Ship your AI SaaS in days.

import logging
from fastapi import Depends, HTTPException, status
from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
import jwt
from jwt import PyJWKClient, PyJWTError
from api.core.config import settings

logger = logging.getLogger(__name__)
security = HTTPBearer()

# Supabase asymmetric keys (ES256 / RS256) are validated via the JWKS endpoint;
# symmetric keys (shared secret) are strictly restricted to HS256.
jwks_client = PyJWKClient(f"{settings.SUPABASE_URL}/auth/v1/.well-known/jwks.json")

async def get_current_user(
    credentials: HTTPAuthorizationCredentials = Depends(security)
) -> dict:
    """
    Zero-Trust JWT verification dependency using PyJWT.
    Validates cryptographic Supabase signature with strict algorithm allowlists.
    Never trusts client-supplied identity; logs errors server-side and returns generic 401.
    """
    token = credentials.credentials
    try:
        unverified_header = jwt.get_unverified_header(token)
        algorithm = unverified_header.get("alg")

        if algorithm == "HS256":
            # Shared secret symmetric verification strictly restricted to HS256
            payload = jwt.decode(
                token,
                settings.SUPABASE_JWT_SECRET,
                algorithms=["HS256"],
                audience="authenticated"
            )
        elif algorithm in ["ES256", "RS256"]:
            # Asymmetric key verification strictly restricted to ES256 / RS256 via JWKS
            signing_key = jwks_client.get_signing_key_from_jwt(token)
            payload = jwt.decode(
                token,
                signing_key.key,
                algorithms=["ES256", "RS256"],
                audience="authenticated"
            )
        else:
            logger.warning(f"Rejected unsupported JWT algorithm: {algorithm}")
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail="Invalid or expired token"
            )

        user_id: str = payload.get("sub")
        if not user_id:
            logger.warning("JWT payload missing 'sub' claim")
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail="Invalid or expired token"
            )

        return {
            "id": user_id,
            "email": payload.get("email"),
            "role": payload.get("role", "authenticated")
        }
    except PyJWTError as e:
        logger.warning(f"JWT verification failed: {e}")
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid or expired token"
        )