jwt refresh token 1.1

server/backend/JWT.py

@@ -32,19 +32,6 @@ class RefreshToken(Token):
         token_str = await Token.create_token(data, expires_delta)
         await db.refresh_token(encoded_jwt = token_str,email=data["sub"])
         return token_str
-# async def create_access_token(data: dict, expires_delta: timedelta | None = None):
-#     to_encode = data.copy()
-#     expire = datetime.utcnow() + (expires_delta or timedelta(minutes=15))
-#     to_encode.update({"exp": expire})
-#     encoded_jwt = jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)
-#     return encoded_jwt
-# async def create_refresh_token(data:dict, expires_delta:timedelta | None = None):
-#     to_encode = data.copy()
-#     expire = datetime.utcnow() + (expires_delta or timedelta(minutes=6000))
-#     to_encode.update({"exp": expire})
-#     encoded_jwt = jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)
-#     return encoded_jwt
-
 async def current_user(token: str = Depends(oauth2_scheme)): #Проверка jwt
     try:
         payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])

server/backend/endpoints.py

@@ -1,5 +1,6 @@
 from fastapi import FastAPI, HTTPException, status, Depends
 from fastapi.middleware.cors import CORSMiddleware
+from fastapi.responses import JSONResponse
 from . import pydentic, JWT
 from datetime import datetime, timedelta
 from pydantic import EmailStr
@@ -86,7 +87,6 @@ async def login_user(row: pydentic.UserLogin):
     user = await db.LoginUser(row)
     if not user:
         raise HTTPException(status_code=401, detail="The user isn't found")
-
     access_token = await JWT.AccessToken.create(
         {"sub": user.email},
         timedelta(minutes=JWT.ACCESS_TOKEN_EXPIRE_MINUTES)
@@ -95,8 +95,21 @@ async def login_user(row: pydentic.UserLogin):
         {"sub": user.email},
         timedelta(minutes=JWT.REFRESH_TOKEN_EXPIRE_MINUTES)
     )
-    return {
+    response = JSONResponse(content={
         "access_token": access_token,
-        "refresh_token": refresh_token,
         "token_type": "bearer"
-    }
+    })
+    response.set_cookie(
+        key="refresh_token",
+        value=refresh_token,
+        httponly=True,
+        secure=False,       # только https
+        samesite="strict"  # чтобы не утекал на другие сайты
+    )
+    return response
+@api.post("/logout")
+async def logout_user(row: pydentic.UserLogout):
+    user = await db.GetUserbyEmail(row)
+    if not user:
+        raise HTTPException(status_code=401, detail="The user isn't found")
+    await db.refresh_token(encoded_jwt = Null,email=user.email)

server/backend/pydentic.py

@@ -37,4 +37,6 @@ class UserUpdate(BaseModel):
         return check_password_complexity(cls, password)
 class UserLogin(BaseModel):
     email:EmailStr = Field(..., min_length=6, max_length=254, description="user's email")
-    password:str = Field(..., description="Password")
+    password:str = Field(..., description="Password")
+class UserLogout(BaseModel):
+    email:EmailStr = Field(..., min_length=6, max_length=254, description="user's email")