Merge pull request #498 from sparcs-kaist/revert-495-revert-494-revert-493-revert-492-revert-491-feat/jwt_auth

Revert Jwt for v3.6.2 realease

Author: Killerwhale-Park

Pipfile

@@ -41,7 +41,6 @@ django-ses = "*"
 pydantic = "*"
 slack-sdk = "*"
 pytz = "*"
-djangorestframework-simplejwt = "*"
 
 [dev-packages]
 black = "*"

Pipfile.lock

@@ -19,10 +19,6 @@
 from ara.classes.sparcssso import Client as SSOClient
 from ara.classes.viewset import ActionAPIViewSet
 
-#for jwt
-from rest_framework_simplejwt.tokens import RefreshToken
-from django.http import JsonResponse
-
 NOUNS = [
     "외계인",
     "펭귄",
@@ -147,7 +143,6 @@ class UserViewSet(ActionAPIViewSet):
     action_permission_classes = {
         "sso_login": (permissions.AllowAny,),
         "sso_login_callback": (permissions.AllowAny,),
-        "refresh_token": (permissions.AllowAny,),
     }
 
     @cached_property
@@ -296,37 +291,17 @@ def sso_login_callback(self, request, *args, **kwargs):
 
         login(request, user_profile.user)
 
-        #jwt token
-        refresh = RefreshToken.for_user(user_profile.user)
-        access_token = str(refresh.access_token)
-        refresh_token = str(refresh)
-
         _next = request.session.get("next", "/")
 
-        # 이용약관 미동의자
-        if (request.user.is_authenticated and
-            request.user.profile.agree_terms_of_service_at is None):
-            tos_url = f"{urlparse(_next).scheme}://{urlparse(_next).netloc}/tos"
-        else:
-            tos_url = None
-
-        # API 요청이면 JSON 응답, 아니면 redirect
-        if request.headers.get("Accept") == "application/json" or request.GET.get("mode") == "json":
-            res = JsonResponse({
-                "detail": "login success",
-                "next": tos_url or _next,
-                "access": access_token,
-                "refresh": refresh_token,
-            })
-            res.set_cookie("access", access_token) #프로덕션 환경에서는 보안 설정 필요.
-            res.set_cookie("refresh", refresh_token)
-            return res
-
-        # 웹 요청이면 기존 redirect 흐름 유지
-        res = redirect(to=tos_url or _next)
-        res.set_cookie("access", access_token)
-        res.set_cookie("refresh", refresh_token)
-        return res
+        # redirect to frontend's terms of service agreement page if user did not agree it yet
+        if (
+            request.user.is_authenticated
+            and request.user.profile.agree_terms_of_service_at is None
+        ):
+            _next = urlparse(_next)
+            return redirect(to=f"{_next.scheme}://{_next.netloc}/tos")
+
+        return redirect(to=_next)
 
     @decorators.action(detail=True, methods=["post"])
     def sso_unregister(self, request, *args, **kwargs):
@@ -356,27 +331,3 @@ def sso_logout(self, request, *args, **kwargs):
         return response.Response(
             status=status.HTTP_200_OK,
         )
-
-    #jwt -> refresh toekn
-    @decorators.action(detail=False, methods=['post'])
-    def refresh_token(self, request):
-        refresh_token = request.COOKIES.get('refresh')
-        if not refresh_token:
-            return response.Response({'error': 'Refresh token not provided'}, status=status.HTTP_400_BAD_REQUEST)
-
-        try:
-            token = RefreshToken(refresh_token)
-            access_token = str(token.access_token)
-        except Exception:
-            return response.Response({'error': 'Invalid refresh token'}, status=status.HTTP_401_UNAUTHORIZED)
-
-        resp = response.Response({'access': access_token})
-        resp.set_cookie(
-            'access',
-            access_token,
-            httponly=True,
-            secure=True,
-            samesite='Lax',
-        )
-        return resp
-    

apps/user/views/viewsets/user.py

@@ -1,26 +1,6 @@
 from rest_framework.authentication import SessionAuthentication
-from rest_framework_simplejwt.authentication import JWTAuthentication
 
 
 class CsrfExemptSessionAuthentication(SessionAuthentication):
     def enforce_csrf(self, request):
         return  # To not perform the csrf check previously happening
-
-
-class JWTCookieAuthentication(JWTAuthentication):
-    def authenticate(self, request):
-        # 1. 쿠키에서 access 토큰을 찾음
-        raw_token = request.COOKIES.get("access")
-
-        # 2. 없으면 헤더에서 찾음 (Authorization: Bearer ...)
-        if not raw_token:
-            header = self.get_header(request)
-            if header is None:
-                return None
-            raw_token = self.get_raw_token(header)
-
-        if raw_token is None:
-            return None
-
-        validated_token = self.get_validated_token(raw_token)
-        return self.get_user(validated_token), validated_token

ara/authentication.py

@@ -45,7 +45,6 @@
 REST_FRAMEWORK["DEFAULT_AUTHENTICATION_CLASSES"] = (
     "rest_framework.authentication.BasicAuthentication",
     "ara.authentication.CsrfExemptSessionAuthentication",
-    "ara.authentication.JWTCookieAuthentication",
 )
 
 LOGGING["disable_existing_loggers"] = False

ara/settings/dev/__init__.py

@@ -5,9 +5,6 @@
 
 from .env import env, root
 
-#for jwt token
-from datetime import timedelta
-
 # Build paths inside the project like this: os.path.join(BASE_DIR, ...)
 BASE_DIR = root()
 
@@ -74,15 +71,6 @@
 # Password validation
 # https://docs.djangoproject.com/en/2.2/ref/settings/#auth-password-validators
 
-SIMPLE_JWT = {
-    'ACCESS_TOKEN_LIFETIME': timedelta(minutes=30),
-    'REFRESH_TOKEN_LIFETIME': timedelta(days=30),
-    'ROTATE_REFRESH_TOKENS': False,
-    'BLACKLIST_AFTER_ROTATION': False,
-    'AUTH_HEADER_TYPES': ('Bearer',),
-    'AUTH_TOKEN_CLASSES': ('rest_framework_simplejwt.tokens.AccessToken',),
-}
-
 AUTH_PASSWORD_VALIDATORS = [
     {
         "NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator",