feat(appliance): initial release of MERICA standalone appliance v1.0.0

backend/app/core/auth/security.py

@@ -0,0 +1,52 @@
+import hmac
+import hashlib
+from datetime import datetime, timedelta, timezone
+from typing import Optional, Dict, Any
+import jwt
+
+from app.core.config import settings
+
+
+def verify_password(plain_password: str, stored_password: str) -> bool:
+    """Constant-time password comparison to prevent timing attacks."""
+    if not plain_password or not stored_password:
+        return False
+    # Supports direct string comparison via hmac or sha256 hash
+    if stored_password.startswith("sha256$"):
+        _, salt, expected_hash = stored_password.split("$", 2)
+        calc_hash = hashlib.sha256((salt + plain_password).encode("utf-8")).hexdigest()
+        return hmac.compare_digest(calc_hash, expected_hash)
+    
+    return hmac.compare_digest(plain_password, stored_password)
+
+
+def hash_password(plain_password: str, salt: str = "merica_dlh_salt") -> str:
+    """Generate salted sha256 password hash."""
+    calc_hash = hashlib.sha256((salt + plain_password).encode("utf-8")).hexdigest()
+    return f"sha256${salt}${calc_hash}"
+
+
+def create_session_token(data: Dict[str, Any], expires_delta: Optional[timedelta] = None) -> str:
+    """Create a unified session JWT token signed with SECRET_KEY."""
+    to_encode = data.copy()
+    now = datetime.now(timezone.utc)
+    if expires_delta:
+        expire = now + expires_delta
+    else:
+        expire = now + timedelta(minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES)
+    
+    to_encode.update({
+        "exp": int(expire.timestamp()),
+        "iat": int(now.timestamp())
+    })
+    encoded_jwt = jwt.encode(to_encode, settings.SECRET_KEY, algorithm=settings.ALGORITHM)
+    return encoded_jwt
+
+
+def decode_session_token(token: str) -> Optional[Dict[str, Any]]:
+    """Decode and validate a session JWT token."""
+    try:
+        payload = jwt.decode(token, settings.SECRET_KEY, algorithms=[settings.ALGORITHM])
+        return payload
+    except Exception:
+        return None