55 lines
2.2 KiB
Python
55 lines
2.2 KiB
Python
from rest_framework.permissions import AllowAny
|
||
from rest_framework_simplejwt.views import TokenRefreshView
|
||
from rest_framework_simplejwt.tokens import RefreshToken
|
||
from rest_framework_simplejwt.exceptions import TokenError
|
||
from drf_spectacular.utils import extend_schema
|
||
|
||
from config.exceptions import AppError
|
||
from apps.user.utils.jwt_redis import revoke_token, is_token_revoked, get_user_invalid_before
|
||
|
||
|
||
@extend_schema(tags=['认证'])
|
||
class CustomTokenRefreshView(TokenRefreshView):
|
||
"""U8 刷新 Token — 在 simplejwt 旋转前后加入 Redis 黑名单检查 + 旧 token 吊销"""
|
||
permission_classes = [AllowAny]
|
||
authentication_classes = ()
|
||
|
||
def post(self, request, *args, **kwargs):
|
||
refresh_raw = request.data.get('refresh', '')
|
||
if not refresh_raw:
|
||
raise AppError('AUTH_TOKEN_INVALID', '请提供 refresh token', status_code=401)
|
||
|
||
# ── 解析旧 token（必须在 super().post() 之前，因为 simplejwt 会 mutate） ──
|
||
try:
|
||
old_token = RefreshToken(refresh_raw)
|
||
except TokenError:
|
||
raise AppError('AUTH_TOKEN_INVALID', 'refresh token 无效或已过期', status_code=401)
|
||
|
||
old_jti = old_token.payload.get('jti')
|
||
old_exp = old_token.payload.get('exp')
|
||
uid = old_token.payload.get('user_id')
|
||
iat = old_token.payload.get('iat')
|
||
|
||
# ── Redis 黑名单检查 ──
|
||
if old_jti and is_token_revoked(old_jti):
|
||
raise AppError('AUTH_TOKEN_INVALID', 'refresh token 已被吊销', status_code=401)
|
||
|
||
# ── 用户级失效截止检查 ──
|
||
if uid and iat is not None:
|
||
invalid_before = get_user_invalid_before(uid)
|
||
if invalid_before is not None and iat < invalid_before:
|
||
raise AppError('AUTH_TOKEN_INVALID', 'token 已失效，请重新登录', status_code=401)
|
||
|
||
# ── 交给 simplejwt 处理旋转 ──
|
||
response = super().post(request, *args, **kwargs)
|
||
|
||
# ── 吊销旧 refresh token ──
|
||
if old_jti and old_exp:
|
||
revoke_token(old_jti, old_exp)
|
||
|
||
return response
|
||
|
||
|
||
# 函数式引用，供 urls.py 保持一致风格
|
||
refresh_token = CustomTokenRefreshView.as_view()
|