Fix addressing issue #2005 including tests

gns3server/api/routes/controller/__init__.py

@@ -171,11 +171,13 @@ router.include_router(
 router.include_router(
     _llm_router,
     prefix="/access",
+    dependencies=[Depends(get_current_active_user)],
     tags=["LLM Model Configurations"]
 )
 
 router.include_router(
     _chat_router,
     prefix="/projects/{project_id}/chat",
+    dependencies=[Depends(get_current_active_user)],
     tags=["Chat"]
 )

gns3server/api/routes/controller/dependencies/authentication.py

@@ -47,14 +47,20 @@ async def get_user_from_token(
             headers={"WWW-Authenticate": "Bearer"},
         )
 
-    username = auth_service.get_username_from_token(token)
-    user = await user_repo.get_user_by_username(username)
+    token_data = auth_service.get_token_data(token)
+    user = await user_repo.get_user_by_username(token_data.username)
     if user is None:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="Could not validate credentials",
             headers={"WWW-Authenticate": "Bearer"},
         )
+    if token_data.token_version != user.token_version:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Token has been revoked",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
     return user
 
 
@@ -87,13 +93,18 @@ async def get_current_active_user_from_websocket(
     await websocket.accept()
 
     try:
-        username = auth_service.get_username_from_token(token)
-        user = await user_repo.get_user_by_username(username)
+        token_data = auth_service.get_token_data(token)
+        user = await user_repo.get_user_by_username(token_data.username)
 
         if user is None:
             raise HTTPException(
                 status_code=status.HTTP_401_UNAUTHORIZED,
-                detail=f"Could not validate credentials for '{username}'"
+                detail=f"Could not validate credentials for '{token_data.username}'"
+            )
+        if token_data.token_version != user.token_version:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail=f"Token has been revoked for '{token_data.username}'"
             )
 
         # Super admin is always authorized

gns3server/api/routes/controller/users.py

@@ -65,7 +65,10 @@ async def login(
             headers={"WWW-Authenticate": "Bearer"},
         )
 
-    token = schemas.Token(access_token=auth_service.create_access_token(user.username), token_type="bearer")
+    token = schemas.Token(
+        access_token=auth_service.create_access_token(user.username, token_version=user.token_version),
+        token_type="bearer"
+    )
     return token
 
 
@@ -87,10 +90,25 @@ async def authenticate(
             headers={"WWW-Authenticate": "Bearer"},
         )
 
-    token = schemas.Token(access_token=auth_service.create_access_token(user.username), token_type="bearer")
+    token = schemas.Token(
+        access_token=auth_service.create_access_token(user.username, token_version=user.token_version),
+        token_type="bearer"
+    )
     return token
 
 
+@router.post("/logout", status_code=status.HTTP_204_NO_CONTENT)
+async def logout(
+        current_user: schemas.User = Depends(get_current_active_user),
+        users_repo: UsersRepository = Depends(get_repository(UsersRepository)),
+) -> None:
+    """
+    Logout the current user by revoking all existing tokens.
+    """
+
+    await users_repo.logout_user(current_user.user_id)
+
+
 @router.get("/me", response_model=schemas.User)
 async def get_logged_in_user(current_user: schemas.User = Depends(get_current_active_user)) -> schemas.User:
     """