The jwt package is the HTTP surface of the Aetoskia Auth Service.
It declares the FastAPI router that exposes the authentication endpoints (/register, /login, /me, /logout, /introspect) and the get_current_user bearer-token dependency used to protect routes.
All user management, hashing, and token logic is delegated to the :mod:jwtlib package (see the py-jwt project), while MongoDB persistence comes from mongo_ops.
Wire the router into an application:
from fastapi import FastAPI\nimport jwt\n\napp = FastAPI()\napp.include_router(jwt.router)\nProtect a route with the current user:
from fastapi import Depends\nfrom jwtlib import PublicUser\nfrom jwt import get_current_user\n\n@app.get(\"/profile\")\nasync def profile(current_user: PublicUser = Depends(get_current_user)):\n return current_user\nAuth tag.get_current_user raises 401 with WWW-Authenticate: Bearer when the header is missing or the token cannot be validated.async","text":"get_current_user(\n credentials: (\n HTTPAuthorizationCredentials | None\n ) = Depends(bearer_scheme),\n) -> PublicUser\nResolve the authenticated user from the bearer credentials.
Decodes the JWT via get_logged_in_user and returns the matching public user profile. Any decoding, validity, or lookup failure produces the same generic 401 response so that the endpoint does not leak token internals.
Parameters:
Name Type Description Defaultcredentials HTTPAuthorizationCredentials | None Bearer credentials extracted from the Authorization header, or None when the header is absent.
Depends(bearer_scheme) Returns:
Name Type DescriptionPublicUser PublicUser The public profile of the authenticated user.
Raises:
Type DescriptionHTTPException With status 401 and header WWW-Authenticate: Bearer when the credentials are missing or the token is not valid.
HTTP routes for the Aetoskia Auth Service.
This module assembles the authentication endpoint set: user registration, login (JWT issuance), current-user lookup, stateless logout, and the internal service-to-service token introspection endpoint. It also provides the get_current_user FastAPI dependency that decodes the bearer token and resolves the authenticated user.
The module is a thin FastAPI layer over the jwtlib application logic; no password or token handling is implemented here.
/introspect is tagged Internal and is consumed by other services via jwtlib.introspection or the openapi-first generated dependencies.async","text":"create_user(\n user: RegisterRequest = Body(...),\n) -> PublicUser\nRegister a new user account.
The password is hashed server side and the returned profile never contains the password.
Parameters:
Name Type Description Defaultuser RegisterRequest Registration payload containing username, optional email, and password (minimum 6 characters).
Body(...) Returns:
Name Type DescriptionPublicUser PublicUser The created public user profile.
"},{"location":"jwt/app/#jwt.app.get_current_user","title":"get_current_userasync","text":"get_current_user(\n credentials: (\n HTTPAuthorizationCredentials | None\n ) = Depends(bearer_scheme),\n) -> PublicUser\nResolve the authenticated user from the bearer credentials.
Decodes the JWT via get_logged_in_user and returns the matching public user profile. Any decoding, validity, or lookup failure produces the same generic 401 response so that the endpoint does not leak token internals.
Parameters:
Name Type Description Defaultcredentials HTTPAuthorizationCredentials | None Bearer credentials extracted from the Authorization header, or None when the header is absent.
Depends(bearer_scheme) Returns:
Name Type DescriptionPublicUser PublicUser The public profile of the authenticated user.
Raises:
Type DescriptionHTTPException With status 401 and header WWW-Authenticate: Bearer when the credentials are missing or the token is not valid.
async","text":"introspect(\n body: IntrospectRequest = Body(...),\n) -> IntrospectResponse\nIntrospect a JWT for other microservices.
Verifies the token and returns the user only when it is active and valid.
Parameters:
Name Type Description Defaultbody IntrospectRequest Request containing the token to verify.
Body(...) Returns:
Name Type DescriptionIntrospectResponse IntrospectResponse Always a 200 response with active and, when valid, the public user profile.
async","text":"login(user: LoginRequest = Body(...)) -> LoginResponse\nAuthenticate a user and issue a JWT access token.
Parameters:
Name Type Description Defaultuser LoginRequest Login payload containing username and password.
Body(...) Returns:
Name Type DescriptionLoginResponse LoginResponse The issued access token together with the public user profile.
Raises:
Type DescriptionHTTPException With status 401 and detail Invalid credentials when the credentials do not match.
async","text":"logout(\n _: PublicUser = Depends(get_current_user),\n) -> LogoutResponse\nLog out the current user (stateless).
No server-side token invalidation is performed; the client must discard the access token.
Parameters:
Name Type Description Default_ PublicUser The authenticated user (validates the bearer token).
Depends(get_current_user) Returns:
Name Type DescriptionLogoutResponse LogoutResponse A message instructing the client to discard the token.
"},{"location":"jwt/app/#jwt.app.read_users_me","title":"read_users_measync","text":"read_users_me(\n current_user: PublicUser = Depends(get_current_user),\n) -> PublicUser\nReturn the currently authenticated user's public profile.
Parameters:
Name Type Description Defaultcurrent_user PublicUser The authenticated user resolved by the bearer dependency.
Depends(get_current_user) Returns:
Name Type DescriptionPublicUser PublicUser The public profile of the requesting user.
"}]}