search

mcueto / djangorestframework-auth0

Library to simply use Auth0 token authentication in DRF within djangorestframework-jwt
MIT License
91 stars 19 forks source link

Removed circular imports #21

Closed snake575 closed 7 years ago

snake575 commented 7 years ago

To address #20, deleted get_jwt_value on the utils module, to acomodate this, made HasRoleBasePermission inherit from Auth0JSONWebTokenAuthentication, so now it can use a new method on it called get_payload, which takes advantage JWT's JSONWebTokenAuthentication.authenticate, which in turn manages jwt_decode_handler errors and returns a validated jwt_value to retrive the payload. (decorators is more broken than ever now).

snake575 commented 7 years ago

I tested the changes and works on my project (without using the auth0 authentication extension), I created another issue to look at those problems #22

Ptosiek commented 7 years ago

I don't think we should mix permission and authentication here. There's no need for Permission to inherits from Auth0JSONWebTokenAuthentication if just to decode the token, and run the authenticate method once (again). has_permission should rather decode the token via jwt_decode_handler and handle exceptions itself. We might as well attach the decoded_payload to the request object/ view instead of decoding it each time.

mcueto commented 7 years ago

@xnegativx this week i'll work on a update! i will work both with @Snake575 and your tips, SO please give me the light to choose the right path! any comment will be welcomed

Ptosiek commented 7 years ago

Hi, Sorry for the delay. I've been trying to circle around this. I ended up with attaching the decoded_jwt to the request object. I tried my best to inherit code from restframework_jwt. Fork is there (but I've been working on other things too (multiple clients)) https://bitbucket.org/xnegativx/djangorestframework-auth0/

mcueto commented 7 years ago

I fixed it restoring back the original get_jwt_value function in 77014a312fba4cffca617eedeb41526a57e6ea80