Виджет

import time
import jwt  # pip install pyjwt[crypto]
import requests

JWKS_URL = "https://aisevenai.ru/api/v1/partner/.well-known/jwks.json"
ISSUER = "https://aisevenai.ru"
AUDIENCE = "<идентификатор вашей интеграции>"

JWKS_MAX_AGE = 600
UNKNOWN_KID_COOLDOWN = 60

_keys: dict[str, jwt.PyJWK] = {}
_fetched_at = 0.0


def _key(kid: str) -> jwt.PyJWK:
    global _keys, _fetched_at
    age = time.time() - _fetched_at
    if age >= JWKS_MAX_AGE or (kid not in _keys and age >= UNKNOWN_KID_COOLDOWN):
        jwks = requests.get(JWKS_URL, timeout=5).json()
        _keys = {k["kid"]: jwt.PyJWK(k) for k in jwks["keys"]}
        _fetched_at = time.time()
    return _keys[kid]


def verify_widget_token(token: str) -> dict:
    kid = jwt.get_unverified_header(token)["kid"]
    claims = jwt.decode(
        token,
        _key(kid).key,
        algorithms=["RS256"],
        issuer=ISSUER,
        audience=AUDIENCE,
        leeway=60,
        options={"require": ["iss", "aud", "sub", "iat", "exp", "jti"]},
    )
    remember_jti_or_reject(claims["jti"], until=claims["exp"] + 60)
    return claims

import { createRemoteJWKSet, jwtVerify } from "jose";

const JWKS = createRemoteJWKSet(
  new URL("https://aisevenai.ru/api/v1/partner/.well-known/jwks.json"),
  { cooldownDuration: 60_000, cacheMaxAge: 600_000 },
);

export async function verifyWidgetToken(token) {
  const { payload } = await jwtVerify(token, JWKS, {
    algorithms: ["RS256"],
    issuer: "https://aisevenai.ru",
    audience: "<идентификатор вашей интеграции>",
    clockTolerance: 60,
    maxTokenAge: 300 + 60,
    requiredClaims: ["sub", "iat", "exp", "jti"],
  });
  await rememberJtiOrReject(payload.jti, payload.exp + 60);
  return payload;
}