[BB-1718] Implement JWT token refreshing

[Agrendalath]

This implements JWT token refreshing. Access tokens will be valid for shorter (JWT_ACCESS_TOKEN_LIFETIME_HOURS) time and refresh tokens will be used to regenerate them. The refresh tokens are rotating, so we won't need to log in anymore as long as we visit the page once per JWT_REFRESH_TOKEN_LIFETIME_DAYS days.

I added one new line to envs on the ticket: JWT_ACCESS_TOKEN_LIFETIME_HOURS=0.0004. This will make access tokens last for less than 2 seconds, which will be enough for making singular requests and will speed up the testing.

Testing instructions:

1. Set .env file (you can find it in a comment on the ticket).
2. Start the backend with docker-compose -f local.yml up --build (build is important here; it will take a while, because our first layer of the Dockerfile has changed).
3. Run migrations with docker-compose -f local.yml exec django python manage.py migrate.
4. Create frontend/.env.local and set REACT_APP_GOOGLE_CLIENT_ID there.
5. Optional (this will speed up testing, as the accounts' rework is not merged into the master yet): remove lines 82 and 83 from frontent/src/App.js.
6. Navigate to frontend and run npm i && npm start.
7. Open "Network" tab in developer tools.
8. Log in.
9. Refresh the page and see that user/ returned 401, was followed by refresh/, which returned 200, which was then followed by user/ returning 200.
10. Click on the cell's name and observe the same pattern for ?board_id=<id> endpoint.

[xitij2000]

👍

• I tested this: followed testing instructions in PR
• I read through the code

[xitij2000]

Could you pin this to a commit id please?
Why was this fork necessary?

[Agrendalath]

Could you pin this to a commit id please?

Sure, that makes sense 👍

Why was this fork necessary?

The implementation of JWT used by django-rest-auth is no longer maintained . There is a fork of the django-rest-auth repository that adds SimpleJWT support (which has the token refreshing fixed).
I forked this to our GH organization, because forks tend to go missing sometimes and a couple year ago I had this exact problem with disappearing Python library (django-pagination), to which there were no mirrors at the point. So I just did this to keep it safe.