from rest_framework.exceptions import AuthenticationFailed
from rest_framework_simplejwt.authentication import JWTAuthentication

from apps.jwt_auth.models import JwtToken
from apps.jwt_auth.session import validate_session_claims


class SessionJWTAuthentication(JWTAuthentication):
    """A signed JWT is usable only while its recorded session remains active."""

    def get_user(self, validated_token):
        user = super().get_user(validated_token)
        session = JwtToken.objects.select_related('cuser_role__role_type', 'cuser_role__sys_ws', 'cuser_role__cuser').filter(
            access=str(validated_token), cuser=user, is_blocked=False,
        ).first()
        if not session:
            raise AuthenticationFailed('نشست شما معتبر نیست. لطفاً دوباره وارد شوید.', code='session_invalid')
        validate_session_claims(session, validated_token)
        return user