Autenticação (JWT)

Resumo

Item	Valor
Obter par de tokens	POST /api/v1/auth/token/
Renovar access	POST /api/v1/auth/token/refresh/
Header nas rotas protegidas	Authorization: Bearer <access>
Validade access	60 minutos
Validade refresh	1 dia
Prefixo do esquema	Bearer (AUTH_HEADER_TYPES)
Verify endpoint	Não registado

Bases de URL:

# Local
export BASE_URL="http://localhost:8000"

# Homologação
export BASE_URL="https://tools-hml.scielo.org"

---

Obter access + refresh

curl (JSON)

curl -s -X POST "${BASE_URL}/api/v1/auth/token/" \
  -H "Content-Type: application/json" \
  -d '{"username":"SEU_USUARIO","password":"SUA_SENHA"}'

Resposta 200

{
  "access": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "refresh": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

Guardar o access numa variável (bash)

RESP=$(curl -s -X POST "${BASE_URL}/api/v1/auth/token/" \
  -H "Content-Type: application/json" \
  -d '{"username":"SEU_USUARIO","password":"SUA_SENHA"}')

export ACCESS=$(echo "$RESP" | python3 -c 'import sys,json; print(json.load(sys.stdin)["access"])')
export REFRESH=$(echo "$RESP" | python3 -c 'import sys,json; print(json.load(sys.stdin)["refresh"])')

echo "ACCESS length: ${#ACCESS}"

curl com form-urlencoded (também aceite pelo SimpleJWT)

curl -s -X POST "${BASE_URL}/api/v1/auth/token/" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "username=SEU_USUARIO&password=SUA_SENHA"

Erros comuns

Status	Situação
401	Utilizador/senha inválidos
400	Corpo malformado / campos em falta

Exemplo de falha de credenciais (corpo típico SimpleJWT):

{
  "detail": "No active account found with the given credentials"
}

---

Renovar o access token

O refresh não exige o header Authorization. Envie só o refresh no body.

curl -s -X POST "${BASE_URL}/api/v1/auth/token/refresh/" \
  -H "Content-Type: application/json" \
  -d "{\"refresh\":\"${REFRESH}\"}"

Resposta 200

{
  "access": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

Atualize a variável:

ACCESS=$(curl -s -X POST "${BASE_URL}/api/v1/auth/token/refresh/" \
  -H "Content-Type: application/json" \
  -d "{\"refresh\":\"${REFRESH}\"}" \
  | python3 -c 'import sys,json; print(json.load(sys.stdin)["access"])')

Se o refresh expirou (após ~1 dia), volte ao passo 1 (login com username/password).

---

Chamar um endpoint protegido

Todas as rotas sob /api/v1/reference/ exigem autenticação (IsAuthenticated).

curl -s -X GET "${BASE_URL}/api/v1/reference/docx/" \
  -H "Authorization: Bearer ${ACCESS}" \
  -H "Accept: application/json"

Resposta esperada (GET do formulário DOCX): {} com HTTP 200.

Sem token

curl -s -o /dev/null -w "%{http_code}\n" \
  -X POST "${BASE_URL}/api/v1/reference/" \
  -H "Content-Type: application/json" \
  -d '{"references":["Ref A"],"type":"json"}'
# Esperado: 401 ou 403

Token inválido / expirado

curl -s -X POST "${BASE_URL}/api/v1/reference/" \
  -H "Authorization: Bearer token_invalido" \
  -H "Content-Type: application/json" \
  -d '{"references":["Ref A"],"type":"json"}'

Resposta típica:

{
  "detail": "Given token not valid for any token type",
  "code": "token_not_valid",
  "messages": [ ... ]
}

Nesse caso: refresh ou novo token/.

---

Fluxo completo num script shell

#!/usr/bin/env bash
set -euo pipefail

BASE_URL="${BASE_URL:-https://tools-hml.scielo.org}"
USER="${JWT_USERNAME:?defina JWT_USERNAME}"
PASS="${JWT_PASSWORD:?defina JWT_PASSWORD}"

TOKENS=$(curl -s -X POST "${BASE_URL}/api/v1/auth/token/" \
  -H "Content-Type: application/json" \
  -d "{\"username\":\"${USER}\",\"password\":\"${PASS}\"}")

ACCESS=$(echo "$TOKENS" | python3 -c 'import sys,json; print(json.load(sys.stdin)["access"])')

curl -s -X POST "${BASE_URL}/api/v1/reference/" \
  -H "Authorization: Bearer ${ACCESS}" \
  -H "Content-Type: application/json" \
  -d '{
    "references": [
      "Smith J. Example title. Nature. 2024;600:1-10."
    ],
    "type": "json"
  }' | python3 -m json.tool

---

Sessão Wagtail (Browsable API)

Útil para testes manuais no browser, sem montar JWT:

1. Abra ${BASE_URL}/admin/ e autentique-se.
2. Na mesma sessão do browser, abra:
   • ${BASE_URL}/api/v1/reference/
   • ${BASE_URL}/api/v1/reference/docx/
3. Use o formulário HTML do DRF (campos references + type, ou file + type).

Para curl com sessão seria necessário cookie CSRF + sessionid; o caminho recomendado para scripts é sempre JWT.

---