Spaces:
Running
Running
File size: 2,236 Bytes
bcaf4d8 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 | """Authentication dependencies for FastAPI routes."""
from dataclasses import dataclass
from typing import Optional
from fastapi import Depends, HTTPException, status
from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
from jose import JWTError, jwt
from app.core.config import settings
security = HTTPBearer(auto_error=False)
@dataclass
class AuthenticatedUser:
"""Authenticated user extracted from JWT token."""
google_id: str
email: str
name: str
picture: Optional[str] = None
def _decode_token(token: str) -> dict:
"""Decode and validate a JWT token."""
try:
payload = jwt.decode(
token,
settings.nextauth_secret,
algorithms=["HS256"],
)
return payload
except JWTError:
raise HTTPException(
status_code=status.HTTP_401_UNAUTHORIZED,
detail="Invalid or expired token",
headers={"WWW-Authenticate": "Bearer"},
)
async def get_current_user(
credentials: HTTPAuthorizationCredentials = Depends(security),
) -> AuthenticatedUser:
"""Require a valid JWT and return the authenticated user."""
if credentials is None:
raise HTTPException(
status_code=status.HTTP_401_UNAUTHORIZED,
detail="Authentication required",
headers={"WWW-Authenticate": "Bearer"},
)
payload = _decode_token(credentials.credentials)
return AuthenticatedUser(
google_id=payload.get("sub", ""),
email=payload.get("email", ""),
name=payload.get("name", ""),
picture=payload.get("picture"),
)
async def get_optional_user(
credentials: Optional[HTTPAuthorizationCredentials] = Depends(security),
) -> Optional[AuthenticatedUser]:
"""Return authenticated user if token is present, otherwise None."""
if credentials is None:
return None
try:
payload = _decode_token(credentials.credentials)
return AuthenticatedUser(
google_id=payload.get("sub", ""),
email=payload.get("email", ""),
name=payload.get("name", ""),
picture=payload.get("picture"),
)
except HTTPException:
return None
|