Prepare ERP source for Gitea deployment

app/core/security/jwt_tokens.py

@@ -0,0 +1,41 @@
+from __future__ import annotations
+
+from datetime import datetime, timedelta, timezone
+from typing import Any
+
+import jwt
+from jwt import PyJWTError
+
+from app.core.settings import get_settings
+
+def utcnow() -> datetime:
+    return datetime.now(timezone.utc)
+
+def encode_access_token(payload: dict[str, Any], expires_minutes: int) -> str:
+    s = get_settings()
+    now = utcnow()
+    exp = now + timedelta(minutes=expires_minutes)
+    token_payload = {
+        **payload,
+        "iss": s.JWT_ISSUER,
+        "aud": s.JWT_AUDIENCE,
+        "iat": int(now.timestamp()),
+        "exp": int(exp.timestamp()),
+        "typ": "access",
+    }
+    return jwt.encode(token_payload, s.SECRET_KEY, algorithm="HS256")
+
+def decode_token(token: str) -> dict[str, Any]:
+    s = get_settings()
+    try:
+        data = jwt.decode(
+            token,
+            s.SECRET_KEY,
+            algorithms=["HS256"],
+            audience=s.JWT_AUDIENCE,
+            issuer=s.JWT_ISSUER,
+            options={"require": ["exp", "iat", "iss", "aud"]},
+        )
+        return data
+    except PyJWTError as e:
+        raise PermissionError("Invalid token") from e