from typing import Any
import jwt
from app.core.auth.exceptions import InvalidTokenError
from app.core.auth.models import AuthContext
class LocalJWTAuthVerifier:
def __init__(self, secret_key: str) -> None:
if not secret_key:
raise ValueError("secret_key is required for local_jwt auth")
self._secret_key = secret_key
async def verify(self, token: str) -> AuthContext:
try:
claims: dict[str, Any] = jwt.decode(
token,
self._secret_key,
algorithms=["HS256"],
options={"require": ["sub"]},
)
except jwt.PyJWTError as e:
raise InvalidTokenError("invalid token") from e
user_id = str(claims.get("sub"))
if not user_id:
raise InvalidTokenError("token missing sub")
return AuthContext(user_id=user_id, token=token, claims=claims)