[#164851399] Adds JWT Authentication to all routes

Pipfile

@@ -19,6 +19,7 @@ whitenoise = "*"
 drf-extensions = "*"
 django-cors-headers = "*"
 django-rest-swagger = "*"
+djangorestframework-simplejwt = "*"
 
 [requires]
 python_version = "3.7"

patienttracker/patients/tests.py

@@ -14,6 +14,7 @@ def setUp(self):
         self.my_admin = User.objects.create(username='user')
         self.client = APIClient()
         user = User.objects.get()
+        self.client.force_authenticate(user=self.my_admin)
 
         self.valid_payload = {
             'first_name' : 'John',

patienttracker/patients/views.py

@@ -2,11 +2,14 @@
 from .serializers import PatientSerializer, AppointmentSerializer
 from .models import Patient, Appointment
 from rest_framework_extensions.mixins import NestedViewSetMixin
+from rest_framework.permissions import IsAuthenticated
 
 class PatientViewSet(NestedViewSetMixin, ModelViewSet):
     serializer_class = PatientSerializer
     queryset = Patient.objects.all()
+    permission_classes = (IsAuthenticated,)
 
 class AppointmentViewSet(NestedViewSetMixin, ModelViewSet):
     serializer_class = AppointmentSerializer
     queryset = Appointment.objects.all()
+    permission_classes = (IsAuthenticated,)

patienttracker/patienttracker/settings.py

@@ -12,6 +12,7 @@
 
 import os
 import environ
+from datetime import timedelta
 
 env = environ.Env(
     DEBUG=(bool, False)
@@ -136,3 +137,42 @@
 
 LOGIN_URL = 'rest_framework:login'
 LOGOUT_URL = 'rest_framework:logout'
+
+SWAGGER_SETTINGS = {
+    'SECURITY_DEFINITIONS': {
+        'apiKey': {
+            'type': 'apiKey',
+            'name': 'Bearer',
+            'in': 'header'
+        }
+    },
+}
+
+REST_FRAMEWORK = {
+    'DEFAULT_AUTHENTICATION_CLASSES': [
+        'rest_framework_simplejwt.authentication.JWTAuthentication',
+        'rest_framework.authentication.SessionAuthentication',
+    ],
+}
+
+SIMPLE_JWT = {
+    'ACCESS_TOKEN_LIFETIME': timedelta(minutes=60),
+    'REFRESH_TOKEN_LIFETIME': timedelta(days=1),
+    'ROTATE_REFRESH_TOKENS': False,
+    'BLACKLIST_AFTER_ROTATION': True,
+
+    'ALGORITHM': 'HS256',
+    'SIGNING_KEY': SECRET_KEY,
+    'VERIFYING_KEY': None,
+
+    'AUTH_HEADER_TYPES': ('Bearer',),
+    'USER_ID_FIELD': 'id',
+    'USER_ID_CLAIM': 'user_id',
+
+    'AUTH_TOKEN_CLASSES': ('rest_framework_simplejwt.tokens.AccessToken',),
+    'TOKEN_TYPE_CLAIM': 'token_type',
+
+    'SLIDING_TOKEN_REFRESH_EXP_CLAIM': 'refresh_exp',
+    'SLIDING_TOKEN_LIFETIME': timedelta(minutes=5),
+    'SLIDING_TOKEN_REFRESH_LIFETIME': timedelta(days=1),
+}

patienttracker/patienttracker/urls.py

@@ -16,6 +16,7 @@
 from django.contrib import admin
 from django.urls import path, include
 from rest_framework_swagger.views import get_swagger_view
+from rest_framework_simplejwt import views as jwt_views
 
 schema_view = get_swagger_view(title='Patient Tracker API')
 
@@ -24,5 +25,7 @@
     path('', include('patients.urls')),
     path('', include('users.urls')),
     path('auth/', include('rest_framework.urls')),
-    path('', schema_view)
+    path('', schema_view),
+    path('api/token/', jwt_views.TokenObtainPairView.as_view(), name='token_obtain_pair'),
+    path('api/token/refresh/', jwt_views.TokenRefreshView.as_view(), name='token_refresh'),
 ]