feat(auth): enterprise authentication and user management

backend/hermes/app/core/security.py

@@ -1,6 +1,7 @@
 from datetime import UTC, datetime, timedelta
 
-from jose import jwt
+from fastapi import HTTPException, status
+from jose import JWTError, jwt
 from pwdlib import PasswordHash
 
 from app.core.config import settings
@@ -8,7 +9,11 @@ from app.core.config import settings
 password_hash = PasswordHash.recommended()
 
 ALGORITHM = "HS256"
-ACCESS_TOKEN_EXPIRE_MINUTES = 60
+ACCESS_TOKEN_TYPE = "access"
+
+
+def get_access_token_expire_seconds() -> int:
+    return settings.access_token_expire_minutes * 60
 
 
 def hash_password(password: str) -> str:
@@ -20,11 +25,15 @@ def verify_password(plain_password: str, hashed_password: str) -> bool:
 
 
 def create_access_token(subject: str) -> str:
-    expire = datetime.now(UTC) + timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
+    issued_at = datetime.now(UTC)
+    expire = issued_at + timedelta(minutes=settings.access_token_expire_minutes)
 
     payload = {
         "sub": subject,
+        "iat": issued_at,
         "exp": expire,
+        "iss": settings.jwt_issuer,
+        "type": ACCESS_TOKEN_TYPE,
     }
 
     return jwt.encode(
@@ -32,3 +41,31 @@ def create_access_token(subject: str) -> str:
         settings.secret_key,
         algorithm=ALGORITHM,
     )
+
+
+def verify_access_token(token: str) -> str:
+    credentials_exception = HTTPException(
+        status_code=status.HTTP_401_UNAUTHORIZED,
+        detail="Nicht authentifiziert",
+        headers={"WWW-Authenticate": "Bearer"},
+    )
+
+    try:
+        payload = jwt.decode(
+            token,
+            settings.secret_key,
+            algorithms=[ALGORITHM],
+            issuer=settings.jwt_issuer,
+        )
+        subject = payload.get("sub")
+        token_type = payload.get("type")
+    except JWTError as exc:
+        raise credentials_exception from exc
+
+    if not isinstance(subject, str) or not subject:
+        raise credentials_exception
+
+    if token_type != ACCESS_TOKEN_TYPE:
+        raise credentials_exception
+
+    return subject