71 lines
2.5 KiB
Python
71 lines
2.5 KiB
Python
# Copyright 2026 Google LLC
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
from datetime import datetime, timedelta, timezone
|
|
from fastapi import Depends, HTTPException, Security, status
|
|
from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
|
|
from jose import JWTError, jwt
|
|
from app.config import settings
|
|
|
|
security = HTTPBearer(auto_error=False)
|
|
|
|
|
|
def create_access_token(user_id: str, extra_claims: dict | None = None) -> str:
|
|
"""Generate a signed JWT access token."""
|
|
expire = datetime.now(timezone.utc) + timedelta(
|
|
minutes=settings.JWT_ACCESS_TOKEN_EXPIRE_MINUTES
|
|
)
|
|
to_encode = {
|
|
"sub": user_id,
|
|
"exp": expire,
|
|
"iat": datetime.now(timezone.utc),
|
|
"iss": "artemis-backend-manager",
|
|
}
|
|
if extra_claims:
|
|
to_encode.update(extra_claims)
|
|
return jwt.encode(to_encode, settings.JWT_SECRET_KEY, algorithm=settings.JWT_ALGORITHM)
|
|
|
|
|
|
def decode_access_token(token: str) -> dict:
|
|
"""Decode and validate a JWT access token."""
|
|
try:
|
|
payload = jwt.decode(token, settings.JWT_SECRET_KEY, algorithms=[settings.JWT_ALGORITHM])
|
|
return payload
|
|
except JWTError as e:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail=f"Invalid or expired credentials: {str(e)}",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
|
|
|
|
async def get_current_user(
|
|
credentials: HTTPAuthorizationCredentials | None = Security(security),
|
|
) -> str:
|
|
"""FastAPI dependency to extract and verify the current user_id."""
|
|
if not credentials:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Missing Authorization Header",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
payload = decode_access_token(credentials.credentials)
|
|
user_id: str | None = payload.get("sub")
|
|
if not user_id:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Malformed token payload (missing subject)",
|
|
)
|
|
return user_id
|