{
  "user_id":  42,
  "username": "alice",
  "role":     "editor",
  "iat":      1700000000,    // issued at (Unix timestamp)
  "exp":      1700003600     // expires in 1 hour
}

# 1. Client sends expired access token → 401
GET /api/posts/ HTTP/1.1
Authorization: Bearer <expired-access-token>

# 2. Client refreshes using the long-lived refresh token
POST /api/token/refresh/
{ "refresh": "<refresh-token>" }

# 3. Server responds with a new access token
{ "access": "<new-access-token>" }

# 4. Client retries with new access token → 200
GET /api/posts/
Authorization: Bearer <new-access-token>

# 1. Obtain token pair
curl -X POST http://localhost:8000/api/token/ \
  -H "Content-Type: application/json" \
  -d '{"username":"alice","password":"secret"}'

# Response:
{
  "access":  "eyJ...",   // valid 15 min
  "refresh": "eyJ..."    // valid 7 days
}

# 2. Call a protected endpoint
curl http://localhost:8000/api/posts/ \
  -H "Authorization: Bearer eyJ..."

from django.contrib.auth.models import AbstractUser
from django.db import models

class User(AbstractUser):
    class Role(models.TextChoices):
        ADMIN  = 'admin',  'Admin'
        EDITOR = 'editor', 'Editor'
        VIEWER = 'viewer', 'Viewer'

    role = models.CharField(
        max_length=10,
        choices=Role.choices,
        default=Role.VIEWER,
    )

    @property
    def is_admin(self):  return self.role == self.Role.ADMIN
    @property
    def is_editor(self): return self.role in (self.Role.ADMIN, self.Role.EDITOR)

from rest_framework.permissions import BasePermission, SAFE_METHODS

class IsAdminRole(BasePermission):
    """Allow access only to users with role='admin'."""
    def has_permission(self, request, view):
        return request.user.is_authenticated and request.user.is_admin

class IsEditorOrAdmin(BasePermission):
    """Editors and admins can write; viewers can only read."""
    def has_permission(self, request, view):
        if request.method in SAFE_METHODS:   # GET, HEAD, OPTIONS
            return request.user.is_authenticated
        return request.user.is_authenticated and request.user.is_editor

class IsOwnerOrAdmin(BasePermission):
    """Object-level: owner or admin may modify, others may read."""
    def has_object_permission(self, request, view, obj):
        if request.method in SAFE_METHODS:
            return True
        return obj.author == request.user or request.user.is_admin

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': [
        'rest_framework_simplejwt.authentication.JWTAuthentication',
    ],
    'DEFAULT_PERMISSION_CLASSES': [
        'rest_framework.permissions.IsAuthenticated',
    ],
    'DEFAULT_THROTTLE_CLASSES': [
        'rest_framework.throttling.AnonRateThrottle',
        'rest_framework.throttling.UserRateThrottle',
    ],
    'DEFAULT_THROTTLE_RATES': {
        'anon': '30/minute',   # unauthenticated users
        'user': '200/minute',  # authenticated users
    },
}

class PostUpdateView(APIView):
    permission_classes = [IsOwnerOrAdmin]

    def put(self, request, pk):
        post = get_object_or_404(Post, pk=pk)
        self.check_object_permissions(request, post)  # ← triggers IsOwnerOrAdmin
        serializer = PostSerializer(post, data=request.data, partial=True)
        if serializer.is_valid():
            serializer.save()
        return Response(serializer.data)

# ── HTTPS ──────────────────────────────────────────
SECURE_SSL_REDIRECT         = True
SECURE_HSTS_SECONDS         = 31536000     # 1 year HSTS
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_PRELOAD         = True
SESSION_COOKIE_SECURE       = True
CSRF_COOKIE_SECURE          = True

# ── Security headers ──────────────────────────────
SECURE_CONTENT_TYPE_NOSNIFF = True
SECURE_BROWSER_XSS_FILTER   = True
X_FRAME_OPTIONS             = 'DENY'

# ── CORS (if using a separate frontend) ───────────
# pip install django-cors-headers
CORS_ALLOWED_ORIGINS = ['https://yourdomain.com']
CORS_ALLOW_CREDENTIALS = True  # only if using cookie auth

# ── Debug must be OFF in production ───────────────
DEBUG = False
ALLOWED_HOSTS = ['yourdomain.com']

import logging
logger = logging.getLogger('security')

class MyTokenView(TokenObtainPairView):
    def post(self, request, *args, **kwargs):
        response = super().post(request, *args, **kwargs)
        if response.status_code == 200:
            logger.info("LOGIN_SUCCESS user=%s ip=%s",
                request.data.get('username'),
                request.META.get('REMOTE_ADDR'))
        else:
            logger.warning("LOGIN_FAILED user=%s ip=%s",
                request.data.get('username'),
                request.META.get('REMOTE_ADDR'))
        return response