Felipe Cardoso
548880b468
Updated `decode_token` for stricter validation of token claims and explicit error handling. Added utilities for token revocation and verification, improving
137 lines
4.2 KiB
Python
137 lines
4.2 KiB
Python
from datetime import datetime, timedelta
|
|
from typing import Optional, Tuple
|
|
from uuid import uuid4
|
|
|
|
from black import timezone
|
|
from jose import jwt, ExpiredSignatureError, JWTError
|
|
from passlib.context import CryptContext
|
|
from app.core.config import settings
|
|
from app.schemas.token import TokenPayload, TokenResponse
|
|
|
|
# Configuration
|
|
SECRET_KEY = settings.SECRET_KEY
|
|
ALGORITHM = "HS256"
|
|
ACCESS_TOKEN_EXPIRE_MINUTES = 30
|
|
REFRESH_TOKEN_EXPIRE_DAYS = 7
|
|
|
|
# Password hashing context
|
|
pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
|
|
|
|
|
|
def verify_password(plain_password: str, hashed_password: str) -> bool:
|
|
"""Verify a plain password against its hash."""
|
|
return pwd_context.verify(plain_password, hashed_password)
|
|
|
|
|
|
def get_password_hash(password: str) -> str:
|
|
"""Generate password hash."""
|
|
return pwd_context.hash(password)
|
|
|
|
|
|
def create_tokens(user_id: str) -> TokenResponse:
|
|
"""
|
|
Create both access and refresh tokens for a user.
|
|
|
|
Args:
|
|
user_id: The user's ID
|
|
|
|
Returns:
|
|
TokenResponse containing both tokens and metadata
|
|
"""
|
|
access_token = create_access_token({"sub": user_id})
|
|
refresh_token = create_refresh_token({"sub": user_id})
|
|
|
|
return TokenResponse(
|
|
access_token=access_token,
|
|
refresh_token=refresh_token,
|
|
token_type="bearer",
|
|
expires_in=ACCESS_TOKEN_EXPIRE_MINUTES * 60,
|
|
user_id=user_id
|
|
)
|
|
|
|
|
|
def create_token(
|
|
data: dict,
|
|
expires_delta: Optional[timedelta] = None,
|
|
token_type: str = "access"
|
|
) -> str:
|
|
"""Create a JWT token with the specified type and expiration."""
|
|
to_encode = data.copy()
|
|
|
|
if expires_delta:
|
|
expire = datetime.utcnow() + expires_delta
|
|
else:
|
|
expire = datetime.utcnow() + (
|
|
timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES) if token_type == "access"
|
|
else timedelta(days=REFRESH_TOKEN_EXPIRE_DAYS)
|
|
)
|
|
|
|
to_encode.update({
|
|
"exp": expire,
|
|
"type": token_type,
|
|
"iat": datetime.utcnow(),
|
|
"jti": str(uuid4())
|
|
})
|
|
|
|
return jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)
|
|
|
|
|
|
def decode_token(token: str, required_type: str = "access") -> TokenPayload:
|
|
"""
|
|
Decode and validate a JWT token with explicit edge-case handling.
|
|
|
|
Args:
|
|
token: The JWT token to decode.
|
|
required_type: The expected token type (default: "access").
|
|
|
|
Returns:
|
|
TokenPayload containing the decoded data.
|
|
|
|
Raises:
|
|
JWTError: If the token is expired, invalid, or malformed.
|
|
"""
|
|
try:
|
|
payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
|
|
|
|
# Explicitly validate required claims (`exp`, `sub`, `type`)
|
|
if "exp" not in payload or "sub" not in payload or "type" not in payload:
|
|
raise KeyError("Missing required claim.")
|
|
|
|
# Verify token expiration (`exp`)
|
|
if datetime.now() > datetime.fromtimestamp(payload["exp"]):
|
|
raise ExpiredSignatureError("Token has expired.")
|
|
|
|
# Verify token type (`type`)
|
|
if payload["type"] != required_type:
|
|
expected_type = required_type
|
|
actual_type = payload["type"]
|
|
raise JWTError(f"Invalid token type: expected '{expected_type}', got '{actual_type}'.")
|
|
|
|
# Create TokenPayload object from token claims
|
|
return TokenPayload(
|
|
sub=payload["sub"],
|
|
type=payload["type"],
|
|
exp=datetime.fromtimestamp(payload["exp"]),
|
|
iat=datetime.fromtimestamp(payload.get("iat", 0)),
|
|
jti=payload.get("jti")
|
|
)
|
|
|
|
except KeyError as e:
|
|
raise JWTError("Malformed token. Missing required claim.") from e
|
|
except ExpiredSignatureError as e:
|
|
raise JWTError("Token expired. Please refresh your token to continue.") from e
|
|
except JWTError as e:
|
|
raise JWTError(str(e)) from e
|
|
|
|
|
|
|
|
|
|
def create_access_token(data: dict, expires_delta: Optional[timedelta] = None) -> str:
|
|
"""Create a new access token."""
|
|
return create_token(data, expires_delta, "access")
|
|
|
|
|
|
def create_refresh_token(data: dict, expires_delta: Optional[timedelta] = None) -> str:
|
|
"""Create a new refresh token."""
|
|
return create_token(data, expires_delta, "refresh")
|