Function create_access_token

apps/api/src/security/auth.py:139–157

Create a JWT access token. SECURITY: always sets ``exp`` and ``iat`` claims. ``iat`` lets :func:`get_current_user` enforce both password-change-based revocation and the logout blocklist (see :func:`revoke_user_sessions_before`), neither of which can work on tokens missing an is

(data: dict, expires_delta: timedelta | None = None)

def create_access_token(data: dict, expires_delta: timedelta | None = None):
    """
    Create a JWT access token.

    SECURITY: always sets ``exp`` and ``iat`` claims. ``iat`` lets
    :func:`get_current_user` enforce both password-change-based revocation and
    the logout blocklist (see :func:`revoke_user_sessions_before`), neither of
    which can work on tokens missing an issuance timestamp.
    """
    to_encode = data.copy()
    now = datetime.now(timezone.utc)
    if expires_delta:
        expire = now + expires_delta
    else:
        # SECURITY: Always set expiration (8 hours default)
        expire = now + JWT_ACCESS_TOKEN_EXPIRES
    to_encode.update({"exp": expire, "iat": now})
    encoded_jwt = jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)
    return encoded_jwt


JWT_REFRESH_TOKEN_EXPIRES = timedelta(days=30)