summaryrefslogtreecommitdiffstats
path: root/packages/meshbay-hub/src/meshbay_hub/auth.py
diff options
context:
space:
mode:
Diffstat (limited to 'packages/meshbay-hub/src/meshbay_hub/auth.py')
-rw-r--r--packages/meshbay-hub/src/meshbay_hub/auth.py3
1 files changed, 3 insertions, 0 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/auth.py b/packages/meshbay-hub/src/meshbay_hub/auth.py
index a4c3bfb..2b2c61e 100644
--- a/packages/meshbay-hub/src/meshbay_hub/auth.py
+++ b/packages/meshbay-hub/src/meshbay_hub/auth.py
@@ -105,10 +105,12 @@ def issue_access_token(
user_id: str,
pk_user: str,
ttl: int = 3600,
+ groups: list[str] | None = None,
) -> str:
"""
Issue a signed JWT access token.
Includes jti (UUID4) — required to prevent replay and enable revocation.
+ Includes groups — list of group_ids the user is a member of (node-side authz).
"""
if _hub_sk_pem is None:
raise RuntimeError("Hub keypair not loaded")
@@ -121,6 +123,7 @@ def issue_access_token(
"jti": str(uuid.uuid4()),
"iat": now,
"exp": now + ttl,
+ "groups": groups or [],
}
return jwt.encode(payload, _hub_sk_pem, algorithm="EdDSA")