Felipe Cardoso
8814dc931f
This commit introduces a system to revoke tokens by storing their `jti` in a new `RevokedToken` model. It includes APIs for logging out (revoking a current token) and logging out from all devices (revoking all tokens). Additionally, token validation now checks revocation status during the decode process.
15 lines
645 B
Python
15 lines
645 B
Python
from sqlalchemy import Column, String, ForeignKey
|
|
from sqlalchemy.dialects.postgresql import UUID
|
|
from sqlalchemy.orm import relationship
|
|
from app.models.base import Base, TimestampMixin, UUIDMixin
|
|
|
|
|
|
class RevokedToken(UUIDMixin, TimestampMixin, Base):
|
|
"""Model to store revoked JWT tokens via their jti (JWT ID)."""
|
|
__tablename__ = "revoked_tokens"
|
|
|
|
jti = Column(String(length=50), nullable=False, unique=True, index=True)
|
|
token_type = Column(String(length=20), nullable=False)
|
|
user_id = Column(UUID(as_uuid=True), ForeignKey("users.id", ondelete="CASCADE"))
|
|
|
|
user = relationship("User", back_populates="revoked_tokens") |