"""JWT authentication bound to a server-revocable GoodDrive session."""
from rest_framework.exceptions import AuthenticationFailed
from rest_framework_simplejwt.authentication import JWTAuthentication

from .models import PersistentLoginSession


class PersistentJWTAuthentication(JWTAuthentication):
    """Invalidate access immediately when the associated login is revoked."""

    def get_user(self, validated_token):
        user = super().get_user(validated_token)
        session_id = validated_token.get('sid')
        if session_id is not None:
            valid = PersistentLoginSession.objects.filter(
                pk=session_id, user_id=user.pk, revoked_at__isnull=True,
                auth_hash=user.get_session_auth_hash(),
            ).exists()
            if not valid:
                raise AuthenticationFailed('Session fermée ou invalidée.')
        # JWTs issued before the update remain valid for their original (short)
        # access-token lifetime and can upgrade using their old refresh token.
        return user