Merge pull request #196 from cuappdev/sophie/auth

Implement auth

Author: sophiestrausberg

app_factory.py

@@ -1,15 +1,20 @@
 import logging
+from datetime import timedelta, timezone
+from flask_jwt_extended import JWTManager
 from datetime import datetime
 from flask import Flask, render_template
 from graphene import Schema
 from graphql.utils import schema_printer
+from src.utils.constants import JWT_SECRET_KEY
 from src.database import db_session, init_db
 from src.database import Base as db
 from src.database import db_url, db_user, db_password, db_name, db_host, db_port
 from flask_migrate import Migrate
 from src.schema import Query, Mutation
 from flasgger import Swagger
 from flask_graphql import GraphQLView
+from src.models.token_blacklist import TokenBlocklist
+
 
 # Set up logging at module level
 logging.basicConfig(format="%(asctime)s %(levelname)-8s %(message)s", level=logging.INFO, datefmt="%Y-%m-%d %H:%M:%S")
@@ -51,6 +56,17 @@ def create_app(run_migrations=False):
     schema = Schema(query=Query, mutation=Mutation)
     swagger = Swagger(app)
 
+    app.config["JWT_SECRET_KEY"] = JWT_SECRET_KEY
+    app.config["JWT_ACCESS_TOKEN_EXPIRES"] = timedelta(hours=1)
+    app.config["JWT_REFRESH_TOKEN_EXPIRES"] = timedelta(days=30)
+
+    jwt = JWTManager(app)
+
+    @jwt.token_in_blocklist_loader
+    def check_if_token_revoked(jwt_header, jwt_payload: dict) -> bool:
+        jti = jwt_payload["jti"]
+        return db_session.query(TokenBlocklist.id).filter_by(jti=jti).scalar() is not None
+
     # Configure routes
     logger.info("Configuring routes")
 
@@ -158,6 +174,13 @@ def scrape_classes():
         except Exception as e:
             logging.error(f"Error in scrape_classes: {e}")
 
+    @scheduler.task("interval", id="cleanup_expired_tokens", hours=24)
+    def cleanup_expired_tokens():
+        logger.info("Deleting expired tokens...")
+        now = datetime.now(timezone.utc)
+        db_session.query(TokenBlocklist).filter(TokenBlocklist.expires_at < now).delete()
+        db_session.commit()
+
     # Update hourly average capacity every hour
     @scheduler.task("cron", id="update_capacity", hour="*")
     def scheduled_job():

migrations/versions/7245f58bb00a_add_token_blacklist_table.py

@@ -0,0 +1,43 @@
+"""add token_blacklist table
+
+Revision ID: 7245f58bb00a
+Revises: 0fde4435424e
+Create Date: 2025-03-12 17:46:57.085233
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision = '7245f58bb00a'
+down_revision = '0fde4435424e'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+# Create the token_blacklist table
+    op.execute("""
+    DO $$
+    BEGIN
+    IF NOT EXISTS (
+    SELECT 1
+    FROM information_schema.tables
+    WHERE table_name = 'token_blacklist'
+    ) THEN
+    CREATE TABLE token_blacklist (
+    id SERIAL PRIMARY KEY,
+    jti VARCHAR(36) NOT NULL,
+    expires_at TIMESTAMP NOT NULL
+    );
+    CREATE INDEX ix_token_blacklist_jti ON token_blacklist(jti);
+    END IF;
+    END $$;
+    """)
+# Create an index on the jti column for faster lookups
+
+
+def downgrade():
+# Drop the index and then the table
+    op.execute("DROP TABLE IF EXISTS token_blacklist;")

requirements.txt

@@ -78,4 +78,5 @@ wasmer-compiler-cranelift==1.1.0
 wcwidth==0.2.6
 Werkzeug==2.2.2
 zipp==3.15.0
-sentry-sdk==2.13.0
+sentry-sdk==2.13.0
+flask_jwt_extended==4.7.1

schema.graphql

@@ -71,16 +71,6 @@ type CreateReport {
 
 scalar DateTime
 
-enum DayOfWeekEnum {
-  MONDAY
-  TUESDAY
-  WEDNESDAY
-  THURSDAY
-  FRIDAY
-  SATURDAY
-  SUNDAY
-}
-
 enum DayOfWeekGraphQLEnum {
   MONDAY
   TUESDAY
@@ -158,6 +148,15 @@ type HourlyAverageCapacity {
 
 scalar JSONString
 
+type LoginUser {
+  accessToken: String
+  refreshToken: String
+}
+
+type LogoutUser {
+  success: Boolean
+}
+
 enum MuscleGroup {
   ABDOMINALS
   CHEST
@@ -179,6 +178,9 @@ type Mutation {
   enterGiveaway(giveawayId: Int!, userNetId: String!): GiveawayInstance
   setWorkoutGoals(userId: Int!, workoutGoal: [String]!): User
   logWorkout(facilityId: Int!, userId: Int!, workoutTime: DateTime!): Workout
+  loginUser(netId: String!): LoginUser
+  logoutUser: LogoutUser
+  refreshAccessToken: RefreshAccessToken
   createReport(createdAt: DateTime!, description: String!, gymId: Int!, issue: String!): CreateReport
   deleteUser(userId: Int!): User
 }
@@ -222,6 +224,10 @@ type Query {
   getHourlyAverageCapacitiesByFacilityId(facilityId: Int): [HourlyAverageCapacity]
 }
 
+type RefreshAccessToken {
+  newAccessToken: String
+}
+
 type Report {
   id: ID!
   createdAt: DateTime!
@@ -246,7 +252,7 @@ type User {
   name: String!
   activeStreak: Int
   maxStreak: Int
-  workoutGoal: [DayOfWeekEnum]
+  workoutGoal: [DayOfWeekGraphQLEnum]
   giveaways: [Giveaway]
 }
 

src/models/token_blacklist.py

@@ -0,0 +1,19 @@
+from sqlalchemy import Column, String, Integer, DateTime
+from src.database import Base
+
+
+class TokenBlocklist(Base):
+    """
+    Represents a JWT token that has been revoked (blacklisted).
+
+    Attributes:
+        - `id`          The primary key of the token record.
+        - `jti`         The unique identifier (JWT ID) of the token. Indexed for fast lookup.
+        - `expires_at`  The DateTime when the token expires.
+    """
+
+    __tablename__ = "token_blacklist"
+
+    id = Column(Integer, primary_key=True)
+    jti = Column(String(36), index=True, nullable=False)
+    expires_at = Column(DateTime, nullable=False)