auth.py

"""JWT session management — stateless cookie-based authentication."""

from datetime import datetime, timedelta, timezone

import jwt
from flask import request

from config import Config

COOKIE_NAME = "idp_session"


def create_jwt(user_dict: dict) -> str:
    payload = {
        "sub": user_dict["email"],
        "display_name": user_dict["display_name"],
        "roles": user_dict["roles"],
        "iat": datetime.now(timezone.utc),
        "exp": datetime.now(timezone.utc)
        + timedelta(minutes=Config.JWT_EXPIRY_MINUTES),
    }
    return jwt.encode(payload, Config.JWT_SECRET, algorithm=Config.JWT_ALGORITHM)


def verify_jwt(token: str) -> dict | None:
    try:
        return jwt.decode(
            token, Config.JWT_SECRET, algorithms=[Config.JWT_ALGORITHM]
        )
    except (jwt.ExpiredSignatureError, jwt.InvalidTokenError):
        return None


def get_current_user() -> dict | None:
    token = request.cookies.get(COOKIE_NAME)
    if not token:
        return None
    payload = verify_jwt(token)
    if payload is None:
        return None
    return {
        "email": payload["sub"],
        "display_name": payload["display_name"],
        "roles": payload["roles"],
    }


def set_session_cookie(response, token: str):
    response.set_cookie(
        COOKIE_NAME,
        token,
        httponly=Config.COOKIE_HTTPONLY,
        secure=Config.COOKIE_SECURE,
        samesite=Config.COOKIE_SAMESITE,
        max_age=Config.JWT_EXPIRY_MINUTES * 60,
    )
    return response


def clear_session_cookie(response):
    response.delete_cookie(COOKIE_NAME)
    return response