api authentication yea

backend/muzak/auth.py

@@ -0,0 +1,23 @@
+from rest_framework.authentication import BaseAuthentication
+from rest_framework.exceptions import AuthenticationFailed
+from mozilla_django_oidc.auth import OIDCAuthenticationBackend
+from django.contrib.auth.models import User
+
+class OIDCBearerTokenAuthentication(BaseAuthentication):
+    def authenticate(self, request):
+        auth = request.META.get('HTTP_AUTHORIZATION', '')
+        if not auth.startswith('Bearer '):
+            return None
+        token = auth.split(' ')[1]
+
+        backend = OIDCAuthenticationBackend()
+
+        try:
+            claims = backend.verify_token(token)
+        except Exception as e:
+            raise AuthenticationFailed(f'Invalid token: {e}')
+
+        user = backend.filter_users_by_claims(claims).first()
+        if not user:
+            raise AuthenticationFailed(f'Unknown user: {claims}')
+        return (user, None)

backend/muzak/settings.py

@@ -88,6 +88,7 @@ AUTHENTICATION_BACKENDS = (
 
 REST_FRAMEWORK = {
     'DEFAULT_AUTHENTICATION_CLASSES': [
+        'muzak.auth.OIDCBearerTokenAuthentication',
         'mozilla_django_oidc.contrib.drf.OIDCAuthentication',
         'rest_framework.authentication.SessionAuthentication',
     ],
@@ -101,6 +102,8 @@ OIDC_RP_CLIENT_SECRET = os.getenv('OIDC_RP_CLIENT_SECRET')
 OIDC_OP_AUTHORIZATION_ENDPOINT = os.getenv('OIDC_OP_AUTHORIZATION_ENDPOINT')
 OIDC_OP_TOKEN_ENDPOINT = os.getenv('OIDC_OP_TOKEN_ENDPOINT')
 OIDC_OP_USER_ENDPOINT = os.getenv('OIDC_OP_USER_ENDPOINT')
+OIDC_RP_SIGN_ALGO = os.getenv('OIDC_RP_SIGN_ALGO')
+OIDC_OP_JWKS_ENDPOINT = os.getenv('OIDC_OP_JWKS_ENDPOINT')
 LOGIN_REDIRECT_URL = "/"
 LOGOUT_REDIRECT_URL = "/"
 LOGIN_URL = "/"