command-line utility for administrative tasks."""
+import os
+import sys
+
+
+def main():
+    """Run administrative tasks."""
+    os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'core.settings')
+    try:
+        from django.core.management import execute_from_command_line
+    except ImportError as exc:
+        raise ImportError(
+            "Couldn't import Django. Are you sure it's installed and "
+            "available on your PYTHONPATH environment variable? Did you "
+            "forget to activate a virtual environment?"
+        ) from exc
+    execute_from_command_line(sys.argv)
+
+
+if __name__ == '__main__':
+    main()

manage.py

@@ -0,0 +1,8 @@
+asgiref==3.7.2
+Django==4.2.6
+djangorestframework==3.14.0
+pytz==2023.3.post1
+sqlparse==0.4.4
+typing_extensions==4.8.0
+tzdata==2023.3
+PyJWT==2.7.0

requirements.txt

@@ -0,0 +1,5 @@
+from django.contrib import admin
+from users.models import User
+
+
+admin.site.register(User)

users/__init__.py

@@ -0,0 +1,6 @@
+from django.apps import AppConfig
+
+
+class UsersConfig(AppConfig):
+    default_auto_field = 'django.db.models.BigAutoField'
+    name = 'users'

users/admin.py

@@ -0,0 +1,105 @@
+import os
+import jwt
+
+from django.conf import settings
+
+from rest_framework import (
+    authentication,
+    exceptions
+)
+
+from users.models import User
+ 
+
+SECRET_KEY =  getattr(settings, 'SECRET_KEY', None)
+
+class JWTAuthentication(authentication.BaseAuthentication):
+    authentication_header_prefix = 'Bearer'
+
+    def authenticate(self, request):
+        """
+        The `authenticate` method is called on every request regardless of
+        whether the endpoint requires authentication. 
+
+        `authenticate` has two possible return values:
+
+        1) `None` - We return `None` if we do not wish to authenticate. Usually
+                    this means we know authentication will fail. An example of
+                    this is when the request does not include a token in the
+                    headers.
+
+        2) `(user, token)` - We return a user/token combination when 
+                             authentication is successful.
+
+                            If neither case is met, that means there's an error 
+                            and we do not return anything.
+                            We simple raise the `AuthenticationFailed` 
+                            exception and let Django REST Framework
+                            handle the rest.
+        """
+        request.user = None
+        # print('\033[32m' + 'start' + '\033[0m')
+        # `auth_header` should be an array with two elements: 1) the name of
+        # the authentication header (in this case, "Bearer") and 2) the JWT 
+        # that we should authenticate against.
+        auth_header = authentication.get_authorization_header(request).split()
+        auth_header_prefix = self.authentication_header_prefix.lower()
+
+
+        if not auth_header:
+            return None
+        
+        
+        if len(auth_header) == 1:
+            # Invalid token header. No credentials provided. Do not attempt to authenticate.
+
+            return None
+
+        elif len(auth_header) > 2:
+            # Invalid token header. The Token string should not contain spaces. Do
+            # not attempt to authenticate.
+            return None
+
+        # The JWT library we're using can't handle the `byte` type, which is
+        # commonly used by standard libraries in Python 3. To get around this,
+        # we simply have to decode `prefix` and `token`. This does not make for
+        # clean code, but it is a good decision because we would get an error
+        # if we didn't decode these values.
+        prefix = auth_header[0].decode('utf-8')
+        token = auth_header[1].decode('utf-8')
+        prefix = auth_header[0].decode('utf-8') if isinstance(auth_header[0], bytes) else auth_header[0]
+        token = auth_header[1].decode('utf-8') if isinstance(auth_header[1], bytes) else auth_header[1]
+
+        if prefix.lower() != auth_header_prefix:
+            # The auth header prefix is not what we expected. Do not attempt to
+            # authenticate.
+            return None
+
+        # By now, we are sure there is a *chance* that authentication will
+        # succeed. We delegate the actual credentials authentication to the
+        # method below.
+        return self._authenticate_credentials(request, token)
+
+    def _authenticate_credentials(self, request, token):
+        """
+        Try to authenticate the given credentials. If authentication is
+        successful, return the user and token. If not, throw an error.
+        """
+        try:
+            payload = jwt.decode(token, SECRET_KEY, algorithms=['HS256'])
+
+        except Exception as e:
+            msg = 'Invalid authentication. Could not decode token.'
+            raise exceptions.AuthenticationFailed()
+
+        try:
+            user = User.objects.get(pk=payload['id'])
+        except User.DoesNotExist:
+            msg = 'No user matching this token was found.'
+            raise exceptions.AuthenticationFailed(msg)
+
+        if not user.is_active:
+            msg = 'This user has been deactivated.'
+            raise exceptions.AuthenticationFailed(msg)
+        
+        return (user, token)

users/apps.py

@@ -0,0 +1,45 @@
+from django.contrib.auth.base_user import BaseUserManager
+from django.utils.translation import gettext_lazy as _
+
+
+class CustomUserManager(BaseUserManager):
+    """
+    Custom user model manager where email is the unique identifier
+    for authentication instead of usernames.
+    """
+
+    def create_user(self, email, password, **extra_fields):
+        extra_fields.setdefault("is_verified", True)
+        extra_fields.setdefault("username", email)
+        
+        if not extra_fields.get("role"):
+            raise ValueError("User must have a role assigned.")
+
+        if not email:
+            raise ValueError("Users must have an email address")
+
+        if self.model.objects.filter(email=email).exists():
+            raise ValueError('User email already exists.')
+
+        email = self.normalize_email(email)
+        user = self.model(email=email, **extra_fields)
+        user.set_password(password)
+        user.save(using=self._db)
+        return user
+
+    
+    def create_superuser(self, email, password, **extra_fields):
+        extra_fields.setdefault("is_staff", True)
+        extra_fields.setdefault("is_superuser", True)
+        extra_fields.setdefault("is_active", True)
+        extra_fields.setdefault("role", 'admin')
+
+        if extra_fields.get("is_staff") is not True:
+            raise ValueError("Superuser must have is_staff=True.")
+        if extra_fields.get("is_superuser") is not True:
+            raise ValueError("Superuser must have is_superuser=True.")
+
+        # Set email and password explicitly
+        email = self.normalize_email(email)
+
+        return self.create_user(email=email, password=password, **extra_fields)