o hj@sddlmZmZmZddlmZmZddlZddlZddlm Z de de fddZ d e d e de fd d Z dd ededBde fddZde dee efdBfddZdS))datetimetimezone timedelta)AnyDictN)settingspasswordreturncCs4|ddd}tjdd}t||}|dS)zZ Hashes a plain-text password using bcrypt (72-byte max length truncated safely). utf-8NH )rounds)encodebcryptgensalthashpwdecode)r pwd_bytessalthashedr3/web/html/dev/chatbot/backend/app/utils/security.py hash_passwords   rplain_passwordhashed_passwordcCsL|r|sdSz|ddd}|d}t||WSty%YdSw)z? Verifies a plain-text password against a bcrypt hash. Fr Nr )rrcheckpw Exception)rrr hash_bytesrrrverify_passwords  rdata expires_deltacCsj|}ttj}|r||}n|ttjd}|t | t | dt j |tj tjd}|S)zz Creates a JWT access token containing agent identity claims. Required payload keys: 'sub' (agentId), 'role'. )minutes)expiat) algorithm)copyrnowrutcrrjwt_expiration_minutesupdateint timestampjwtr jwt_secret jwt_algorithm)rr to_encoder&expire encoded_jwtrrrcreate_access_tokens    r2tokenc CsB|sdSztj|tjtjgd}|WStjtjfy YdSw)z~ Decodes and verifies a JWT access token. Returns the token payload if valid and non-expired, or None if invalid. N) algorithms)r,rrr-r.ExpiredSignatureErrorInvalidTokenError)r3payloadrrrdecode_access_token6sr8)N)rrrtypingrrr,r app.configrstrrboolrdictr2r8rrrrs   "