50 lines
1.5 KiB
Python
50 lines
1.5 KiB
Python
"""JWT 安全配置"""
|
|
from datetime import datetime, timedelta
|
|
|
|
import jwt as pyjwt
|
|
from jose import JWTError, jwt as jose_jwt
|
|
from app.core.config import settings
|
|
|
|
ALGORITHM = "HS256"
|
|
ACCESS_TOKEN_EXPIRE_MINUTES = 60 * 24 # 24小时
|
|
|
|
|
|
def create_access_token(data: dict):
|
|
to_encode = data.copy()
|
|
expire = datetime.utcnow() + timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
|
|
to_encode.update({"exp": expire})
|
|
return jose_jwt.encode(to_encode, settings.SECRET_KEY, algorithm=ALGORITHM)
|
|
|
|
|
|
def verify_token(token: str):
|
|
try:
|
|
payload = jose_jwt.decode(token, settings.SECRET_KEY, algorithms=[ALGORITHM])
|
|
return payload
|
|
except JWTError:
|
|
return None
|
|
|
|
|
|
def verify_casdoor_token(token: str) -> dict:
|
|
"""Verify a Casdoor-issued JWT before using any identity claims."""
|
|
certificate = settings.casdoor_cert_content.strip()
|
|
if not certificate:
|
|
raise ValueError("Casdoor certificate is not configured")
|
|
|
|
issuer = (settings.CASDOOR_ISSUER or settings.CASDOOR_ENDPOINT).rstrip("/")
|
|
if not issuer:
|
|
raise ValueError("Casdoor issuer is not configured")
|
|
|
|
header = pyjwt.get_unverified_header(token)
|
|
algorithm = header.get("alg")
|
|
if algorithm not in {"RS256", "RS384", "RS512"}:
|
|
raise ValueError("Unsupported Casdoor token algorithm")
|
|
|
|
return pyjwt.decode(
|
|
token,
|
|
certificate,
|
|
algorithms=[algorithm],
|
|
audience=settings.CASDOOR_CLIENT_ID,
|
|
issuer=issuer,
|
|
options={"require": ["exp", "iat", "sub"]},
|
|
)
|