marcos
9378fe0427
A deliberately small Python service — auth helpers, a sqlite-backed store, and two request handlers — plus a .pr-review.json that steers the reviewer toward this repo's house rules. Pull requests against it carry planted defects so the reviewer has something real to find.
27 lines
537 B
Python
27 lines
537 B
Python
"""Token and session helpers."""
|
|
|
|
import hmac
|
|
import secrets
|
|
|
|
_SESSIONS: dict[str, str] = {}
|
|
|
|
|
|
def new_token() -> str:
|
|
"""Generate an opaque session token."""
|
|
return secrets.token_urlsafe(32)
|
|
|
|
|
|
def verify_token(supplied: str, expected: str) -> bool:
|
|
"""Constant-time token comparison."""
|
|
return hmac.compare_digest(supplied, expected)
|
|
|
|
|
|
def login(user_id: str) -> str:
|
|
token = new_token()
|
|
_SESSIONS[token] = user_id
|
|
return token
|
|
|
|
|
|
def user_for_token(token: str) -> str | None:
|
|
return _SESSIONS.get(token)
|