Spaces:
Sleeping
Sleeping
| """Password hashing and JWT helpers for authentication. | |
| Pure functions — no FastAPI imports — so they stay unit-testable. bcrypt for | |
| password storage (via passlib), PyJWT for short-lived HS256 access tokens. | |
| """ | |
| from datetime import datetime, timedelta, timezone | |
| from typing import Optional | |
| import jwt | |
| from passlib.context import CryptContext | |
| from . import config | |
| _pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto") | |
| # A throwaway hash to verify against when a login email is unknown, so that the | |
| # "no such user" path costs roughly the same time as "wrong password" (this | |
| # blunts user-enumeration via timing). | |
| _DUMMY_HASH = _pwd_context.hash("dummy-password-for-constant-time-compare") | |
| def hash_password(password: str) -> str: | |
| return _pwd_context.hash(password) | |
| def verify_password(password: str, password_hash: Optional[str]) -> bool: | |
| """Verify a password against a stored hash. When no hash is given (unknown | |
| user) we still run a compare against a dummy hash and return False, keeping | |
| timing roughly constant.""" | |
| if password_hash is None: | |
| _pwd_context.verify(password, _DUMMY_HASH) | |
| return False | |
| return _pwd_context.verify(password, password_hash) | |
| def create_access_token(subject: str, expires_minutes: Optional[int] = None) -> str: | |
| minutes = expires_minutes or config.ACCESS_TOKEN_EXPIRE_MINUTES | |
| now = datetime.now(timezone.utc) | |
| payload = { | |
| "sub": subject, | |
| "type": "access", # so a future token kind can't be replayed as an access token | |
| "iat": now, | |
| "exp": now + timedelta(minutes=minutes), | |
| } | |
| return jwt.encode(payload, config.AUTH_SECRET_KEY, algorithm=config.AUTH_ALGORITHM) | |
| def decode_token(token: str) -> dict: | |
| """Decode and validate a JWT. Raises jwt.PyJWTError on any problem.""" | |
| return jwt.decode(token, config.AUTH_SECRET_KEY, algorithms=[config.AUTH_ALGORITHM]) | |