
    LCj              	           d Z ddlmZmZmZ ddlmZ ddlmZmZ ddl	m
Z
 ddlmZ ddlmZ  e       Z e
dgd	
      ZdZdZdZdedefdZdededefdZdededefdZdedefdZddededeeef   fdZy)u  
Password hashing and JWT token utilities.

This is a separate authentication mechanism from app/core/security.py's
API-key auth. API keys identify a calling service/integration with a
long-lived static secret; JWTs here identify an individual logged-in
customer with a short-lived, expiring token — the standard pattern for
a user-facing SaaS login, not machine-to-machine API access.

Password hashing uses bcrypt via passlib — never store or compare
plaintext passwords anywhere in this codebase.
    )datetime	timedeltatimezone)Any)JWTErrorjwt)CryptContext)get_settings)AuthenticationErrorbcryptauto)schemes
deprecatedHS256i     plain_passwordreturnc                 ,    t         j                  |       S N)pwd_contexthash)r   s    AC:\Crop_Prediction\Backend\crop-ai-system\app\core\auth_tokens.pyhash_passwordr   #   s    N++    hashed_passwordc                 .    t         j                  | |      S r   )r   verify)r   r   s     r   verify_passwordr   '   s    no>>r   user_idemailc                    t        j                  t        j                        t	        t
              z   }| |d|t        j                  t        j                        d}t        j                  |t        j                  t              S )N)minutesaccess)subr    typeexpiat	algorithm)r   nowr   utcr   ACCESS_TOKEN_EXPIRE_MINUTESr   encodesettings
SECRET_KEYJWT_ALGORITHM)r   r    expirepayloads       r   create_access_tokenr3   +   s]    \\(,,')<W*XXF||HLL)G ::gx22mLLr   c                    t        j                  t        j                        t	        t
              z   }| d|t        j                  t        j                        d}t        j                  |t        j                  t              S )N)daysrefresh)r$   r%   r&   r'   r(   )r   r*   r   r+   r   REFRESH_TOKEN_EXPIRE_DAYSr   r-   r.   r/   r0   )r   r1   r2   s      r   create_refresh_tokenr8   7   sZ    \\(,,')9R*SSF||HLL)	G ::gx22mLLr   tokenexpected_typec                     	 t        j                  | t        j                  t        g      }|j                  d      |k7  rt        d| d      |S # t
        $ r}t        d      |d}~ww xY w)uA  
    Raises AuthenticationError (not a raw JWTError) on any failure —
    expired, malformed, wrong signature, or wrong token type used in the
    wrong place (e.g. a refresh token presented where an access token
    is required). Callers should never need to know about python-jose's
    exception types directly.
    )
algorithmszInvalid or expired token)messageNr%   zExpected a z token)r   decoder.   r/   r0   r   r   get)r9   r:   r2   excs       r   decode_tokenrA   B   sp    O**UH$7$7]OT {{6m+!Kf*MNNN  O!*DE3NOs   +A 	A.A))A.N)r#   )__doc__r   r   r   typingr   joser   r   passlib.contextr	   app.core.configr
   app.core.exceptionsr   r.   r   r0   r,   r7   strr   boolr   r3   r8   dictrA    r   r   <module>rL      s    3 2   ( ( 3>
 H:&A%  ,# ,# ,?C ?# ?$ ?	M 	MS 	MS 	MM# M# M C tCH~ r   