bazis-users 2.2.0__tar.gz → 2.3.0__tar.gz

bazis_users-2.3.0/.github/workflows/build-publish.yml

@@ -0,0 +1,20 @@
+name: Build and Publish
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+  # started by the Release workflow on the tag it creates: a tag pushed with the
+  # workflow token does not trigger the push event above
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    if: startsWith(github.ref, 'refs/tags/v')
+    uses: ecofuture-tech/.github/.github/workflows/reusable-build-publish.yml@main
+    secrets:
+      PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
+      TEST_PYPI_TOKEN: ${{ secrets.TEST_PYPI_TOKEN }}

bazis_users-2.3.0/.github/workflows/release.yml

@@ -0,0 +1,74 @@
+name: Release
+
+# Creates the release tag vX.Y.Z on the current main commit and starts Build and Publish
+# for it. Run it from the Actions tab (or through the GitHub API) on the main branch.
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version without the "v" prefix, e.g. 2.3.0 or 2.4.0-rc1'
+        required: true
+        type: string
+
+permissions:
+  contents: write
+  actions: write
+
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    if: github.ref == 'refs/heads/main'
+    env:
+      GH_TOKEN: ${{ github.token }}
+      VERSION: ${{ inputs.version }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Validate the version
+        run: |
+          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-(alpha|beta|rc)[0-9]+)?$ ]]; then
+            echo "::error::Invalid version '$VERSION', expected e.g. 2.3.0 or 2.4.0-rc1"
+            exit 1
+          fi
+          if git rev-parse -q --verify "refs/tags/v$VERSION" >/dev/null; then
+            echo "::error::Tag v$VERSION already exists"
+            exit 1
+          fi
+          LAST_TAG=$(git tag --list 'v*' --sort=-v:refname | head -n 1)
+          echo "Last release: ${LAST_TAG:-none}, new release: v$VERSION"
+          if [ -n "$LAST_TAG" ] && [ "$(printf '%s\n%s\n' "${LAST_TAG#v}" "$VERSION" | sort -V | tail -n 1)" != "$VERSION" ]; then
+            echo "::error::Version $VERSION is not newer than $LAST_TAG"
+            exit 1
+          fi
+
+      - name: Require green tests on this commit
+        run: |
+          CONCLUSION=$(gh run list --workflow tests.yml --commit "$GITHUB_SHA" --status completed \
+            --json conclusion --jq 'map(.conclusion) | first // "none"')
+          echo "Tests on $GITHUB_SHA: $CONCLUSION"
+          if [ "$CONCLUSION" != "success" ]; then
+            echo "::error::The Tests workflow has not succeeded on $GITHUB_SHA ($CONCLUSION)"
+            exit 1
+          fi
+
+      - name: Create the tag
+        run: |
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          git tag -a "v$VERSION" -m "${{ github.event.repository.name }} $VERSION" "$GITHUB_SHA"
+          git push origin "v$VERSION"
+
+      - name: Start Build and Publish
+        run: gh workflow run build-publish.yml --ref "v$VERSION"
+
+      - name: Summary
+        run: |
+          echo "Tagged \`v$VERSION\` at \`$GITHUB_SHA\` and started Build and Publish." >> "$GITHUB_STEP_SUMMARY"

bazis_users-2.3.0/.github/workflows/tests.yml

@@ -0,0 +1,99 @@
+name: Tests
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: tests-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - run: uvx ruff check bazis tests
+
+  tests:
+    name: tests (python ${{ matrix.python }}, ${{ matrix.resolution }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ['3.12', '3.13', '3.14']
+        resolution: [highest]
+        include:
+          # the lowest versions allowed by pyproject.toml
+          - python: '3.12'
+            resolution: lowest-direct
+
+    services:
+      postgres:
+        image: postgis/postgis:16-3.4
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: bazis
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+      redis:
+        image: redis:7
+        ports:
+          - 6379:6379
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    env:
+      BS_DEBUG: 'true'
+      BS_SECRET_KEY: ci-only-secret-key-that-is-long-enough-0123456789
+      BS_DATABASES__DEFAULT__HOST: localhost
+      BS_DATABASES__DEFAULT__PORT: '5432'
+      BS_DATABASES__DEFAULT__NAME: bazis
+      BS_DATABASES__DEFAULT__USER: postgres
+      BS_DATABASES__DEFAULT__PASSWORD: postgres
+      BS_CACHES__DEFAULT__LOCATION: redis://localhost:6379/1
+      BS_MEDIA_ROOT: /tmp/bazis/media
+      BS_STATIC_ROOT: /tmp/bazis/static
+      BS_WEBAPP_ROOT: /tmp/bazis/webapp
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install GDAL (required by the PostGIS database backend)
+        # a stalled Ubuntu mirror must fail the step quickly instead of hanging the job
+        timeout-minutes: 10
+        run: |
+          APT="sudo apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30"
+          $APT update
+          $APT install -y --no-install-recommends gdal-bin
+
+      - uses: astral-sh/setup-uv@v6
+        with:
+          python-version: ${{ matrix.python }}
+          activate-environment: true
+
+      - name: Install dependencies
+        run: uv pip install --resolution ${{ matrix.resolution }} -e '.[test]'
+
+      - name: Check for missing migrations
+        working-directory: sample
+        run: python manage.py makemigrations --check --dry-run
+
+      - name: Run tests
+        working-directory: sample
+        run: python -m pytest ../tests -o addopts="" -p no:cacheprovider

bazis_users-2.3.0/CLAUDE.md

@@ -0,0 +1,55 @@
+# bazis-users
+
+User management for Bazis: abstract user models, session JWTs (`UserAbstract.jwt_build`,
+`service.decode_token`), the FastAPI dependencies `get_user_required` / `get_user_optional`,
+the token endpoint and the user context (`UserMixin.CTX_USER_REQUEST`) used by
+bazis-author and bazis-permit.
+
+Security: session tokens are signed with `SECRET_KEY`, so only HMAC algorithms are allowed
+and `exp`/`sub` are required. A context variable set for a request must be reset after it
+(WSGI servers reuse threads).
+
+The package code is in `bazis/contrib/users`, the sample project used by the tests is in `sample/`,
+the tests are in `tests/`.
+
+## Running the tests
+
+The tests need PostgreSQL with PostGIS and Redis (see `.github/workflows/tests.yml`).
+Run them from the `sample` directory:
+
+```bash
+cd sample
+BS_DEBUG=true \
+BS_SECRET_KEY=local-secret-key-that-is-long-enough-0123456789 \
+BS_DATABASES__DEFAULT__HOST=localhost BS_DATABASES__DEFAULT__PORT=5432 \
+BS_DATABASES__DEFAULT__NAME=bazis BS_DATABASES__DEFAULT__USER=postgres \
+BS_DATABASES__DEFAULT__PASSWORD=postgres \
+BS_CACHES__DEFAULT__LOCATION=redis://localhost:6379/1 \
+BS_MEDIA_ROOT=/tmp/bazis/media BS_STATIC_ROOT=/tmp/bazis/static BS_WEBAPP_ROOT=/tmp/bazis/webapp \
+python -m pytest ../tests -o addopts="" -p no:cacheprovider
+```
+
+Lint: `ruff check bazis tests`. CI also runs `python manage.py makemigrations --check
+--dry-run` in `sample`: commit the migrations of model changes, including the sample apps.
+
+## Releasing
+
+A release is the tag `vX.Y.Z` on `main`: the Build and Publish workflow builds the package
+(the version comes from the tag through setuptools-scm) and publishes it to PyPI
+(pre-releases `-alphaN`/`-betaN`/`-rcN` go to Test PyPI) and creates the GitHub release.
+
+Claude Code sessions cannot push tags. Release through the **Release** workflow instead:
+
+1. Make sure the changes are merged into `main` and the Tests workflow is green on the
+   `main` head commit (the Release workflow checks this and refuses otherwise).
+2. Add the release notes as `docs/releases/X.Y.Z.md` in the change being released.
+3. Start the workflow `release.yml` on `ref: main` with the input `version: X.Y.Z`
+   (GitHub API: `POST /repos/ecofuture-tech/bazis-users/actions/workflows/release.yml/dispatches`;
+   with the GitHub MCP tools: `actions_run_trigger`, method `run_workflow`).
+4. The Release run creates the annotated tag and starts Build and Publish on it. Check
+   that both runs succeed and that the version appears on https://pypi.org/project/bazis-users/.
+
+Release the Bazis packages in dependency order: a package is tested in CI against the
+versions of its Bazis dependencies published on PyPI. Pick the version by semver:
+breaking changes (settings renamed or required, dependency removed, behavior changed)
+bump the minor version while the project is below 3.0.

{bazis_users-2.2.0 → bazis_users-2.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bazis-users
-Version: 2.2.0
+Version: 2.3.0
 Summary: User management module for Bazis framework.
 Author-email: Ilya Kharyn <ilya.tt07@gmail.com>
 Maintainer-email: Ilya Kharyn <ilya.tt07@gmail.com>
@@ -17,10 +17,11 @@ Classifier: Framework :: Django
 Classifier: Framework :: FastAPI
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
-Requires-Dist: bazis
-Requires-Dist: python-multipart
+Requires-Dist: bazis>=2.3.0
+Requires-Dist: python-multipart>=0.0.18
+Requires-Dist: PyJWT>=2.10
 Provides-Extra: test
-Requires-Dist: bazis-test-utils; extra == "test"
+Requires-Dist: bazis-test-utils>=2.3.0; extra == "test"
 Provides-Extra: dev
 Requires-Dist: ruff; extra == "dev"
 
@@ -232,26 +233,33 @@ class MyUserRouteSet(UserRouteSet):
 
 Services for working with users and tokens.
 
-**Location**: `bazis.contrib.users.services`
+**Location**: `bazis.contrib.users.service`
 
 #### get_token_data
 
-Extracts data from JWT token.
+Extracts data from the JWT token. The token is read from the `bazis_auth` query parameter,
+the `Authorization: Bearer` header or the `bazis_auth` cookie (the name is
+`BAZIS_AUTH_COOKIE_NAME`). It must be signed with `SECRET_KEY` using
+`BAZIS_JWT_SESSION_ALG` (`HS256`, `HS384` or `HS512`) and contain `exp` and `sub`
+(the username); otherwise the request fails with 401. Without a token the result is `{}`.
 
 ```python
-from bazis.contrib.users.services import get_token_data
+from bazis.contrib.users.service import get_token_data
 
-def my_endpoint(token: str = Depends(get_token_data)):
-    user_id = token.get('user_id')
+def my_endpoint(token: dict = Depends(get_token_data)):
+    username = token.get('sub')
     # Work with token data
 ```
 
+`decode_token(token)` verifies a token outside of a request and raises
+`jwt.ExpiredSignatureError` / `jwt.InvalidTokenError`.
+
 #### get_user_from_token
 
 Gets user from token.
 
 ```python
-from bazis.contrib.users.services import get_user_from_token
+from bazis.contrib.users.service import get_user_from_token
 
 def my_endpoint(user = Depends(get_user_from_token)):
     # user - user object or AnonymousUser
@@ -263,7 +271,7 @@ def my_endpoint(user = Depends(get_user_from_token)):
 Gets user from request (authentication required).
 
 ```python
-from bazis.contrib.users.services import get_user_required
+from bazis.contrib.users.service import get_user_required
 
 def my_endpoint(user = Depends(get_user_required)):
     # user - authenticated user
@@ -276,7 +284,7 @@ def my_endpoint(user = Depends(get_user_required)):
 Gets user from request (authentication optional).
 
 ```python
-from bazis.contrib.users.services import get_user_optional
+from bazis.contrib.users.service import get_user_optional
 
 def my_endpoint(user = Depends(get_user_optional)):
     # user - user or AnonymousUser
@@ -347,7 +355,7 @@ router.register(routes.MyUserRouteSet.as_router())
 Use `get_user_required` for endpoints that require authentication:
 
 ```python
-from bazis.contrib.users.services import get_user_required
+from bazis.contrib.users.service import get_user_required
 from fastapi import APIRouter, Depends
 from pydantic import BaseModel
 
@@ -372,7 +380,7 @@ def change_password(
 Use `get_user_optional` for endpoints available to everyone:
 
 ```python
-from bazis.contrib.users.services import get_user_optional, get_token_data
+from bazis.contrib.users.service import get_user_optional, get_token_data
 from fastapi import Depends
 
 @router.get('/auth/', response_model=AuthResponse)
@@ -395,14 +403,14 @@ def auth(
 Getting data from JWT token without loading the user:
 
 ```python
-from bazis.contrib.users.services import get_token_data
+from bazis.contrib.users.service import get_token_data
 from fastapi import Depends
 
 @router.get('/token-info/')
 def token_info(token_data: dict = Depends(get_token_data)):
     # token_data contains decoded data from JWT
     return {
-        "user_id": token_data.get("user_id"),
+        "username": token_data.get("sub"),
         "exp": token_data.get("exp"),
     }
 ```
@@ -502,7 +510,7 @@ class Task(UserMixin, DtMixin, UuidMixin, JsonApiMixin):
 **routes.py**:
 ```python
 from bazis.contrib.users.routes import UserRouteSet
-from bazis.contrib.users.services import get_user_required
+from bazis.contrib.users.service import get_user_required
 from django.apps import apps
 from fastapi import APIRouter, Depends
 from pydantic import BaseModel

{bazis_users-2.2.0 → bazis_users-2.3.0}/README.md

@@ -206,26 +206,33 @@ class MyUserRouteSet(UserRouteSet):
 
 Services for working with users and tokens.
 
-**Location**: `bazis.contrib.users.services`
+**Location**: `bazis.contrib.users.service`
 
 #### get_token_data
 
-Extracts data from JWT token.
+Extracts data from the JWT token. The token is read from the `bazis_auth` query parameter,
+the `Authorization: Bearer` header or the `bazis_auth` cookie (the name is
+`BAZIS_AUTH_COOKIE_NAME`). It must be signed with `SECRET_KEY` using
+`BAZIS_JWT_SESSION_ALG` (`HS256`, `HS384` or `HS512`) and contain `exp` and `sub`
+(the username); otherwise the request fails with 401. Without a token the result is `{}`.
 
 ```python
-from bazis.contrib.users.services import get_token_data
+from bazis.contrib.users.service import get_token_data
 
-def my_endpoint(token: str = Depends(get_token_data)):
-    user_id = token.get('user_id')
+def my_endpoint(token: dict = Depends(get_token_data)):
+    username = token.get('sub')
     # Work with token data
 ```
 
+`decode_token(token)` verifies a token outside of a request and raises
+`jwt.ExpiredSignatureError` / `jwt.InvalidTokenError`.
+
 #### get_user_from_token
 
 Gets user from token.
 
 ```python
-from bazis.contrib.users.services import get_user_from_token
+from bazis.contrib.users.service import get_user_from_token
 
 def my_endpoint(user = Depends(get_user_from_token)):
     # user - user object or AnonymousUser
@@ -237,7 +244,7 @@ def my_endpoint(user = Depends(get_user_from_token)):
 Gets user from request (authentication required).
 
 ```python
-from bazis.contrib.users.services import get_user_required
+from bazis.contrib.users.service import get_user_required
 
 def my_endpoint(user = Depends(get_user_required)):
     # user - authenticated user
@@ -250,7 +257,7 @@ def my_endpoint(user = Depends(get_user_required)):
 Gets user from request (authentication optional).
 
 ```python
-from bazis.contrib.users.services import get_user_optional
+from bazis.contrib.users.service import get_user_optional
 
 def my_endpoint(user = Depends(get_user_optional)):
     # user - user or AnonymousUser
@@ -321,7 +328,7 @@ router.register(routes.MyUserRouteSet.as_router())
 Use `get_user_required` for endpoints that require authentication:
 
 ```python
-from bazis.contrib.users.services import get_user_required
+from bazis.contrib.users.service import get_user_required
 from fastapi import APIRouter, Depends
 from pydantic import BaseModel
 
@@ -346,7 +353,7 @@ def change_password(
 Use `get_user_optional` for endpoints available to everyone:
 
 ```python
-from bazis.contrib.users.services import get_user_optional, get_token_data
+from bazis.contrib.users.service import get_user_optional, get_token_data
 from fastapi import Depends
 
 @router.get('/auth/', response_model=AuthResponse)
@@ -369,14 +376,14 @@ def auth(
 Getting data from JWT token without loading the user:
 
 ```python
-from bazis.contrib.users.services import get_token_data
+from bazis.contrib.users.service import get_token_data
 from fastapi import Depends
 
 @router.get('/token-info/')
 def token_info(token_data: dict = Depends(get_token_data)):
     # token_data contains decoded data from JWT
     return {
-        "user_id": token_data.get("user_id"),
+        "username": token_data.get("sub"),
         "exp": token_data.get("exp"),
     }
 ```
@@ -476,7 +483,7 @@ class Task(UserMixin, DtMixin, UuidMixin, JsonApiMixin):
 **routes.py**:
 ```python
 from bazis.contrib.users.routes import UserRouteSet
-from bazis.contrib.users.services import get_user_required
+from bazis.contrib.users.service import get_user_required
 from django.apps import apps
 from fastapi import APIRouter, Depends
 from pydantic import BaseModel

bazis_users-2.3.0/bazis/contrib/users/_version.py

@@ -0,0 +1,24 @@
+# file generated by vcs-versioning
+# don't change, don't track in version control
+from __future__ import annotations
+
+__all__ = [
+    "__version__",
+    "__version_tuple__",
+    "version",
+    "version_tuple",
+    "__commit_id__",
+    "commit_id",
+]
+
+version: str
+__version__: str
+__version_tuple__: tuple[int | str, ...]
+version_tuple: tuple[int | str, ...]
+commit_id: str | None
+__commit_id__: str | None
+
+__version__ = version = '2.3.0'
+__version_tuple__ = version_tuple = (2, 3, 0)
+
+__commit_id__ = commit_id = 'g5959b6ec7'

{bazis_users-2.2.0 → bazis_users-2.3.0}/bazis/contrib/users/conf.py

@@ -12,12 +12,12 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+from typing import Literal
+
 from django.utils.translation import gettext_lazy as _
 
 from pydantic import Field
 
-from jose.constants import Algorithms
-
 from bazis.core.utils.schemas import BazisSettings
 
 
@@ -34,7 +34,10 @@ class Settings(BazisSettings):
     )
     BAZIS_OPENAPI_TOKEN_URL: str = Field('/api/openapi-token/', title=_('OpenAPI token`s endpoint'))
     BAZIS_AUTH_COOKIE_NAME: str = Field('bazis_auth', title=_('Name of the user cookie'))
-    BAZIS_JWT_SESSION_ALG: str = Field(Algorithms.HS256, title=_('JWT algorithm'))
+    #: session tokens are signed with SECRET_KEY, so only HMAC algorithms are allowed
+    BAZIS_JWT_SESSION_ALG: Literal['HS256', 'HS384', 'HS512'] = Field(
+        'HS256', title=_('JWT algorithm')
+    )
     BAZIS_JWT_SESSION_LIFETIME: int = Field(86400, title=_('JWT lifetime'), dynamic=True)
 
 

{bazis_users-2.2.0 → bazis_users-2.3.0}/bazis/contrib/users/middleware.py

@@ -32,6 +32,11 @@ class UserRequestMiddleware:
         Processes the incoming request, setting the user in the context if the user is
         authenticated, and then passes the request to the next middleware or view.
         """
-        if request.user and getattr(request.user, 'is_anonymous', None) is False:
-            UserMixin.CTX_USER_REQUEST.set(request.user)
-        return self.get_response(request)
+        # the context is reset after the response: a WSGI server reuses its threads,
+        # so a user left in the context would be seen by the next request of the thread
+        user = request.user if getattr(request.user, 'is_anonymous', None) is False else None
+        token = UserMixin.CTX_USER_REQUEST.set(user)
+        try:
+            return self.get_response(request)
+        finally:
+            UserMixin.CTX_USER_REQUEST.reset(token)

{bazis_users-2.2.0 → bazis_users-2.3.0}/bazis/contrib/users/models_abstract.py

@@ -29,7 +29,7 @@ from django.dispatch import receiver
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 
-from jose import jwt
+import jwt
 
 from bazis.core.models_abstract import InitialBase, JsonApiMixin
 
@@ -68,9 +68,11 @@ class UserAbstract(AbstractUser, InitialBase):
         Generates a JSON Web Token (JWT) for the user, optionally including an
         authentication type.
         """
+        dt_now = now()
         data = {
             'sub': self.username,
-            'exp': now() + timedelta(seconds=settings.BAZIS_JWT_SESSION_LIFETIME),
+            'iat': dt_now,
+            'exp': dt_now + timedelta(seconds=settings.BAZIS_JWT_SESSION_LIFETIME),
         }
         if auth_type:
             data['auth_type'] = auth_type

{bazis_users-2.2.0 → bazis_users-2.3.0}/bazis/contrib/users/service.py

@@ -20,8 +20,7 @@ from fastapi.security import OAuth2PasswordBearer
 
 from starlette.status import HTTP_401_UNAUTHORIZED
 
-from jose import JWTError, jwt
-from jose.exceptions import ExpiredSignatureError
+import jwt
 
 from bazis.core.errors import JsonApi401Exception
 
@@ -32,6 +31,23 @@ User = get_user_model() # noqa: N806
 AnonymousUser = get_anonymous_user_model()
 
 
+def decode_token(token: str) -> dict:
+    """
+    Decodes and verifies a session JWT built by `UserAbstract.jwt_build`.
+    Raises `jwt.ExpiredSignatureError` for an expired token and `jwt.InvalidTokenError`
+    for any other invalid token. Tokens without an expiration time or a subject are
+    rejected.
+    """
+    return jwt.decode(
+        token,
+        settings.SECRET_KEY,
+        algorithms=[settings.BAZIS_JWT_SESSION_ALG],
+        # iat is informational: checking it would reject tokens issued by a server whose
+        # clock is slightly ahead
+        options={'require': ['exp', 'sub'], 'verify_iat': False},
+    )
+
+
 def get_token_data(
     token_header: str = Depends(
         OAuth2PasswordBearer(tokenUrl=settings.BAZIS_OPENAPI_TOKEN_URL, auto_error=False)
@@ -40,19 +56,26 @@ def get_token_data(
     token_cookie: str | None = Cookie(default=None, alias=settings.BAZIS_AUTH_COOKIE_NAME),
 ) -> dict:
     """
-    Decodes the JWT token provided by the client. If the token is missing or
-    invalid, returns an empty dictionary. Raises a JsonApi401Exception if the token
-    has expired.
+    Decodes the JWT token provided by the client. Returns an empty dictionary if there
+    is no token or the token is not a session token (no expiration). Raises
+    JsonApi401Exception if the token has expired or is invalid.
     """
     token = token_param or token_header or token_cookie
 
     if not token:
         return {}
     try:
-        return jwt.decode(token, settings.SECRET_KEY, algorithms=[settings.BAZIS_JWT_SESSION_ALG])
-    except ExpiredSignatureError:
+        return decode_token(token)
+    except jwt.ExpiredSignatureError:
         raise JsonApi401Exception(detail=str(_('Token has expired'))) from None
-    except JWTError:
+    except jwt.MissingRequiredClaimError as exc:
+        if exc.claim == 'exp':
+            # a token signed with SECRET_KEY but without expiration is not a session token
+            # (e.g. the token of the authorization store of bazis-authing, which uses the
+            # same cookie): it identifies nobody, the request is anonymous
+            return {}
+        raise JsonApi401Exception(detail=str(_('Token is invalid'))) from None
+    except jwt.InvalidTokenError:
         raise JsonApi401Exception(detail=str(_('Token is invalid'))) from None