JWT

const jwt = require('jsonwebtoken');
const crypto = require('crypto');

// ✅ JWT - Configuration Sécurisée Production 2024
class JWTManager {
  constructor(options = {}) {
    // Configuration sécurisée recommandée
    this.config = {
      // Clé secrète forte (256+ bits pour HS256)
      secret: options.secret || crypto.randomBytes(64).toString('hex'),
      
      // Algorithmes recommandés
      algorithm: 'RS256',  // Asymétrique recommandé (ou ES256)
      
      // Durées de vie sécurisées
      accessTokenTTL: '15m',      // Access token court
      refreshTokenTTL: '7d',      // Refresh token plus long
      
      // Émetteur et audience
      issuer: options.issuer || 'hashbj-auth-service',
      audience: options.audience || 'hashbj-clients'
    };
    
    // Générer paire de clés RSA pour production
    if (!options.privateKey || !options.publicKey) {
      this.generateKeyPair();
    } else {
      this.privateKey = options.privateKey;
      this.publicKey = options.publicKey;
    }
  }

  // Création token sécurisé
  createAccessToken(payload, options = {}) {
    const now = Math.floor(Date.now() / 1000);
    
    const tokenPayload = {
      // Claims standard
      iss: this.config.issuer,
      aud: this.config.audience,
      sub: payload.userId || payload.sub,
      iat: now,
      exp: now + this.parseTTL(options.ttl || this.config.accessTokenTTL),
      
      // Sécurité additionnelle
      jti: crypto.randomUUID(), // Token ID unique
      
      // Claims custom
      ...payload
    };
    
    const token = jwt.sign(tokenPayload, this.privateKey, {
      algorithm: this.config.algorithm
    });
    
    return {
      token: token,
      payload: tokenPayload,
      algorithm: this.config.algorithm,
      expires_in: this.parseTTL(options.ttl || this.config.accessTokenTTL),
      token_type: 'Bearer',
      security_level: 'HIGH'
    };
  }

  // Vérification token sécurisée
  verifyToken(token, options = {}) {
    try {
      const decoded = jwt.verify(token, this.publicKey, {
        algorithms: [this.config.algorithm],
        issuer: this.config.issuer,
        audience: this.config.audience,
        ...options
      });
      
      return {
        valid: true,
        decoded: decoded,
        algorithm: this.config.algorithm,
        time_remaining: decoded.exp - Math.floor(Date.now() / 1000)
      };
      
    } catch (error) {
      return {
        valid: false,
        error: error.message,
        error_type: this.categorizeError(error)
      };
    }
  }
}

import jwt
import secrets
import time
from datetime import datetime, timedelta, timezone
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.asymmetric import rsa

class JWTManager:
    """JWT Manager sécurisé pour production Python"""
    
    def __init__(self, **kwargs):
        # Configuration sécurisée
        self.config = {
            'algorithm': 'RS256',  # Asymétrique recommandé
            'access_token_ttl': timedelta(minutes=15),
            'refresh_token_ttl': timedelta(days=7),
            'issuer': kwargs.get('issuer', 'hashbj-auth-service'),
            'audience': kwargs.get('audience', 'hashbj-clients')
        }
        
        # Générer clés RSA si non fournies
        if 'private_key' in kwargs and 'public_key' in kwargs:
            self.private_key = kwargs['private_key']
            self.public_key = kwargs['public_key']
        else:
            self._generate_key_pair()
    
    def create_access_token(self, payload):
        """Création access token sécurisé"""
        now = datetime.now(timezone.utc)
        exp_time = now + self.config['access_token_ttl']
        
        token_payload = {
            # Claims standard RFC 7519
            'iss': self.config['issuer'],
            'aud': self.config['audience'],
            'sub': payload.get('user_id', payload.get('sub')),
            'iat': int(now.timestamp()),
            'exp': int(exp_time.timestamp()),
            'jti': str(secrets.token_urlsafe(16)),
            
            # Claims custom
            **{k: v for k, v in payload.items() if k not in ['iss', 'aud', 'sub', 'iat', 'exp', 'jti']}
        }
        
        token = jwt.encode(
            payload=token_payload,
            key=self.private_key,
            algorithm=self.config['algorithm']
        )
        
        return {
            'token': token,
            'algorithm': self.config['algorithm'],
            'expires_in': int(self.config['access_token_ttl'].total_seconds()),
            'token_type': 'Bearer',
            'security_level': 'HIGH'
        }
    
    def verify_token(self, token):
        """Vérification token avec checks sécurité complets"""
        try:
            decoded = jwt.decode(
                jwt=token,
                key=self.public_key,
                algorithms=[self.config['algorithm']],
                issuer=self.config['issuer'],
                audience=self.config['audience']
            )
            
            return {
                'valid': True,
                'decoded': decoded,
                'algorithm': self.config['algorithm']
            }
            
        except jwt.ExpiredSignatureError:
            return {'valid': False, 'error': 'Token expired'}
        except jwt.InvalidTokenError as e:
            return {'valid': False, 'error': str(e)}

# Usage Production
manager = JWTManager(
    issuer='my-auth-service',
    audience='my-client-apps'
)

# Créer token
token_result = manager.create_access_token({
    'user_id': 'user123',
    'role': 'admin'
})

print(f"Token: {token_result}")

# Vérifier token
verification = manager.verify_token(token_result['token'])
print(f"Verification: {verification}")