JWT Authentication & Rate Limiting System

[RichardCMX]

Overview

Implements a comprehensive JWT-based authentication system and tiered rate limiting protection for all API endpoints, enhancing security and preventing abuse.

Related Issues

Closes #30

Changes Made

🔑 JWT Authentication System

• User Registration (POST /api/auth/register/)
  • Password confirmation validation
  • Automatic JWT token generation on registration
  • User profile data in response
• User Login (POST /api/auth/login/)
  • Access token (1-hour lifetime) and refresh token (7-day lifetime)
  • Token rotation with blacklisting for security
  • User data included in response
• Token Refresh (POST /api/auth/refresh/)
  • Seamless token renewal without re-authentication
  • Rotating refresh tokens with blacklisting
• User Profile (GET /api/auth/profile/)
  • JWT-authenticated access to user information
  • Proper 401 responses for unauthorized access

🛡️ Rate Limiting Protection

Tiered rate limiting strategy across all API endpoints:

• Public Light endpoints (health, ready): 100 requests/minute
• Public Medium endpoints (arrivals, schedule): 60 requests/minute
• Public Heavy endpoints (search): 30 requests/minute
• Auth Sensitive operations (login): 5 requests/minute
• Auth Registration: 3 requests/minute
• Auth General operations (profile): 20 requests/minute

Features:

• IP-based rate limiting using django-ratelimit
• Detailed 429 error responses with retry information
• Configurable via environment variables
• Can be disabled for development/testing (RATELIMIT_ENABLE)
• Redis-backed for distributed deployments

📦 Dependencies Added

• djangorestframework-simplejwt==5.3.0 - JWT authentication
• django-ratelimit==4.1.0 - Rate limiting middleware

🧪 Testing

20 comprehensive tests added (100% passing):

• 10 JWT authentication tests (api/tests/test_jwt_auth.py)
  • Registration, login, token refresh, profile access
  • Error handling and validation scenarios
  • Protected vs public endpoint access control
• 10 rate limiting tests (api/tests/test_rate_limiting.py)
  • Rate limit enforcement across all tiers
  • 429 error response validation
  • Configuration and toggle testing
  • Authenticated vs unauthenticated limits

📝 Documentation

• Updated README.md with authentication and rate limiting sections
• Updated CHANGELOG.md with comprehensive feature documentation
• Updated api/tests/README.md with new test documentation
• Added configuration examples and usage guides

Security Enhancements

• ✅ Token rotation prevents replay attacks
• ✅ Blacklisting prevents use of compromised tokens
• ✅ Rate limiting protects against DoS and brute force attacks
• ✅ Intelligent tiered limits based on endpoint sensitivity
• ✅ IP-based tracking prevents circumvention
• ✅ Environment-based configuration prevents secrets in code

Backward Compatibility

• ✅ All existing API endpoints work unchanged
• ✅ Public endpoints remain accessible without authentication
• ✅ Optional authentication can be adopted incrementally
• ✅ Rate limiting can be disabled for development

Testing Results

Found 65 test(s).
Creating test database for alias 'default'...
✓ PostgreSQL extensions installed in test database (postgis, pg_trgm, unaccent)
System check identified no issues (0 silenced).
.................................................................
----------------------------------------------------------------------
Ran 65 tests in 13.239s

OK

Configuration

.env additions:

# JWT Authentication
SECRET_KEY=your-super-secure-secret-key-here

# Rate Limiting
RATELIMIT_ENABLE=true

Usage Examples

# Register new user
curl -X POST "http://localhost:8000/api/auth/register/" \
  -H "Content-Type: application/json" \
  -d '{"username": "newuser", "email": "user@example.com", "password": "secure123", "password_confirm": "secure123"}'

# Login and get tokens
curl -X POST "http://localhost:8000/api/auth/login/" \
  -H "Content-Type: application/json" \
  -d '{"username": "newuser", "password": "secure123"}'

# Access protected endpoint
curl "http://localhost:8000/api/auth/profile/" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN_HERE"

# Refresh token
curl -X POST "http://localhost:8000/api/auth/refresh/" \
  -H "Content-Type: application/json" \
  -d '{"refresh": "YOUR_REFRESH_TOKEN_HERE"}'

Files Modified

• README.md - Authentication and rate limiting documentation
• CHANGELOG.md - Feature documentation
• datahub/settings.py - JWT and rate limiting configuration
• api/auth_views.py - JWT authentication views (new)
• api/rate_limiting.py - Rate limiting utilities (new)
• api/views.py - Rate limiting integration
• api/urls.py - Authentication endpoints
• api/tests/test_jwt_auth.py - JWT tests (new)
• api/tests/test_rate_limiting.py - Rate limiting tests (new)
• api/tests/README.md - Test documentation
• pyproject.toml - Dependencies

Checklist

• Code follows project style guidelines
• Tests added and passing (20 new tests, 65 total)
• Documentation updated (README, CHANGELOG, test docs)
• No breaking changes
• Security best practices followed
• Backward compatible
• Environment configuration documented

Next Steps

After merging, this branch serves as the base for:

• feature/client-management - Client application management
• feature/security-performance - Additional security and performance feature