基于jwt的web认证方案

# coding: utf-8
import time
from uuid import uuid4

from jwt import decode, encode, DecodeError, ExpiredSignatureError, InvalidTokenError


class Token(object):
    secret = conf["JWT_SECRET_KEY"]
    algorithm = conf["JWT_ALGORITHM"]
    lifetime = None
    token_type = None

    def __init__(self, token=None, secret=None, algorithm=None):
        if self.lifetime is None or self.token_type is None:
            raise InvalidTokenError

        if secret:
            self.secret = secret

        if algorithm:
            self.algorithm = algorithm

        self.token = token
        self.now = int(time.time())

        if self.token is not None:  # decode
            try:
                self.payload = decode(token, self.secret, algorithm=self.algorithm)
            except ExpiredSignatureError:
                raise ExpiredSignatureError
            except DecodeError:
                raise DecodeError
        else:  # create
            self.payload = {"token_type": self.token_type}
            self.set_iat()
            self.set_exp()
            self.set_jti()

    def __setitem__(self, key, value):
        self.payload[key] = value

    def __getitem__(self, key):
        return self.payload[key]

    def __delitem__(self, key):
        del self.payload[key]

    def __str__(self):
        return encode(self.payload, self.secret, algorithm=self.algorithm)

    def set_iat(self):
        self.payload["iat"] = self.now

    def set_exp(self):
        self.payload["exp"] = self.now + self.lifetime

    def check_expired(self):  # 'ture' is expired
        return self.now > self.payload["exp"]

    def set_jti(self):  # jwt的唯一身份标识,主要用来作为一次性token,从而回避重放攻击,暂时不用
        self.payload["jti"] = uuid4().hex

    @classmethod
    def for_user(cls, user):
        token = cls()
        token["user"] = user.id
        return token


class RefreshToken(Token):
    lifetime = conf["JWT_REFRESH_TOKEN_LIFETIME"]
    token_type = "refresh"

    @property
    def access_token(self):
        access = AccessToken()
        for k, v in self.payload.iteritems():
            if k not in access.payload:
                access[k] = v
        return access


class AccessToken(Token):
    lifetime = conf["JWT_TOKEN_LIFETIME"]
    token_type = "access"