NuklearRabbit
03c5b60235
Demo auth, seed import/reset, dashboard, vehicle/booking list+detail, audit trail. Backend: 19 tests passing, ruff clean. Frontend: React Router shell, typed API client, responsive pages. Verified end-to-end via curl and browser.
53 lines
1.4 KiB
Python
53 lines
1.4 KiB
Python
from __future__ import annotations
|
|
|
|
import base64
|
|
import hashlib
|
|
import hmac
|
|
import json
|
|
import time
|
|
from dataclasses import dataclass
|
|
|
|
from app.core.config import get_settings
|
|
|
|
settings = get_settings()
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class SessionPayload:
|
|
user_id: str
|
|
public_ref: str
|
|
role: str
|
|
display_name: str
|
|
issued_at: int
|
|
|
|
|
|
def _sign(data: bytes) -> str:
|
|
digest = hmac.new(settings.app_secret.encode(), data, hashlib.sha256).digest()
|
|
return base64.urlsafe_b64encode(digest).decode().rstrip("=")
|
|
|
|
|
|
def create_session_token(payload: SessionPayload) -> str:
|
|
body = json.dumps(payload.__dict__, separators=(",", ":")).encode()
|
|
encoded_body = base64.urlsafe_b64encode(body).decode().rstrip("=")
|
|
signature = _sign(encoded_body.encode())
|
|
return f"{encoded_body}.{signature}"
|
|
|
|
|
|
def read_session_token(token: str) -> SessionPayload | None:
|
|
try:
|
|
encoded_body, signature = token.split(".", 1)
|
|
except ValueError:
|
|
return None
|
|
expected = _sign(encoded_body.encode())
|
|
if not hmac.compare_digest(expected, signature):
|
|
return None
|
|
padding = "=" * (-len(encoded_body) % 4)
|
|
try:
|
|
body = json.loads(base64.urlsafe_b64decode(encoded_body + padding))
|
|
except (ValueError, json.JSONDecodeError):
|
|
return None
|
|
payload = SessionPayload(**body)
|
|
if time.time() - payload.issued_at > settings.session_ttl_seconds:
|
|
return None
|
|
return payload
|