Merge pull request #62 from cuappdev/claire/auth

Add JWT authentication and user management features

Author: claiireyu

app.py

@@ -1,23 +1,47 @@
 import logging
 import argparse
-from flask import Flask, request, g
+import signal
+import sys
 import time
+from datetime import datetime, timedelta
+
+from dotenv import load_dotenv
+
+load_dotenv()
+
+from flask import Flask, request, g
+from flask_cors import CORS
+from flask_jwt_extended import JWTManager
 from flask_graphql import GraphQLView
 from graphene import Schema
 from src.schema import Query, Mutation
 from src.scrapers.games_scraper import fetch_game_schedule
 from src.scrapers.youtube_stats import fetch_videos
 from src.scrapers.daily_sun_scrape import fetch_news
 from src.services.article_service import ArticleService
+from src.utils.constants import JWT_SECRET_KEY
 from src.utils.team_loader import TeamLoader
-import signal
-import sys
-from dotenv import load_dotenv
-
-load_dotenv()
+from src.database import db
 
 app = Flask(__name__)
 
+# CORS: allow frontend (different origin) to call this API
+CORS(app, supports_credentials=True)
+
+# JWT config
+app.config["JWT_SECRET_KEY"] = JWT_SECRET_KEY
+app.config["JWT_ACCESS_TOKEN_EXPIRES"] = timedelta(hours=1)
+app.config["JWT_REFRESH_TOKEN_EXPIRES"] = timedelta(days=30)
+
+jwt = JWTManager(app)
+
+
+@jwt.token_in_blocklist_loader
+def check_if_token_revoked(jwt_header, jwt_payload: dict) -> bool:
+    """Reject the request if the token's jti is in the blocklist (e.g. after logout)."""
+    jti = jwt_payload["jti"]
+    return db["token_blocklist"].find_one({"jti": jti}) is not None
+
 
 @app.before_request
 def start_timer():
@@ -73,7 +97,7 @@ def log_response_time(response):
     datefmt="%Y-%m-%d %H:%M:%S",
 )
 
-schema = Schema(query=Query, mutation=Mutation)
+schema = Schema(query=Query, mutation=Mutation, auto_camelcase=True)
 
 
 def create_context():
@@ -136,6 +160,17 @@ class DefaultArgs:
     scheduler.init_app(app)
     scheduler.start()
 
+    @scheduler.task("interval", id="cleanse_token_blocklist", seconds=86400)  # 24 hours
+    def cleanse_token_blocklist():
+        """Remove expired tokens from blocklist so the collection doesn't grow forever."""
+        from datetime import timezone
+        from src.database import db
+        result = db["token_blocklist"].delete_many(
+            {"expires_at": {"$lt": datetime.now(timezone.utc)}}
+        )
+        if result.deleted_count:
+            logging.info(f"Cleansed {result.deleted_count} expired token(s) from blocklist")
+
     @scheduler.task("interval", id="scrape_schedules", seconds=43200) # 12 hours
     def scrape_schedules():
         logging.info("Scraping game schedules...")

requirements.txt

@@ -1,4 +1,6 @@
 Flask
+Flask-CORS
+Flask-JWT-Extended==4.7.1
 Flask-GraphQL
 graphene
 pymongo

src/database.py

@@ -98,6 +98,9 @@ def setup_database_indexes():
             background=True
         )
 
+        # JWT blocklist: fast lookup by jti
+        db["token_blocklist"].create_index([("jti", 1)], background=True)
+
         print("✅ MongoDB indexes created successfully")
     except Exception as e:
         print(f"❌ Failed to create MongoDB indexes: {e}")

src/mutations/__init__.py

@@ -1,4 +1,10 @@
 from .create_game import CreateGame
 from .create_team import CreateTeam
 from .create_youtube_video import CreateYoutubeVideo
-from .create_article import CreateArticle
+from .create_article import CreateArticle
+from .login_user import LoginUser
+from .signup_user import SignupUser
+from .refresh_access_token import RefreshAccessToken
+from .logout_user import LogoutUser
+from .add_favorite_game import AddFavoriteGame
+from .remove_favorite_game import RemoveFavoriteGame

src/mutations/add_favorite_game.py

@@ -0,0 +1,25 @@
+from bson import ObjectId
+from graphql import GraphQLError
+from graphene import Mutation, String, Boolean
+
+from flask_jwt_extended import get_jwt_identity, jwt_required
+from src.database import db
+from src.services.game_service import GameService
+
+
+class AddFavoriteGame(Mutation):
+    class Arguments:
+        game_id = String(required=True, description="ID of the game to add to favorites.")
+
+    success = Boolean()
+
+    @jwt_required()
+    def mutate(self, info, game_id):
+        if not GameService.get_game_by_id(game_id):
+            raise GraphQLError("Game not found.")
+        user_id = get_jwt_identity()
+        db["users"].update_one(
+            {"_id": ObjectId(user_id)},
+            {"$addToSet": {"favorite_game_ids": game_id}},
+        )
+        return AddFavoriteGame(success=True)

src/mutations/login_user.py

@@ -0,0 +1,23 @@
+from graphql import GraphQLError
+from graphene import Mutation, String, Field
+
+from flask_jwt_extended import create_access_token, create_refresh_token
+from src.database import db
+
+
+class LoginUser(Mutation):
+    class Arguments:
+        net_id = String(required=True, description="User's net ID (e.g. Cornell netid).")
+
+    access_token = String()
+    refresh_token = String()
+
+    def mutate(self, info, net_id):
+        user = db["users"].find_one({"net_id": net_id})
+        if not user:
+            raise GraphQLError("User not found.")
+        identity = str(user["_id"])
+        return LoginUser(
+            access_token=create_access_token(identity=identity),
+            refresh_token=create_refresh_token(identity=identity),
+        )

src/mutations/logout_user.py

@@ -0,0 +1,19 @@
+from datetime import datetime, timezone
+
+from graphene import Mutation, Boolean
+
+from flask_jwt_extended import get_jwt, jwt_required
+from src.database import db
+
+
+class LogoutUser(Mutation):
+    success = Boolean()
+
+    @jwt_required(verify_type=False)
+    def mutate(self, info):
+        token = get_jwt()
+        jti = token["jti"]
+        exp = token["exp"]
+        expires_at = datetime.fromtimestamp(exp, tz=timezone.utc)
+        db["token_blocklist"].insert_one({"jti": jti, "expires_at": expires_at})
+        return LogoutUser(success=True)

src/mutations/refresh_access_token.py

@@ -0,0 +1,14 @@
+from graphene import Mutation, String
+
+from flask_jwt_extended import create_access_token, get_jwt_identity, jwt_required
+
+
+class RefreshAccessToken(Mutation):
+    new_access_token = String()
+
+    @jwt_required(refresh=True)
+    def mutate(self, info):
+        identity = get_jwt_identity()
+        return RefreshAccessToken(
+            new_access_token=create_access_token(identity=identity),
+        )

src/mutations/remove_favorite_game.py

@@ -0,0 +1,21 @@
+from bson import ObjectId
+from graphene import Mutation, String, Boolean
+
+from flask_jwt_extended import get_jwt_identity, jwt_required
+from src.database import db
+
+
+class RemoveFavoriteGame(Mutation):
+    class Arguments:
+        game_id = String(required=True, description="ID of the game to remove from favorites.")
+
+    success = Boolean()
+
+    @jwt_required()
+    def mutate(self, info, game_id):
+        user_id = get_jwt_identity()
+        db["users"].update_one(
+            {"_id": ObjectId(user_id)},
+            {"$pull": {"favorite_game_ids": game_id}},
+        )
+        return RemoveFavoriteGame(success=True)

src/mutations/signup_user.py

@@ -0,0 +1,33 @@
+from graphql import GraphQLError
+from graphene import Mutation, String
+
+from flask_jwt_extended import create_access_token, create_refresh_token
+from src.database import db
+
+
+class SignupUser(Mutation):
+    class Arguments:
+        net_id = String(required=True, description="User's net ID (e.g. Cornell netid).")
+        name = String(required=False, description="Display name.")
+        email = String(required=False, description="Email address.")
+
+    access_token = String()
+    refresh_token = String()
+
+    def mutate(self, info, net_id, name=None, email=None):
+        if db["users"].find_one({"net_id": net_id}):
+            raise GraphQLError("Net ID already exists.")
+        user_doc = {
+            "net_id": net_id,
+            "favorite_game_ids": [],
+        }
+        if name is not None:
+            user_doc["name"] = name
+        if email is not None:
+            user_doc["email"] = email
+        result = db["users"].insert_one(user_doc)
+        identity = str(result.inserted_id)
+        return SignupUser(
+            access_token=create_access_token(identity=identity),
+            refresh_token=create_refresh_token(identity=identity),
+        )