Quiz_LLM JWT 인증

...
INSTALLED_APPS = [
    ...
    "rest_framework_simplejwt",
    ...
SIMPLE_JWT = {
    "ACCESS_TOKEN_LIFETIME": timedelta(hours=1),
    "REFRESH_TOKEN_LIFETIME": timedelta(days=1),
    "ROTATE_REFRESH_TOKENS": True,
    "BLACKLIST_AFTER_ROTATION": False,
    "UPDATE_LAST_LOGIN": False,
}
...
REST_FRAMEWORK = {
    'DEFAULT_PERMISSION_CLASSES': (
        'rest_framework.permissions.IsAuthenticated',  
    ),
    "DEFAULT_AUTHENTICATION_CLASSES": [
        "rest_framework_simplejwt.authentication.JWTAuthentication",
    ],
}

class EmailVerificationView(APIView):
    permission_classes = [AllowAny]

    def get(self, request, uidb64, token):
        try:
            # 유저 ID 복호화
            uid = urlsafe_base64_decode(uidb64).decode()
            user = get_object_or_404(User, pk=uid)

            # 토큰 검증
            if default_token_generator.check_token(user, token):
                user.is_active = True  # 계정 활성화
                user.save()

                # JWT 토큰 발급
                from rest_framework_simplejwt.tokens import RefreshToken

                refresh = RefreshToken.for_user(user)
                access_token = str(refresh.access_token)
                refresh_token = str(refresh)

                # 응답에 토큰 포함
                res = Response(
                    {
                        "message": "Email verified successfully.",
                        "token": {
                            "access": access_token,
                            "refresh": refresh_token,
                        },
                    },
                    status=status.HTTP_200_OK,
                )

                # JWT 토큰을 쿠키에 저장
                res.set_cookie("username", user.username, httponly=False)
                res.set_cookie("access", access_token, httponly=False)
                # res.set_cookie("refresh", refresh_token, httponly=True)
                user.refresh_token = refresh_token
                user.save()
                return res
            else:
                return Response(
                    {"message": "Invalid or expired token."},
                    status=status.HTTP_400_BAD_REQUEST,
                )
        except Exception as e:
            return Response(
                {"message": "Invalid request."}, status=status.HTTP_400_BAD_REQUEST
            )

class AuthAPIView(APIView):

    def get_permissions(self):
        """POST 요청은 인증 없이 허용"""
        if self.request.method == "POST":
            return [AllowAny()]
        return [IsAuthenticated()]

    # 로그인
    def post(self, request):
        # 유저 인증
        user = authenticate(
            username=request.data.get("username"), password=request.data.get("password")
        )
        # 이미 회원가입 된 유저일 때
        if user is not None:
            serializer = UserSerializer(user)
            # jwt 토큰 접근
            token = TokenObtainPairSerializer.get_token(user)
            refresh_token = str(token)
            access_token = str(token.access_token)
            res = Response(
                {
                    "user": serializer.data,
                    "message": "login success",
                    "token": {
                        "access": access_token,
                        "refresh": refresh_token,
                    },
                },
                status=status.HTTP_200_OK,
            )
            # jwt 토큰 => 쿠키에 저장
            res.set_cookie("username", user.username, httponly=False)
            res.set_cookie("access", access_token, httponly=False)
            user.refresh_token = refresh_token
            user.save()
            return res
        else:
            return Response(status=status.HTTP_400_BAD_REQUEST)

    # 로그아웃
    def delete(self, request):
        username = request.data.get("username")
        user = get_object_or_404(User, username=username)

        # 쿠키에 저장된 토큰 삭제 => 로그아웃 처리
        response = Response(
            {"message": f"{username} Logout success"}, status=status.HTTP_202_ACCEPTED
        )
        response.delete_cookie("access")
        # response.delete_cookie("refresh")
        user.refresh_token = ""
        user.save()
        return response

class TokenRefresh(APIView):
    permission_classes = [AllowAny]

    def post(self, request):
        try:
            # access token을 decode 해서 유저 id 추출 => 유저 식별
            access = request.COOKIES["access"]
            payload = jwt.decode(access, SECRET_KEY, algorithms=["HS256"])
            pk = payload.get("user_id")
            user = get_object_or_404(User, pk=pk)
            refresh_token = user.refresh_token
            data = {"refresh": refresh_token}
            serializer = TokenRefreshSerializer(data=data)

            # 유효성 검사 및 응답 직렬화
            if serializer.is_valid(raise_exception=True):
                access = serializer.data.get("access", None)
                serializer = UserSerializer(instance=user)

                # 새로운 access와 refresh 토큰으로 응답 생성
                res = Response(
                    {"access": access}, status=status.HTTP_200_OK
                )
                res.set_cookie("username", user.username, httponly=False)
                res.set_cookie("access", access, httponly=False)
                # res.set_cookie("refresh", refresh)
                return res

        except jwt.exceptions.InvalidTokenError as e:
            return Response({"detail": str(e)}, status=status.HTTP_401_UNAUTHORIZED)
        except KeyError:
            return Response({"detail": "토큰을 확인할 수 없습니다."}, status=status.HTTP_400_BAD_REQUEST)
        except Exception as e:
            return Response({"detail": "오류가 발생하였습니다. : " + str(e)}, status=status.HTTP_500_INTERNAL_SERVER_ERROR)