Revamp authentication routes structure (#201)

* Fix #68: use makefun to generate dynamic dependencies

* Remove every Starlette imports

* Split every routers and remove event handlers

* Make users router optional

* Pass after_update handler to get_users_router

* Update documentation

* Remove test file

* Write migration doc for splitted routers

fastapi_users/authentication/cookie.py

@@ -1,14 +1,17 @@
 from typing import Any, Optional
 
+import jwt
+from fastapi import Response
 from fastapi.security import APIKeyCookie
-from starlette.requests import Request
-from starlette.responses import Response
+from pydantic import UUID4
 
-from fastapi_users.authentication.jwt import JWTAuthentication
+from fastapi_users.authentication import BaseAuthentication
+from fastapi_users.db.base import BaseUserDatabase
 from fastapi_users.models import BaseUserDB
+from fastapi_users.utils import JWT_ALGORITHM, generate_jwt
 
 
-class CookieAuthentication(JWTAuthentication):
+class CookieAuthentication(BaseAuthentication[str]):
     """
     Authentication backend using a cookie.
 
@@ -24,6 +27,9 @@ class CookieAuthentication(JWTAuthentication):
     :param name: Name of the backend. It will be used to name the login route.
     """
 
+    scheme: APIKeyCookie
+    token_audience: str = "fastapi-users:auth"
+    secret: str
     lifetime_seconds: int
     cookie_name: str
     cookie_path: str
@@ -42,14 +48,40 @@ class CookieAuthentication(JWTAuthentication):
         cookie_httponly: bool = True,
         name: str = "cookie",
     ):
-        super().__init__(secret, lifetime_seconds, name=name)
+        super().__init__(name, logout=True)
+        self.secret = secret
         self.lifetime_seconds = lifetime_seconds
         self.cookie_name = cookie_name
         self.cookie_path = cookie_path
         self.cookie_domain = cookie_domain
         self.cookie_secure = cookie_secure
         self.cookie_httponly = cookie_httponly
-        self.api_key_cookie = APIKeyCookie(name=self.cookie_name, auto_error=False)
+        self.scheme = APIKeyCookie(name=self.cookie_name, auto_error=False)
+
+    async def __call__(
+        self, credentials: Optional[str], user_db: BaseUserDatabase,
+    ) -> Optional[BaseUserDB]:
+        if credentials is None:
+            return None
+
+        try:
+            data = jwt.decode(
+                credentials,
+                self.secret,
+                audience=self.token_audience,
+                algorithms=[JWT_ALGORITHM],
+            )
+            user_id = data.get("user_id")
+            if user_id is None:
+                return None
+        except jwt.PyJWTError:
+            return None
+
+        try:
+            user_uiid = UUID4(user_id)
+            return await user_db.get(user_uiid)
+        except ValueError:
+            return None
 
     async def get_login_response(self, user: BaseUserDB, response: Response) -> Any:
         token = await self._generate_token(user)
@@ -72,5 +104,6 @@ class CookieAuthentication(JWTAuthentication):
             self.cookie_name, path=self.cookie_path, domain=self.cookie_domain
         )
 
-    async def _retrieve_token(self, request: Request) -> Optional[str]:
-        return await self.api_key_cookie.__call__(request)
+    async def _generate_token(self, user: BaseUserDB) -> str:
+        data = {"user_id": str(user.id), "aud": self.token_audience}
+        return generate_jwt(data, self.lifetime_seconds, self.secret, JWT_ALGORITHM)