Method _validate_dashboard_token

astrbot/dashboard/server.py:317–349

Validate a dashboard JWT or scoped plugin page asset token. Args: token: JWT value from the Authorization header, cookie, or query string. path: Current request path used for plugin page asset token scope checks. Returns: A tuple of the decoded p

(
        self,
        token: str,
        path: str,
    )

        return r

    def _validate_dashboard_token(
        self,
        token: str,
        path: str,
    ) -> tuple[dict[str, Any] | None, str]:
        """Validate a dashboard JWT or scoped plugin page asset token.

        Args:
            token: JWT value from the Authorization header, cookie, or query string.
            path: Current request path used for plugin page asset token scope checks.

        Returns:
            A tuple of the decoded payload and an error message. The payload is
            present only when the token is valid for the current request path.
        """
        try:
            payload = jwt.decode(token, self._jwt_secret, algorithms=["HS256"])
        except jwt.ExpiredSignatureError:
            return None, "Token 过期"
        except jwt.InvalidTokenError:
            return None, "Token 无效"

        if PluginPageAuth.is_asset_token(payload) and not PluginPageAuth.is_scope_valid(
            payload,
            path,
        ):
            return None, "Token 无效"

        username = payload.get("username")
        if not isinstance(username, str) or not username.strip():
            return None, "Token 无效"

        return payload, ""

    async def _apply_auth_rate_limit(
        self,