Basic Configuration

JWT Configuration

# config/security.yaml
authentication:
  jwt:
    secret_key: "${JWT_SECRET_KEY}"  # From environment
    algorithm: "HS256"
    access_token_expire: 3600     # 1 hour
    refresh_token_expire: 604800  # 7 days
    issuer: "ai-security-system"
    audience: "api-users"
  
  oauth:
    enabled: true
    providers:
      google:
        client_id: "${GOOGLE_CLIENT_ID}"
        client_secret: "${GOOGLE_CLIENT_SECRET}"
        redirect_uri: "/auth/google/callback"
      
authorization:
  rbac:
    enabled: true
    default_role: "user"
    roles:
      admin:
        permissions:
          - "system:manage"
          - "users:manage"
          - "models:manage"
          - "security:configure"
      user:
        permissions:
          - "ai:query"
          - "data:validate"
          - "reports:view"
      readonly:
        permissions:
          - "reports:view"
          - "status:check"

# Python implementation
import jwt
import datetime
from functools import wraps
from flask import request, jsonify, current_app

class AuthManager:
    def __init__(self, app_config):
        self.secret_key = app_config['JWT_SECRET_KEY']
        self.algorithm = app_config.get('JWT_ALGORITHM', 'HS256')
        self.expiration = app_config.get('JWT_EXPIRATION', 3600)
    
    def generate_token(self, user_id, role='user'):
        """Generate JWT token for user"""
        payload = {
            'user_id': user_id,
            'role': role,
            'exp': datetime.datetime.utcnow() + datetime.timedelta(seconds=self.expiration),
            'iat': datetime.datetime.utcnow(),
            'iss': 'ai-security-system'
        }
        
        token = jwt.encode(payload, self.secret_key, algorithm=self.algorithm)
        return token
    
    def verify_token(self, token):
        """Verify and decode JWT token"""
        try:
            payload = jwt.decode(token, self.secret_key, algorithms=[self.algorithm])
            return {'valid': True, 'payload': payload}
        except jwt.ExpiredSignatureError:
            return {'valid': False, 'error': 'Token expired'}
        except jwt.InvalidTokenError:
            return {'valid': False, 'error': 'Invalid token'}
    
    def require_auth(self, required_permission=None):
        """Decorator for protecting endpoints"""
        def decorator(f):
            @wraps(f)
            def decorated_function(*args, **kwargs):
                token = request.headers.get('Authorization')
                if not token or not token.startswith('Bearer '):
                    return jsonify({'error': 'Missing or invalid authorization header'}), 401
                
                token = token.split(' ')[1]
                verification = self.verify_token(token)
                
                if not verification['valid']:
                    return jsonify({'error': verification['error']}), 401
                
                # Check permissions if required
                if required_permission:
                    user_role = verification['payload'].get('role')
                    if not self.has_permission(user_role, required_permission):
                        return jsonify({'error': 'Insufficient permissions'}), 403
                
                request.user = verification['payload']
                return f(*args, **kwargs)
            return decorated_function
        return decorator