portal-auth-jwt

Create an OAuth2PasswordBearer scheme pointing at your token endpoint, encode tokens with PyJWT using HS256 and a 32-byte secret, and decode them in a get_current_user dependency. Include sub and scope claims with a 30-minute expiration.

Pass scopes to Security(get_current_user, scopes=["admin"]) on each endpoint, then compare the token's role claim against required scopes using a role hierarchy. Return 401 for invalid tokens and 403 for authenticated users lacking permission.

Verifying a dummy Argon2 hash when the username is missing keeps response time constant, preventing timing attacks that reveal whether an account exists. pwdlib's PasswordHash.recommended() provides the Argon2id hashing used for both real and dummy verification.

No, refresh tokens are explicitly out of scope by design decision. Tokens expire after 30 minutes and users re-login cleanly, which simplifies revocation and reduces token-theft exposure.

Pass the user's Bearer token into each tool's HTTP call via the Authorization header when calling governed API endpoints. A 403 from the downstream endpoint means the user lacks the required scope, and that error should be surfaced rather than bypassed.

Deletion is a soft delete setting disabled=true, and get_current_user rejects disabled users so the block takes effect on the next request. An admin cannot deactivate or demote themselves, and duplicate usernames or emails return 409.