feat: implement auth, projects, and frontend foundation

apps/api/src/auth/__init__.py

@@ -0,0 +1,12 @@
+from src.auth.cookies import build_cookie_options
+from src.auth.jwt_service import decode_access_token, mint_access_token
+from src.auth.oidc import build_login_redirect_url
+from src.auth.refresh_store import hash_refresh_token
+
+__all__ = [
+    "build_cookie_options",
+    "build_login_redirect_url",
+    "decode_access_token",
+    "hash_refresh_token",
+    "mint_access_token",
+]

apps/api/src/auth/cookies.py

@@ -0,0 +1,9 @@
+from src.config import Settings
+
+
+def build_cookie_options(settings: Settings) -> dict[str, str | bool]:
+    return {
+        "httponly": True,
+        "secure": settings.cookie_secure,
+        "samesite": settings.cookie_samesite,
+    }

apps/api/src/auth/jwt_service.py

@@ -0,0 +1,27 @@
+from datetime import datetime
+
+from jose import jwt  # type: ignore[import-untyped]
+
+from src.config import Settings
+
+
+def mint_access_token(
+    *,
+    settings: Settings,
+    subject: str,
+    email: str,
+    name: str,
+    expires_at: datetime,
+) -> str:
+    payload = {
+        "sub": subject,
+        "email": email,
+        "name": name,
+        "exp": expires_at,
+    }
+    return jwt.encode(payload, settings.jwt_secret, algorithm=settings.jwt_algorithm)
+
+
+def decode_access_token(*, settings: Settings, token: str) -> dict[str, str | int]:
+    claims = jwt.decode(token, settings.jwt_secret, algorithms=[settings.jwt_algorithm])
+    return dict(claims)

apps/api/src/auth/oidc.py

@@ -0,0 +1,77 @@
+from urllib.parse import urlencode
+
+import httpx
+from jose import jwt  # type: ignore[import-untyped]
+
+from src.config import Settings
+
+
+def build_login_redirect_url(
+    *,
+    settings: Settings,
+    redirect_uri: str,
+    state: str,
+    nonce: str,
+) -> str:
+    query = urlencode(
+        {
+            "response_type": "code",
+            "client_id": settings.authentik_client_id,
+            "redirect_uri": redirect_uri,
+            "scope": "openid profile email",
+            "state": state,
+            "nonce": nonce,
+        }
+    )
+    return f"{settings.authentik_authorize_url}?{query}"
+
+
+async def exchange_code_for_tokens(
+    *,
+    settings: Settings,
+    code: str,
+    redirect_uri: str,
+    client: httpx.AsyncClient,
+) -> dict[str, str]:
+    response = await client.post(
+        settings.authentik_token_url,
+        data={
+            "grant_type": "authorization_code",
+            "code": code,
+            "redirect_uri": redirect_uri,
+            "client_id": settings.authentik_client_id,
+            "client_secret": settings.authentik_client_secret,
+        },
+    )
+    response.raise_for_status()
+    payload = response.json()
+    return {
+        "access_token": payload["access_token"],
+        "refresh_token": payload["refresh_token"],
+    }
+
+
+async def fetch_jwks(*, settings: Settings, client: httpx.AsyncClient) -> dict[str, list[dict[str, str]]]:
+    response = await client.get(settings.authentik_jwks_url)
+    response.raise_for_status()
+    payload = response.json()
+    return {"keys": payload["keys"]}
+
+
+def verify_provider_access_token(
+    *,
+    settings: Settings,
+    token: str,
+    jwks: dict[str, list[dict[str, str]]],
+) -> dict[str, str | int]:
+    unverified_header = jwt.get_unverified_header(token)
+    key_id = unverified_header["kid"]
+    jwk_key = next(key for key in jwks["keys"] if key.get("kid") == key_id)
+    claims = jwt.decode(
+        token,
+        jwk_key,
+        algorithms=[jwk_key.get("alg", "HS256")],
+        audience=settings.authentik_audience,
+        issuer=settings.authentik_issuer,
+    )
+    return dict(claims)

apps/api/src/auth/refresh_store.py

@@ -0,0 +1,79 @@
+from datetime import UTC, datetime
+from hashlib import sha256
+from secrets import token_urlsafe
+
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from src.models.refresh_token import RefreshToken
+
+
+def hash_refresh_token(raw_token: str) -> str:
+    return sha256(raw_token.encode("utf-8")).hexdigest()
+
+
+async def create_refresh_token(
+    *,
+    session: AsyncSession,
+    user_id: object,
+    expires_at: datetime,
+    user_agent: str | None,
+    ip_address: str | None,
+) -> tuple[str, RefreshToken]:
+    raw_token = token_urlsafe(48)
+    record = RefreshToken(
+        user_id=user_id,
+        token_hash=hash_refresh_token(raw_token),
+        expires_at=expires_at,
+        created_at=datetime.now(UTC),
+        user_agent=user_agent,
+        ip_address=ip_address,
+    )
+    session.add(record)
+    await session.commit()
+    await session.refresh(record)
+    return raw_token, record
+
+
+async def rotate_refresh_token(
+    *,
+    session: AsyncSession,
+    raw_token: str,
+    user_agent: str | None,
+    ip_address: str | None,
+) -> tuple[str, RefreshToken]:
+    existing_hash = hash_refresh_token(raw_token)
+    existing = await session.scalar(
+        select(RefreshToken).where(
+            RefreshToken.token_hash == existing_hash,
+            RefreshToken.revoked_at.is_(None),
+        )
+    )
+    if existing is None:
+        raise ValueError("refresh token not found")
+    if existing.expires_at <= datetime.now(UTC):
+        raise ValueError("refresh token expired")
+
+    existing.revoked_at = datetime.now(UTC)
+    await session.flush()
+
+    return await create_refresh_token(
+        session=session,
+        user_id=existing.user_id,
+        expires_at=existing.expires_at,
+        user_agent=user_agent,
+        ip_address=ip_address,
+    )
+
+
+async def revoke_refresh_token(*, session: AsyncSession, raw_token: str) -> bool:
+    token_hash = hash_refresh_token(raw_token)
+    existing = await session.scalar(select(RefreshToken).where(RefreshToken.token_hash == token_hash))
+    if existing is None:
+        return False
+    if existing.revoked_at is not None:
+        return True
+
+    existing.revoked_at = datetime.now(UTC)
+    await session.commit()
+    return True