Fief Django/DRF authentication backend

[matteius]

Hey there @frankie567 -- I noticed there wasn't a Django/DRF pattern for using Fief and so I converted the existing examples to one that is working for me. Granted, this is a first pass and could probably be refactored and improved upon, but it appears to be working for my case.

from django.conf import settings
from fief_client import (
    Fief,
    FiefAccessTokenExpired,
    FiefAccessTokenInvalid,
    FiefAccessTokenMissingPermission,
    FiefAccessTokenMissingScope,
)
from rest_framework.authentication import BaseAuthentication
from rest_framework.exceptions import AuthenticationFailed


class FiefUser:
    """
    A basic user class that represents a user from Fief.
    """

    is_authenticated = True
    is_active = True  # You might also need this one

    def __init__(self, id, email=None, **kwargs):
        self.id = id
        self.email = email
        for key, value in kwargs.items():
            setattr(self, key, value)


class FiefAuthentication(BaseAuthentication):
    keyword = "Bearer"

    def __init__(self):
        self.client = Fief(
            settings.FIEF_HOST,
            settings.FIEF_ID,
            settings.FIEF_SECRET,
        )

    def __call__(self, *args, **kwargs):
        return self

    def authenticate(self, request):
        # Allow OPTIONS requests to bypass authentication
        if request.method == "OPTIONS":
            return None

        auth_header = request.headers.get("Authorization")
        if not auth_header:
            return None

        token = auth_header.split()[1]
        try:
            token_info = self.client.validate_access_token(token)
            user = self.get_or_create_user(token_info)
            return user, token
        except (
            FiefAccessTokenInvalid,
            FiefAccessTokenExpired,
            FiefAccessTokenMissingScope,
            FiefAccessTokenMissingPermission,
        ):
            raise AuthenticationFailed("Invalid Fief token.")

    def get_or_create_user(self, token_info):
        # Create a basic FiefUser with the provided information
        user = FiefUser(id=token_info["id"], email=token_info.get("email"))
        return user

Here is an example of using it:

from rest_framework.views import APIView
from rest_framework.response import Response
from rest_framework import status, permissions

from .authentication import FiefAuthentication


class FiefTestAPI(APIView):
    authentication_classes = [FiefAuthentication]
    permission_classes = [permissions.IsAuthenticated]

    def get(self, request):
        return Response({'message': 'Hello, world!'}, status=status.HTTP_200_OK)

[frankie567]

Thank you for this @matteius 👏

That's indeed really relevant! I had in mind to create a dedicated integration for Django, which would be a replacement for the built-in user authentication; but that was really complex.

Your approach is really sensible for API with DRF and simple to setup!