【認証・許可系/Auth系】API認証の設計/実装について📝

from datetime import timedelta, datetime
from jose import jwt, JWTError
from passlib.context import CryptContext
from fastapi import Depends, Header, HTTPException, status

SECRET_KEY = "<<<強力なランダム文字列>>>"
ALGORITHM = "HS256"
ACCESS_LIFETIME = timedelta(minutes=30)

pwd_ctx = CryptContext(schemes=["bcrypt"], deprecated="auto")

def create_access_token(sub: str) -> str:
    exp = datetime.utcnow() + ACCESS_LIFETIME
    to_encode = {"sub": sub, "exp": exp}
    return jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)

oauth2_scheme = OAuth2PasswordBearer(tokenUrl="/auth/token")

async def get_current_user(token: str = Depends(oauth2_scheme)):
    try:
        payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
        return payload["sub"]
    except JWTError:
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED)

import { Hono } from 'hono';

const API_KEY = process.env.FASTAPI_MCP_API_KEY ?? 'secret-fast-api-mcp-token';

const app = new Hono();

// 認証付き
app.get('/protected', (c) => {
  const key = c.req.header('x-api-key');
  if (key !== API_KEY) return c.json({ error: 'Unauthorized' }, 401);
  return c.text('OK!');
});

// 認証不要
app.get('/public', (c) => c.text('Hello, World!'));

export default app;