The class and method for login are similar to those for registration. Let's write it:

@blp.route("/login")
class UserLogin(MethodView):
    @blp.arguments(UserSchema)
    def post(self, user_data):
        user = UserModel.query.filter(
            UserModel.username == user_data["username"]
        ).first()

        if user and pbkdf2_sha256.verify(user_data["password"], user.password):
            access_token = create_access_token(identity=user.id)
            return {"access_token": access_token}, 200

        abort(401, message="Invalid credentials.")

We filter users in the database by username and check if such a user exists and if the password verification for this user passes. If so, we create a JWT access token.

In this method, we return an access token generated using the create_access_token function imported from the flask_jwt_extended library. We add the user ID information to the JWT access token so that when a user returns the JWT to us, we will know which user it belongs to.

If a user with the given username does not exist or the password does not match what is in the table, we return an error.