mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-04-25 11:18:22 +00:00
03c3b18565
Port RFC-001 authentication core from PR #1728: - JWT token handling (create_access_token, decode_token, TokenPayload) - Password hashing (bcrypt) with verify_password - SQLite UserRepository with base interface - Provider Factory pattern (LocalAuthProvider) - CLI reset_admin tool - Auth-specific errors (AuthErrorCode, TokenError, AuthErrorResponse) Deps: - bcrypt>=4.0.0 - pyjwt>=2.9.0 - email-validator>=2.0.0 - backend/uv.toml pins public PyPI index Tests: 12 pure unit tests (test_auth_config.py, test_auth_errors.py). Scope note: authz.py, test_auth.py, and test_auth_type_system.py are deferred to commit 2 because they depend on middleware and deps wiring that is not yet in place. Commit 1 stays "pure new files only" as the spec mandates.
45 lines
1.2 KiB
Python
45 lines
1.2 KiB
Python
"""Typed error definitions for auth module.
|
|
|
|
AuthErrorCode: exhaustive enum of all auth failure conditions.
|
|
TokenError: exhaustive enum of JWT decode failures.
|
|
AuthErrorResponse: structured error payload for HTTP responses.
|
|
"""
|
|
|
|
from enum import StrEnum
|
|
|
|
from pydantic import BaseModel
|
|
|
|
|
|
class AuthErrorCode(StrEnum):
|
|
"""Exhaustive list of auth error conditions."""
|
|
|
|
INVALID_CREDENTIALS = "invalid_credentials"
|
|
TOKEN_EXPIRED = "token_expired"
|
|
TOKEN_INVALID = "token_invalid"
|
|
USER_NOT_FOUND = "user_not_found"
|
|
EMAIL_ALREADY_EXISTS = "email_already_exists"
|
|
PROVIDER_NOT_FOUND = "provider_not_found"
|
|
NOT_AUTHENTICATED = "not_authenticated"
|
|
|
|
|
|
class TokenError(StrEnum):
|
|
"""Exhaustive list of JWT decode failure reasons."""
|
|
|
|
EXPIRED = "expired"
|
|
INVALID_SIGNATURE = "invalid_signature"
|
|
MALFORMED = "malformed"
|
|
|
|
|
|
class AuthErrorResponse(BaseModel):
|
|
"""Structured error response — replaces bare `detail` strings."""
|
|
|
|
code: AuthErrorCode
|
|
message: str
|
|
|
|
|
|
def token_error_to_code(err: TokenError) -> AuthErrorCode:
|
|
"""Map TokenError to AuthErrorCode — single source of truth."""
|
|
if err == TokenError.EXPIRED:
|
|
return AuthErrorCode.TOKEN_EXPIRED
|
|
return AuthErrorCode.TOKEN_INVALID
|