Skip to content

Jwt

jwt

Summary

The jwt package is the HTTP surface of the Aetoskia Auth Service.

It declares the FastAPI router that exposes the authentication endpoints (/register, /login, /me, /logout, /introspect) and the get_current_user bearer-token dependency used to protect routes.

All user management, hashing, and token logic is delegated to the :mod:jwtlib package (see the py-jwt project), while MongoDB persistence comes from mongo_ops.

Quick start

Wire the router into an application:

1
2
3
4
5
from fastapi import FastAPI
import jwt

app = FastAPI()
app.include_router(jwt.router)

Protect a route with the current user:

1
2
3
4
5
6
7
from fastapi import Depends
from jwtlib import PublicUser
from jwt import get_current_user

@app.get("/profile")
async def profile(current_user: PublicUser = Depends(get_current_user)):
    return current_user

Notes

  • The router mounts with an empty prefix and the Auth tag.
  • get_current_user raises 401 with WWW-Authenticate: Bearer when the header is missing or the token cannot be validated.

Functions

get_current_user async 

1
2
3
4
5
get_current_user(
    credentials: (
        HTTPAuthorizationCredentials | None
    ) = Depends(bearer_scheme),
) -> PublicUser

Resolve the authenticated user from the bearer credentials.

Decodes the JWT via get_logged_in_user and returns the matching public user profile. Any decoding, validity, or lookup failure produces the same generic 401 response so that the endpoint does not leak token internals.

Parameters:

Name Type Description Default
credentials HTTPAuthorizationCredentials | None

Bearer credentials extracted from the Authorization header, or None when the header is absent.

 Depends(bearer_scheme)

Returns:

Name Type Description
PublicUser PublicUser

The public profile of the authenticated user.

Raises:

Type Description
HTTPException

With status 401 and header WWW-Authenticate: Bearer when the credentials are missing or the token is not valid.