Verify Serializer Should Honour Blacklist

rest_framework_simplejwt/serializers.py

@@ -1,4 +1,3 @@
-from django.conf import settings
 from django.contrib.auth import authenticate
 from django.utils.translation import gettext_lazy as _
 from rest_framework import exceptions, serializers
@@ -9,7 +8,7 @@
 from .state import User
 from .tokens import RefreshToken, SlidingToken, UntypedToken
 
-if 'rest_framework_simplejwt.token_blacklist' in settings.INSTALLED_APPS:
+if api_settings.BLACKLIST_AFTER_ROTATION:
     from .token_blacklist.models import BlacklistedToken
 
 class PasswordField(serializers.CharField):
@@ -146,7 +145,7 @@ class TokenVerifySerializer(serializers.Serializer):
     def validate(self, attrs):
         UntypedToken(attrs['token'])
 
-        if 'rest_framework_simplejwt.token_blacklist' in settings.INSTALLED_APPS:
+        if api_settings.BLACKLIST_AFTER_ROTATION:
             try:
                 token = RefreshToken(attrs['token'])
             # not a refresh token
@@ -155,6 +154,6 @@ def validate(self, attrs):
 
             jti = token.get(api_settings.JTI_CLAIM)
             if BlacklistedToken.objects.filter(token__jti=jti).exists():
-                raise ValidationError(_('Token is blacklisted'))
+                return {}
 
         return {}

tests/test_token_blacklist.py

@@ -193,11 +193,30 @@ def test_jti_field_should_contain_uuid_hex_strings(self):
         self.assertEqual(actual_hexes, self.expected_hexes)
 
 
-class TokenVerifySerializerShouldHonourBlacklist(TestCase):
+class TokenVerifySerializerShouldHonourBlacklist(MigrationTestCase):
+    migrate_from = ('token_blacklist', '0002_outstandingtoken_jti_hex')
+    migrate_to = ('token_blacklist', '0003_auto_20171017_2007')
+
+    def setUp(self):
+        self.user = User.objects.create(
+            username='test_user',
+            password='test_password',
+        )
+
+        super().setUp()
+
+    def test_token_verify_serializer_should_honour_blacklist_if_blacklisting_enabled(self):
+        with self.settings(REST_FRAMEWORK={'BLACKLIST_AFTER_ROTATION': True}):
+            refresh_token = RefreshToken.for_user(self.user)
+            refresh_token.blacklist()
+
+            serializer = TokenVerifySerializer(data={"token": str(refresh_token)})
+            self.assertFalse(serializer.is_valid())
 
-    def token_verify_serializer_shouldHonour_blacklist(self):
-        refresh_token = RefreshToken()
-        refresh_token.blacklist()
+    def test_token_verify_serializer_should_not_honour_blacklist_if_blacklisting_not_enabled(self):
+        with self.settings(REST_FRAMEWORK={'BLACKLIST_AFTER_ROTATION': False}):
+            refresh_token = RefreshToken.for_user(self.user)
+            refresh_token.blacklist()
 
-        serializer = TokenVerifySerializer({"token": refresh_token.payload})
-        self.assertFalse(serializer.is_valid())
+            serializer = TokenVerifySerializer(data={"token": str(refresh_token)})
+            self.assertTrue(serializer.is_valid())