Spaces:
Sleeping
Sleeping
File size: 5,826 Bytes
2a1425b 4b4f221 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 | import os
from datetime import datetime, timedelta
from typing import Optional
import jwt
from fastapi import HTTPException, status, Request
from ..config.settings import settings
from ..utils.logging_config import get_logger
logger = get_logger(__name__)
def verify_token(token: str) -> dict:
"""
Verify JWT token and return decoded payload.
Args:
token (str): JWT token to verify
Returns:
dict: Decoded token payload
Raises:
HTTPException: If token is invalid, expired, or malformed
"""
logger.debug("Verifying JWT token")
try:
# Decode the token using the secret key
payload = jwt.decode(
token,
settings.SECRET_KEY,
algorithms=[settings.ALGORITHM]
)
# Extract user information from payload
user_id = payload.get("sub")
exp = payload.get("exp")
if user_id is None:
logger.error("Token verification failed: Missing user ID in payload")
raise HTTPException(
status_code=status.HTTP_401_UNAUTHORIZED,
detail="Could not validate credentials: Missing user ID"
)
if exp is None:
logger.error("Token verification failed: Missing expiration in payload")
raise HTTPException(
status_code=status.HTTP_401_UNAUTHORIZED,
detail="Could not validate credentials: Missing expiration"
)
# Check if token is expired
if datetime.fromtimestamp(exp) < datetime.now():
logger.warning("Token verification failed: Token has expired")
raise HTTPException(
status_code=status.HTTP_401_UNAUTHORIZED,
detail="Token has expired"
)
logger.debug(f"Token verified successfully for user: {user_id}")
return payload
except jwt.ExpiredSignatureError:
logger.warning("Token verification failed: Token has expired")
raise HTTPException(
status_code=status.HTTP_401_UNAUTHORIZED,
detail="Token has expired"
)
except jwt.JWTError as e:
logger.error(f"Token verification failed: JWT error - {str(e)}")
raise HTTPException(
status_code=status.HTTP_401_UNAUTHORIZED,
detail="Could not validate credentials"
)
except Exception as e:
logger.error(f"Token verification failed: Authentication error - {str(e)}")
raise HTTPException(
status_code=status.HTTP_401_UNAUTHORIZED,
detail=f"Authentication error: {str(e)}"
)
async def get_current_user(request: Request) -> str:
"""
Extract and verify user from JWT token in request headers.
Args:
request (Request): FastAPI request object containing Authorization header
Returns:
str: User ID extracted from token
Raises:
HTTPException: If no token provided or token is invalid
"""
logger.debug("Extracting and verifying user from JWT token in request")
# Get authorization header
authorization = request.headers.get("Authorization")
if not authorization:
logger.warning("Authorization header missing in request")
raise HTTPException(
status_code=status.HTTP_401_UNAUTHORIZED,
detail="Authorization header missing"
)
# Check if it's a Bearer token
if not authorization.startswith("Bearer "):
logger.warning("Invalid authorization header format in request")
raise HTTPException(
status_code=status.HTTP_401_UNAUTHORIZED,
detail="Invalid authorization header format. Expected 'Bearer <token>'"
)
# Extract token
token = authorization.split(" ")[1]
# Verify token and get payload
payload = verify_token(token)
# Return user ID
user_id = payload.get("sub")
logger.debug(f"Current user extracted from token: {user_id}")
return user_id
def create_access_token(data: dict, expires_delta: Optional[timedelta] = None) -> str:
"""
Create a new access token with the provided data.
Args:
data (dict): Data to encode in the token
expires_delta (timedelta, optional): Token expiration time delta
Returns:
str: Encoded JWT token
"""
logger.debug(f"Creating access token for data: {data}")
to_encode = data.copy()
# Set expiration
if expires_delta:
expire = datetime.now() + expires_delta
else:
expire = datetime.now() + timedelta(minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES)
to_encode.update({"exp": expire.timestamp()})
logger.debug(f"Token will expire at: {expire}")
# Encode the token
encoded_jwt = jwt.encode(
to_encode,
settings.SECRET_KEY,
algorithm=settings.ALGORITHM
)
logger.info(f"Access token created successfully")
return encoded_jwt
def extract_user_id_from_token(token: str) -> str:
"""
Extract user ID from JWT token without full verification (for logging/debugging).
Args:
token (str): JWT token to extract user ID from
Returns:
str: User ID if found, None otherwise
"""
logger.debug("Extracting user ID from token without full verification")
try:
# Decode without verification to get user ID
payload = jwt.decode(
token,
settings.SECRET_KEY,
algorithms=[settings.ALGORITHM],
options={"verify_signature": False, "verify_exp": False}
)
user_id = payload.get("sub")
logger.debug(f"User ID extracted from token: {user_id}")
return user_id
except jwt.InvalidTokenError:
logger.debug("Failed to extract user ID from token: Invalid token")
return None |