§
    ~v»jd  ã                  óž   — d Z ddlmZ ddlZddlZddlZddlZddlZddlm	Z	m
Z
mZmZ ddlZddlmZ  G d„ d¦  «        Z G d„ d	¦  «        ZdS )
z¤
Cryptographic services: Password Hashing, JWT Token Issuance & Revocation.
Implements OWASP 2026 guidelines with PBKDF2-HMAC-SHA256 and constant-time comparisons.
é    )ÚannotationsN)ÚAnyÚDictÚOptionalÚSet)ÚAuthTokenPairc                  ó,   — e Zd ZdZddd	„Zdd„Zdd„ZdS )ÚPasswordHasherz@OWASP-compliant password hashing and constant-time verification.éÀ'	 é   Ú
iterationsÚintÚ
salt_bytesÚreturnÚNonec                ó"   — || _         || _        d S ©N)r   r   )Úselfr   r   s      ú+C:\Projects\FreeExile\server\auth\crypto.pyÚ__init__zPasswordHasher.__init__   s   € Ø$ˆŒØ$ˆŒˆˆó    ÚpasswordÚstrc                óR  — t          j        | j        ¦  «        }t          j        d|                     d¦  «        || j        d¬¦  «        }t          j        |¦  «         	                    d¦  «        }t          j        |¦  «         	                    d¦  «        }d| j        › d|› d|› �S )z:Hash a password using PBKDF2-HMAC-SHA256 with random salt.Úsha256úutf-8é    ©Ú	hash_namer   Úsaltr   ÚdklenÚasciizpbkdf2_sha256$ú$)
ÚsecretsÚtoken_bytesr   ÚhashlibÚpbkdf2_hmacÚencoder   Úbase64Ú	b64encodeÚdecode)r   r   r    ÚdkÚsalt_b64Úhash_b64s         r   Úhash_passwordzPasswordHasher.hash_password   s¦   € åÔ" 4¤?Ñ3Ô3ˆÝÔ ØØ—_’_ WÑ-Ô-ØØ”Øð
ñ 
ô 
ˆõ Ô# DÑ)Ô)×0Ò0°Ñ9Ô9ˆÝÔ# BÑ'Ô'×.Ò.¨wÑ7Ô7ˆØG ¤ÐGÐG°(ÐGÐG¸XÐGÐGÐGr   Úhashed_passwordÚboolc           	     óÀ  — 	 |                      d¦  «        \  }}}}|dk    rdS t          |¦  «        }t          j        |                     d¦  «        ¦  «        }t          j        |                     d¦  «        ¦  «        }	t          j        d|                     d¦  «        ||t          |	¦  «        ¬¦  «        }
t          j	        |	|
¦  «        S # t          $ r Y dS w xY w)zCVerify password against stored hash using constant-time comparison.r#   Úpbkdf2_sha256Fr"   r   r   r   )Úsplitr   r)   Ú	b64decoder(   r&   r'   Úlenr$   Úcompare_digestÚ	Exception)r   r   r0   Ú	algorithmÚiter_strr-   r.   r   r    Úexpected_hashÚactual_hashs              r   Úverify_passwordzPasswordHasher.verify_password'   sç   € ð	Ø6E×6KÒ6KÈCÑ6PÔ6PÑ3ˆI�x ¨8Ø˜OÒ+Ð+Ø�uÝ˜X™œˆJÝÔ# H§O¢O°GÑ$<Ô$<Ñ=Ô=ˆDÝ"Ô,¨X¯_ª_¸WÑ-EÔ-EÑFÔFˆMå!Ô-Ø"Ø!Ÿš¨Ñ1Ô1ØØ%Ý˜-Ñ(Ô(ðñ ô ˆKõ Ô)¨-¸ÑEÔEÐEøÝð 	ð 	ð 	à�5�5ð	øøøs   ‚ C ¤B*C Ã
CÃCN)r   r   )r   r   r   r   r   r   )r   r   r   r   )r   r   r0   r   r   r1   )Ú__name__Ú
__module__Ú__qualname__Ú__doc__r   r/   r=   © r   r   r
   r
      s_   € € € € € ØJÐJð%ð %ð %ð %ð %ðHð Hð Hð Hðð ð ð ð ð r   r
   c                  óB   — e Zd ZdZ	 	 	 ddd„Zdd„Zdd„Zdd„Zd d„ZdS )!ÚTokenServicezDJWT Access and Refresh token generation, validation, and revocation.ÚHS256é„  é€:	 Ú
secret_keyr   r9   Úaccess_token_ttl_secondsr   Úrefresh_token_ttl_secondsr   r   c                ód   — || _         || _        || _        || _        t	          ¦   «         | _        d S r   )rH   r9   rI   rJ   ÚsetÚ_revoked_tokens)r   rH   r9   rI   rJ   s        r   r   zTokenService.__init__A   s4   € ð %ˆŒØ"ˆŒØ(@ˆÔ%Ø)BˆÔ&Ý),©¬ˆÔÐÐr   Ú
account_idÚrolesú	list[str]Úemailr   c                ó(  — t          t          j        ¦   «         ¦  «        }t          j        d¦  «        }|||||| j        z   |ddœ}t          j        || j        | j        ¬¦  «        }t          j	        d¦  «        }t          ||| j        d¬¦  «        S )z:Create signed access token and high-entropy refresh token.r   úfreeexile-auth-gateway)ÚsubrQ   rO   ÚiatÚexpÚjtiÚiss)r9   r   ÚBearer)Úaccess_tokenÚrefresh_tokenÚexpires_in_secondsÚ
token_type)r   Útimer$   Ú	token_hexrI   Újwtr(   rH   r9   Útoken_urlsafer   )	r   rN   rO   rQ   ÚnowrW   Úaccess_payloadrZ   r[   s	            r   Úgenerate_token_pairz TokenService.generate_token_pairN   s¢   € õ •$”)‘+”+ÑÔˆÝÔ Ñ#Ô#ˆàØØØØ˜Ô6Ñ6ØØ+ð
ð 
ˆõ ”z .°$´/ÈTÌ^Ð\Ñ\Ô\ˆÝÔ-¨bÑ1Ô1ˆåØ%Ø'Ø#Ô<Øð	
ñ 
ô 
ð 	
r   ÚtokenúOptional[Dict[str, Any]]c                ó¶   — |                       |¦  «        rdS 	 t          j        || j        | j        gd¬¦  «        }|S # t          j        t          f$ r Y dS w xY w)z:Verify token signature and ensure it has not been revoked.NrS   )Ú
algorithmsÚissuer)Úis_token_revokedr`   r+   rH   r9   Ú
PyJWTErrorr8   )r   re   Úpayloads      r   Úverify_access_tokenz TokenService.verify_access_tokenj   s{   € à× Ò  Ñ'Ô'ð 	Ø�4ð		Ý&)¤jØØ”Ø œNÐ+Ø/ð	'ñ 'ô 'ˆGð ˆNøÝ”¥	Ð*ð 	ð 	ð 	Ø�4�4ð	øøøs   ™$> ¾AÁAc                ó:   — | j                              |¦  «         dS )zRevoke a token immediately.N)rM   Úadd©r   re   s     r   Úrevoke_tokenzTokenService.revoke_tokeny   s   € àÔ× Ò  Ñ'Ô'Ð'Ð'Ð'r   r1   c                ó   — || j         v S )zCheck if token is in blacklist.)rM   rp   s     r   rj   zTokenService.is_token_revoked}   s   € à˜Ô,Ð,Ð,r   N)rE   rF   rG   )
rH   r   r9   r   rI   r   rJ   r   r   r   )rN   r   rO   rP   rQ   r   r   r   )re   r   r   rf   )re   r   r   r   )re   r   r   r1   )	r>   r?   r@   rA   r   rd   rm   rq   rj   rB   r   r   rD   rD   >   sŽ   € € € € € ØNÐNð
 !Ø(+Ø)0ð/ð /ð /ð /ð /ð
ð 
ð 
ð 
ð8ð ð ð ð(ð (ð (ð (ð-ð -ð -ð -ð -ð -r   rD   )rA   Ú
__future__r   r)   r&   Úhmacr$   r^   Útypingr   r   r   r   r`   Úserver.auth.modelsr   r
   rD   rB   r   r   ú<module>rw      sô   ððð ð
 #Ð "Ð "Ð "Ð "Ð "Ø €€€Ø €€€Ø €€€Ø €€€Ø €€€Ø +Ð +Ð +Ð +Ð +Ð +Ð +Ð +Ð +Ð +Ð +Ð +Ø 
€
€
€
à ,Ð ,Ð ,Ð ,Ð ,Ð ,ð)ð )ð )ð )ð )ñ )ô )ð )ðXA-ð A-ð A-ð A-ð A-ñ A-ô A-ð A-ð A-ð A-r   