64 lines
2.5 KiB
Python
Executable File
64 lines
2.5 KiB
Python
Executable File
# /opt/docker/dev/service_finder/backend/app/core/security.py
|
|
import bcrypt
|
|
import string
|
|
import secrets
|
|
from datetime import datetime, timedelta, timezone
|
|
from typing import Optional, Dict, Any, Tuple
|
|
from jose import jwt, JWTError
|
|
from app.core.config import settings
|
|
|
|
def verify_password(plain_password: str, hashed_password: str) -> bool:
|
|
if not hashed_password: return False
|
|
return bcrypt.checkpw(plain_password.encode("utf-8"), hashed_password.encode("utf-8"))
|
|
|
|
def get_password_hash(password: str) -> str:
|
|
return bcrypt.hashpw(password.encode("utf-8"), bcrypt.gensalt()).decode("utf-8")
|
|
|
|
def create_tokens(data: Dict[str, Any], remember_me: bool = False) -> Tuple[str, str]:
|
|
""" Access és Refresh token generálása UTC időzónával.
|
|
|
|
Args:
|
|
data: Token payload adatok
|
|
remember_me: Ha True, a refresh token lejárata 30 nap, egyébként 1 nap
|
|
"""
|
|
to_encode = data.copy()
|
|
now = datetime.now(timezone.utc)
|
|
|
|
# Access Token (mindig ugyanaz a lejárat)
|
|
acc_expire = now + timedelta(minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES)
|
|
access_payload = {**to_encode, "exp": acc_expire, "iat": now, "type": "access"}
|
|
access_token = jwt.encode(access_payload, settings.SECRET_KEY, algorithm=settings.ALGORITHM)
|
|
|
|
# Refresh Token lejárat a remember_me alapján
|
|
if remember_me:
|
|
ref_expire = now + timedelta(days=30) # 30 nap remember me esetén
|
|
else:
|
|
ref_expire = now + timedelta(days=1) # 1 nap alapértelmezett
|
|
|
|
refresh_payload = {"sub": str(to_encode.get("sub")), "exp": ref_expire, "iat": now, "type": "refresh"}
|
|
refresh_token = jwt.encode(refresh_payload, settings.SECRET_KEY, algorithm=settings.ALGORITHM)
|
|
|
|
return access_token, refresh_token
|
|
|
|
def decode_token(token: str) -> Optional[Dict[str, Any]]:
|
|
try:
|
|
return jwt.decode(token, settings.SECRET_KEY, algorithms=[settings.ALGORITHM])
|
|
except JWTError:
|
|
return None
|
|
|
|
def generate_secure_slug(length: int = 16) -> str:
|
|
""" Biztonságos, URL-barát véletlenszerű azonosító generálása. """
|
|
alphabet = string.ascii_letters + string.digits
|
|
return ''.join(secrets.choice(alphabet) for _ in range(length))
|
|
|
|
# RBAC Phase 1: Tisztított rangtábla a rendszerszintű szerepkörökhöz.
|
|
# A szervezeti szerepkörök (OrgUserRole) külön kezelendők.
|
|
DEFAULT_RANK_MAP = {
|
|
"SUPERADMIN": 100,
|
|
"ADMIN": 90,
|
|
"MODERATOR": 75,
|
|
"SERVICE_MGR": 40,
|
|
"SALES_REP": 30,
|
|
"USER": 10,
|
|
"GUEST": 0
|
|
} |