Markov
2f1778c821
Some checks failed
Deploy Web Client / deploy (push) Has been cancelled
- BFF on port 8200: auth + proxy to tracker - All /api/* routes go through BFF - WebSocket proxy with JWT auth - Tracker no longer exposed to internet - Logging on all requests - Removed Next.js API routes for auth (BFF handles it)
40 lines
1.0 KiB
Python
40 lines
1.0 KiB
Python
"""JWT auth for web users."""
|
|
|
|
import time
|
|
from typing import Optional
|
|
|
|
import jwt
|
|
from fastapi import Depends, HTTPException, Request
|
|
|
|
from config import JWT_SECRET, JWT_ALGORITHM
|
|
|
|
TOKEN_EXPIRY = 7 * 24 * 3600 # 7 days
|
|
|
|
|
|
def create_token(username: str, provider: str = "local") -> str:
|
|
payload = {
|
|
"sub": username,
|
|
"name": username,
|
|
"provider": provider,
|
|
"iat": int(time.time()),
|
|
"exp": int(time.time()) + TOKEN_EXPIRY,
|
|
}
|
|
return jwt.encode(payload, JWT_SECRET, algorithm=JWT_ALGORITHM)
|
|
|
|
|
|
def verify_token(token: str) -> Optional[dict]:
|
|
try:
|
|
return jwt.decode(token, JWT_SECRET, algorithms=[JWT_ALGORITHM])
|
|
except jwt.PyJWTError:
|
|
return None
|
|
|
|
|
|
def get_current_user(request: Request) -> dict:
|
|
auth = request.headers.get("authorization", "")
|
|
if not auth.startswith("Bearer "):
|
|
raise HTTPException(401, "Not authenticated")
|
|
payload = verify_token(auth[7:])
|
|
if not payload:
|
|
raise HTTPException(401, "Invalid token")
|
|
return payload
|