134 lines
4.5 KiB
Python
134 lines
4.5 KiB
Python
"""JWT-based authentication with config-file user management."""
|
|
|
|
import os
|
|
import logging
|
|
import secrets
|
|
from datetime import datetime, timedelta, timezone
|
|
from pathlib import Path
|
|
|
|
import bcrypt
|
|
import jwt
|
|
from dotenv import load_dotenv
|
|
from fastapi import Depends, HTTPException, status
|
|
from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
|
|
|
|
# ── Config ────────────────────────────────────────────
|
|
|
|
PROJECT_ROOT = Path(__file__).parent.parent
|
|
load_dotenv(PROJECT_ROOT / ".env")
|
|
|
|
|
|
def _load_jwt_secret() -> str:
|
|
configured = os.getenv("JWT_SECRET_KEY")
|
|
if configured:
|
|
return configured
|
|
|
|
secret_path = Path(
|
|
os.getenv("JWT_SECRET_FILE", str(PROJECT_ROOT / "config" / ".jwt-secret"))
|
|
)
|
|
try:
|
|
secret = secret_path.read_text(encoding="utf-8").strip()
|
|
if secret:
|
|
return secret
|
|
except FileNotFoundError:
|
|
pass
|
|
|
|
secret = secrets.token_urlsafe(48)
|
|
try:
|
|
descriptor = os.open(secret_path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
|
|
except FileExistsError:
|
|
secret = secret_path.read_text(encoding="utf-8").strip()
|
|
if secret:
|
|
return secret
|
|
raise RuntimeError(f"JWT secret file is empty: {secret_path}")
|
|
except OSError as exc:
|
|
raise RuntimeError(
|
|
"Set JWT_SECRET_KEY because the JWT secret file could not be created: "
|
|
f"{secret_path}"
|
|
) from exc
|
|
|
|
with os.fdopen(descriptor, "w", encoding="utf-8") as secret_file:
|
|
secret_file.write(secret)
|
|
logging.getLogger(__name__).warning("Created JWT secret file at %s", secret_path)
|
|
return secret
|
|
|
|
JWT_SECRET_KEY = _load_jwt_secret()
|
|
JWT_ALGORITHM = "HS256"
|
|
JWT_EXPIRE_HOURS = int(os.getenv("JWT_EXPIRE_HOURS", "24"))
|
|
|
|
security = HTTPBearer(auto_error=False)
|
|
|
|
|
|
# ── User Loading ───────────────────────────────────────
|
|
|
|
def _load_users_file():
|
|
"""Load users from config file. Auto-hash plain-text passwords on first run."""
|
|
import json as j
|
|
config_path = os.getenv(
|
|
"USERS_CONFIG_PATH", str(Path(__file__).parent.parent / "config" / "users.json")
|
|
)
|
|
with open(config_path, encoding="utf-8") as f:
|
|
users_raw = j.load(f)
|
|
|
|
# Migrate plain-text passwords to bcrypt hashes (one-time on startup)
|
|
migrated = False
|
|
for user in users_raw:
|
|
if "password_plain" in user and "password" not in user:
|
|
pw_bytes = user.pop("password_plain").encode("utf-8")
|
|
user["password"] = bcrypt.hashpw(pw_bytes, bcrypt.gensalt()).decode("utf-8")
|
|
migrated = True
|
|
|
|
if migrated:
|
|
with open(config_path, "w", encoding="utf-8") as f:
|
|
j.dump(users_raw, f, ensure_ascii=False, indent=2)
|
|
|
|
return users_raw
|
|
|
|
|
|
_users_db = _load_users_file()
|
|
|
|
|
|
def get_user_by_username(username: str):
|
|
for u in _users_db:
|
|
if u["id"] == username:
|
|
return u
|
|
return None
|
|
|
|
|
|
# ── Token Helpers ─────────────────────────────────────
|
|
|
|
def create_access_token(data: dict) -> str:
|
|
to_encode = data.copy()
|
|
expire = datetime.now(timezone.utc) + timedelta(hours=JWT_EXPIRE_HOURS)
|
|
to_encode.update({"exp": expire})
|
|
return jwt.encode(to_encode, JWT_SECRET_KEY, algorithm=JWT_ALGORITHM)
|
|
|
|
|
|
def decode_access_token(token: str) -> dict | None:
|
|
try:
|
|
return jwt.decode(token, JWT_SECRET_KEY, algorithms=[JWT_ALGORITHM])
|
|
except jwt.ExpiredSignatureError:
|
|
return None
|
|
except jwt.InvalidTokenError:
|
|
return None
|
|
|
|
|
|
# ── Dependency ───────────────────────────────────────
|
|
|
|
async def get_current_user(
|
|
credentials: HTTPAuthorizationCredentials | None = Depends(security),
|
|
) -> str:
|
|
"""Extract and validate JWT, returning the user_id."""
|
|
if credentials is None:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="인증이 필요합니다",
|
|
)
|
|
payload = decode_access_token(credentials.credentials)
|
|
user_id = payload.get("user_id") if payload else None
|
|
if not isinstance(user_id, str) or get_user_by_username(user_id) is None:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="유효하지 않거나 만료된 토큰입니다",
|
|
)
|
|
return user_id
|