File size: 8,909 Bytes
eca5751 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 | """
JWT Tool - Decode / Encode / Verify JSON Web Tokens.
===========================================
Tool thao tác JWT: decode payload, encode token, verify chữ ký.
Author: Hieu Louis (2026)
"""
from __future__ import annotations
import base64
import json
import hmac
import hashlib
import time
from typing import Any, Dict, Optional
from .base import Tool, ToolResult, ToolContext, ToolCategory, ToolSafety
def _b64url_decode(seg: str) -> bytes:
"""Giải mã base64url (thêm padding nếu thiếu). / Decode base64url with padding fix."""
pad = "=" * (-len(seg) % 4)
return base64.urlsafe_b64decode(seg + pad)
def _b64url_encode(raw: bytes) -> str:
"""Mã hóa base64url (bỏ padding). / Encode bytes to base64url without padding."""
return base64.urlsafe_b64encode(raw).rstrip(b"=").decode("ascii")
# Algorithms được hỗ trợ cho HMAC (không cần lib ngoài). / HMAC algorithms supported w/o external deps.
_HMAC_ALGS: Dict[str, str] = {
"HS256": "sha256",
"HS384": "sha384",
"HS512": "sha512",
}
class JWTTool(Tool):
"""Decode / Encode / Verify JWT (HS256/384/512 + RS256 via PyJWT)."""
category = ToolCategory.CRYPTO
safety = ToolSafety.SAFE
@property
def name(self) -> str:
return "jwt"
@property
def description(self) -> str:
return "Decode / encode / verify JWT tokens. Hỗ trợ HS256/384/512 (stdlib) + RS256 (PyJWT)."
@property
def parameters(self) -> Dict[str, Any]:
return {
"type": "object",
"properties": {
"token": {"type": "string", "description": "JWT token (cho decode/verify)"},
"action": {
"type": "string",
"enum": ["decode", "encode", "verify"],
"default": "decode",
},
"secret": {"type": "string", "description": "Secret key (cho HMAC)"},
"algorithm": {
"type": "string",
"enum": ["HS256", "HS384", "HS512", "RS256", "none"],
"default": "HS256",
},
"payload": {
"type": "object",
"description": "Payload dict (cho encode)",
},
},
"required": ["action"],
}
def validate_args(self, args: Dict[str, Any]) -> Optional[str]:
action = args.get("action", "decode")
if action in ("decode", "verify") and not args.get("token"):
return f"Missing required arg: token (cho action='{action}')"
if action == "encode" and not args.get("payload"):
return "Missing required arg: payload (cho action='encode')"
if action in ("encode", "verify") and not args.get("secret") and args.get("algorithm", "HS256") != "none":
return f"Missing required arg: secret (cho action='{action}')"
return None
# ---- Hành động chính / Main actions ---------------------------------
def _decode(self, token: str) -> ToolResult:
"""Decode JWT mà không cần verify chữ ký (fallback thủ công)."""
try:
import jwt # type: ignore
unverified = jwt.decode(token, options={"verify_signature": False})
header = jwt.get_unverified_header(token)
return ToolResult(
success=True,
output=json.dumps({"header": header, "payload": unverified}, ensure_ascii=False, indent=2),
metadata={"header": header, "payload": unverified, "verified": False},
)
except ImportError:
pass
except Exception:
# Nếu PyJWT raise lỗi thì fallback về parse thủ công / fall back to manual parse
pass
try:
parts = token.split(".")
if len(parts) < 2:
return ToolResult(success=False, error="Invalid JWT format (cần ít nhất 2 phần)", return_code=1)
header = json.loads(_b64url_decode(parts[0]))
payload = json.loads(_b64url_decode(parts[1]))
return ToolResult(
success=True,
output=json.dumps({"header": header, "payload": payload}, ensure_ascii=False, indent=2),
metadata={"header": header, "payload": payload, "verified": False},
)
except Exception as e:
return ToolResult(success=False, error=f"Decode failed: {e}", return_code=1)
def _encode(self, payload: Dict[str, Any], secret: str, algorithm: str) -> ToolResult:
"""Encode JWT — thử PyJWT trước, fallback HMAC thủ công."""
try:
import jwt # type: ignore
token = jwt.encode(payload, secret, algorithm=algorithm)
return ToolResult(
success=True,
output=token,
metadata={"algorithm": algorithm, "verified": True},
)
except ImportError:
pass
# Fallback HMAC thủ công / Manual HMAC fallback
if algorithm not in _HMAC_ALGS:
return ToolResult(
success=False,
error=f"Algorithm '{algorithm}' cần PyJWT: pip install PyJWT",
return_code=1,
)
header = {"alg": algorithm, "typ": "JWT"}
h_b64 = _b64url_encode(json.dumps(header, separators=(",", ":"), sort_keys=True).encode())
p_b64 = _b64url_encode(json.dumps(payload, separators=(",", ":"), sort_keys=True).encode())
signing_input = f"{h_b64}.{p_b64}".encode("ascii")
sig = hmac.new(secret.encode(), signing_input, getattr(hashlib, _HMAC_ALGS[algorithm])).digest()
token = f"{h_b64}.{p_b64}.{_b64url_encode(sig)}"
return ToolResult(
success=True,
output=token,
metadata={"algorithm": algorithm, "verified": True, "backend": "stdlib-hmac"},
)
def _verify(self, token: str, secret: str, algorithm: str) -> ToolResult:
"""Verify chữ ký JWT."""
try:
import jwt # type: ignore
payload = jwt.decode(token, secret, algorithms=[algorithm])
return ToolResult(
success=True,
output="Signature valid",
metadata={"payload": payload, "verified": True, "backend": "PyJWT"},
)
except ImportError:
pass
except Exception as e:
return ToolResult(success=False, error=f"Verify failed (PyJWT): {e}", return_code=1)
if algorithm not in _HMAC_ALGS:
return ToolResult(
success=False,
error=f"Algorithm '{algorithm}' cần PyJWT: pip install PyJWT",
return_code=1,
)
try:
parts = token.split(".")
if len(parts) != 3:
return ToolResult(success=False, error="Invalid JWT format (cần đúng 3 phần)", return_code=1)
header = json.loads(_b64url_decode(parts[0]))
if header.get("alg") != algorithm:
return ToolResult(
success=False,
error=f"Algorithm mismatch: header={header.get('alg')} expected={algorithm}",
return_code=1,
)
signing_input = f"{parts[0]}.{parts[1]}".encode("ascii")
expected_sig = hmac.new(secret.encode(), signing_input, getattr(hashlib, _HMAC_ALGS[algorithm])).digest()
actual_sig = _b64url_decode(parts[2])
if not hmac.compare_digest(expected_sig, actual_sig):
return ToolResult(success=False, error="Invalid signature", return_code=1)
payload = json.loads(_b64url_decode(parts[1]))
# Kiểm tra exp / check expiry
if isinstance(payload.get("exp"), (int, float)) and payload["exp"] < time.time():
return ToolResult(success=False, error="Token expired", return_code=1)
return ToolResult(
success=True,
output="Signature valid",
metadata={"payload": payload, "verified": True, "backend": "stdlib-hmac"},
)
except Exception as e:
return ToolResult(success=False, error=f"Verify failed: {e}", return_code=1)
def execute(self, args: Dict[str, Any], context: ToolContext) -> ToolResult:
action = args.get("action", "decode")
algorithm = args.get("algorithm", "HS256")
if action == "decode":
return self._decode(args["token"])
if action == "encode":
return self._encode(args["payload"], args.get("secret", ""), algorithm)
if action == "verify":
return self._verify(args["token"], args.get("secret", ""), algorithm)
return ToolResult(success=False, error=f"Unknown action: {action}", return_code=1)
|