Bug: Valid Refresh Tokens despite user changing password

Fixes anitab-org#903

Author: tichnas

app/api/resources/user.py

@@ -408,8 +408,13 @@ def post(cls):
         The return value is an access token and the expiry timestamp.
         The token is valid for 1 week.
         """
-        user_id = get_jwt_identity()
-        access_token = create_access_token(identity=user_id)
+        req_user = get_jwt_identity()
+        user = DAO.get_user(req_user["id"])
+
+        if user.password_hash != req_user["password"]:
+            return messages.TOKEN_IS_INVALID, HTTPStatus.UNAUTHORIZED
+
+        access_token = create_access_token(identity=req_user["id"])
 
         from run import application
 
@@ -472,7 +477,9 @@ def post(cls):
             )
 
         access_token = create_access_token(identity=user.id)
-        refresh_token = create_refresh_token(identity=user.id)
+        refresh_token = create_refresh_token(
+            identity={"id": user.id, "password": user.password_hash}
+        )
 
         from run import application
 

tests/users/test_api_refresh.py

@@ -31,7 +31,10 @@ def setUp(self):
 
     def test_user_refresh(self):
         with self.client:
-            refresh_header = get_test_request_header(user1["username"], refresh=True)
+            refresh_header = get_test_request_header(
+                {"id": self.first_user.id, "password": self.first_user.password_hash},
+                refresh=True,
+            )
             response = self.client.post(
                 "/refresh",
                 headers=refresh_header,