App

jwt.app

Summary

HTTP routes for the Aetoskia Auth Service.

This module assembles the authentication endpoint set: user registration, login (JWT issuance), current-user lookup, stateless logout, and the internal service-to-service token introspection endpoint. It also provides the get_current_user FastAPI dependency that decodes the bearer token and resolves the authenticated user.

The module is a thin FastAPI layer over the jwtlib application logic; no password or token handling is implemented here.

---

Notes

• /introspect is tagged Internal and is consumed by other services via jwtlib.introspection or the openapi-first generated dependencies.
• Logout is stateless: no server-side token invalidation is performed.

---

Functions

create_user async

create_user(user: RegisterRequest = Body(...)) -> PublicUser

Register a new user account.

The password is hashed server side and the returned profile never contains the password.

Parameters:

Name	Type	Description	Default
user	RegisterRequest	Registration payload containing username, optional email, and password (minimum 6 characters).	Body(...)

Returns:

Name	Type	Description
PublicUser	PublicUser	The created public user profile.

get_current_user async

get_current_user(credentials: HTTPAuthorizationCredentials | None = Depends(bearer_scheme)) -> PublicUser

Resolve the authenticated user from the bearer credentials.

Decodes the JWT via get_logged_in_user and returns the matching public user profile. Any decoding, validity, or lookup failure produces the same generic 401 response so that the endpoint does not leak token internals.

Parameters:

Name	Type	Description	Default
credentials	HTTPAuthorizationCredentials | None	Bearer credentials extracted from the Authorization header, or None when the header is absent.	Depends(bearer_scheme)

Returns:

Name	Type	Description
PublicUser	PublicUser	The public profile of the authenticated user.

Raises:

Type	Description
HTTPException	With status 401 and header WWW-Authenticate: Bearer when the credentials are missing or the token is not valid.

introspect async

introspect(body: IntrospectRequest = Body(...)) -> IntrospectResponse

Introspect a JWT for other microservices.

Verifies the token and returns the user only when it is active and valid.

Parameters:

Name	Type	Description	Default
body	IntrospectRequest	Request containing the token to verify.	Body(...)

Returns:

Name	Type	Description
IntrospectResponse	IntrospectResponse	Always a 200 response with active and, when valid, the public user profile.

login async

login(user: LoginRequest = Body(...)) -> LoginResponse

Authenticate a user and issue a JWT access token.

Parameters:

Name	Type	Description	Default
user	LoginRequest	Login payload containing username and password.	Body(...)

Returns:

Name	Type	Description
LoginResponse	LoginResponse	The issued access token together with the public user profile.

Raises:

Type	Description
HTTPException	With status 401 and detail Invalid credentials when the credentials do not match.

logout async

logout(_: PublicUser = Depends(get_current_user)) -> LogoutResponse

Log out the current user (stateless).

No server-side token invalidation is performed; the client must discard the access token.

Parameters:

Name	Type	Description	Default
_	PublicUser	The authenticated user (validates the bearer token).	Depends(get_current_user)

Returns:

Name	Type	Description
LogoutResponse	LogoutResponse	A message instructing the client to discard the token.

read_users_me async

read_users_me(current_user: PublicUser = Depends(get_current_user)) -> PublicUser

Return the currently authenticated user's public profile.

Parameters:

Name	Type	Description	Default
current_user	PublicUser	The authenticated user resolved by the bearer dependency.	Depends(get_current_user)

Returns:

Name	Type	Description
PublicUser	PublicUser	The public profile of the requesting user.