42 lines
1.2 KiB
Python
42 lines
1.2 KiB
Python
"""安全工具：密码哈希（PBKDF2，标准库）+ JWT。"""
|
|
import hashlib
|
|
import secrets
|
|
import time
|
|
|
|
import jwt
|
|
|
|
from ..config import settings
|
|
|
|
|
|
def hash_password(password: str) -> str:
|
|
salt = secrets.token_hex(16)
|
|
dk = hashlib.pbkdf2_hmac("sha256", password.encode(), salt.encode(), 100_000)
|
|
return f"pbkdf2${salt}${dk.hex()}"
|
|
|
|
|
|
def verify_password(password: str, stored: str) -> bool:
|
|
try:
|
|
_, salt, hexed = stored.split("$")
|
|
except ValueError:
|
|
return False
|
|
dk = hashlib.pbkdf2_hmac("sha256", password.encode(), salt.encode(), 100_000)
|
|
return secrets.compare_digest(dk.hex(), hexed)
|
|
|
|
|
|
def create_access_token(user_id: int, username: str, role: str = "user") -> str:
|
|
payload = {
|
|
"sub": str(user_id),
|
|
"username": username,
|
|
"role": role,
|
|
"iat": int(time.time()),
|
|
"exp": int(time.time()) + settings.ACCESS_TOKEN_EXPIRE_MINUTES * 60,
|
|
}
|
|
return jwt.encode(payload, settings.SECRET_KEY, algorithm=settings.ALGORITHM)
|
|
|
|
|
|
def decode_token(token: str) -> dict | None:
|
|
try:
|
|
return jwt.decode(token, settings.SECRET_KEY, algorithms=[settings.ALGORITHM])
|
|
except jwt.PyJWTError:
|
|
return None
|