fixes

backend/api/views/auth.py

@@ -0,0 +1,65 @@
+"""Cookie-backed JWT auth views.
+
+`CookieTokenObtainPairView` and `CookieTokenRefreshView` move the JWT pair into
+httpOnly cookies on the response so the frontend never has tokens in JS-readable
+storage. Refresh accepts the token from the cookie *or* the legacy request body.
+`CookieLogoutView` clears both cookies and blacklists the refresh token.
+"""
+
+from __future__ import annotations
+
+from django.conf import settings
+from rest_framework import status
+from rest_framework.permissions import AllowAny
+from rest_framework.request import Request
+from rest_framework.response import Response
+from rest_framework.views import APIView
+from rest_framework_simplejwt.exceptions import TokenError
+from rest_framework_simplejwt.tokens import RefreshToken
+from rest_framework_simplejwt.views import TokenObtainPairView, TokenRefreshView
+
+from api.utils.cookie_auth import clear_jwt_cookies, set_jwt_cookies
+
+
+class CookieTokenObtainPairView(TokenObtainPairView):
+    def post(self, request: Request, *args, **kwargs):
+        response = super().post(request, *args, **kwargs)
+        if response.status_code == status.HTTP_200_OK:
+            access = response.data.pop("access", None)
+            refresh = response.data.pop("refresh", None)
+            set_jwt_cookies(response, access, refresh)
+            response.data = {"status": "ok"}
+        return response
+
+
+class CookieTokenRefreshView(TokenRefreshView):
+    def post(self, request: Request, *args, **kwargs):
+        if "refresh" not in request.data:
+            cookie_refresh = request.COOKIES.get(settings.JWT_AUTH_COOKIE_REFRESH)
+            if cookie_refresh:
+                # request.data is a QueryDict / dict — make a mutable copy.
+                data = request.data.copy() if hasattr(request.data, "copy") else dict(request.data)
+                data["refresh"] = cookie_refresh
+                request._full_data = data  # type: ignore[attr-defined]
+        response = super().post(request, *args, **kwargs)
+        if response.status_code == status.HTTP_200_OK:
+            access = response.data.pop("access", None)
+            refresh = response.data.pop("refresh", None)
+            set_jwt_cookies(response, access, refresh)
+            response.data = {"status": "ok"}
+        return response
+
+
+class CookieLogoutView(APIView):
+    permission_classes = [AllowAny]
+
+    def post(self, request: Request) -> Response:
+        refresh = request.COOKIES.get(settings.JWT_AUTH_COOKIE_REFRESH)
+        if refresh:
+            try:
+                RefreshToken(refresh).blacklist()
+            except TokenError:
+                pass
+        response = Response({"status": "ok"})
+        clear_jwt_cookies(response)
+        return response