1from datetime import datetime, timedelta
 2from typing import Union
 3
 4import jwt
 5
 6from app.config import get_secret_key
 7from app.config.env import JWT_ACCESS_TOKEN_EXPIRE_MINUTES
 8
 9
10def create_admin_token(username: str, is_sudo=False) -> str:
11    data = {
12        "sub": username,
13        "access": "sudo" if is_sudo else "admin",
14        "iat": datetime.utcnow(),
15    }
16    if JWT_ACCESS_TOKEN_EXPIRE_MINUTES > 0:
17        expire = datetime.utcnow() + timedelta(
18            minutes=JWT_ACCESS_TOKEN_EXPIRE_MINUTES
19        )
20        data["exp"] = expire
21    encoded_jwt = jwt.encode(data, get_secret_key(), algorithm="HS256")
22    return encoded_jwt
23
24
25def get_admin_payload(token: str) -> Union[dict, None]:
26    try:
27        payload = jwt.decode(token, get_secret_key(), algorithms=["HS256"])
28    except jwt.InvalidTokenError:
29        return
30
31    username: str = payload.get("sub")
32    access: str = payload.get("access")
33    if not username or access not in ("admin", "sudo"):
34        return
35    try:
36        created_at = datetime.utcfromtimestamp(payload["iat"])
37    except KeyError:
38        created_at = None
39
40    return {
41        "username": username,
42        "is_sudo": access == "sudo",
43        "created_at": created_at,
44    }