인증 & 보안

from starlette.middleware.base import BaseHTTPMiddleware
from starlette.responses import JSONResponse
import jwt  # pip install python-jose[cryptography]

class BearerAuthMiddleware(BaseHTTPMiddleware):
    def __init__(self, app, jwks_uri: str):
        super().__init__(app)
        self.jwks_uri = jwks_uri

    async def dispatch(self, request, call_next):
        auth = request.headers.get("Authorization", "")
        if not auth.startswith("Bearer "):
            return JSONResponse(
                {"error": "unauthorized"}, status_code=401
            )
        token = auth[7:]
        try:
            payload = jwt.decode(token, self.jwks_uri, algorithms=["RS256"])
            request.state.user = payload
        except jwt.ExpiredSignatureError:
            return JSONResponse({"error": "token_expired"}, status_code=401)
        except jwt.JWTError:
            return JSONResponse({"error": "invalid_token"}, status_code=401)
        return await call_next(request)