feat: add endpoints desc

src/infrastructure/security/csrf.py

@@ -3,7 +3,7 @@ import secrets
 from typing import Any, Optional, Mapping
 from itsdangerous import URLSafeTimedSerializer, SignatureExpired, BadSignature
 from src.application.contracts import ICsrfService
-from src.application.domain.exceptions import ApplicationException
+from src.application.domain.exceptions import CsrfException
 from src.infrastructure.config.settings import settings
 
 
@@ -42,21 +42,12 @@ class CsrfService(ICsrfService):
         try:
             data = self._serializer.loads(token, max_age=self.TTL_SECONDS)
         except SignatureExpired:
-            raise ApplicationException(
-                status_code=403,
-                message='CSRF token expired',
-            )
+            raise CsrfException(message='CSRF token expired')
         except BadSignature:
-            raise ApplicationException(
-                status_code=403,
-                message='CSRF token invalid',
-            )
+            raise CsrfException(message='CSRF token invalid')
 
         if expected_subject is not None and data.get('sub') != expected_subject:
-            raise ApplicationException(
-                status_code=403,
-                message='CSRF token subject mismatch',
-            )
+            raise CsrfException(message='CSRF token subject mismatch')
 
         return data
 
@@ -67,15 +58,9 @@ class CsrfService(ICsrfService):
 
     def verify_pair(self, cookie_token: Optional[str], header_token: Optional[str], expected_subject: Optional[str] = None) -> None:
         if not cookie_token or not header_token:
-            raise ApplicationException(
-                status_code=403,
-                message='CSRF token missing',
-            )
+            raise CsrfException(message='CSRF token missing')
 
         if not secrets.compare_digest(cookie_token, header_token):
-            raise ApplicationException(
-                status_code=403,
-                message='CSRF token mismatch',
-            )
+            raise CsrfException(message='CSRF token mismatch')
 
         self.verify(cookie_token, expected_subject=expected_subject)

src/infrastructure/security/jwt.py

@@ -2,7 +2,7 @@ from __future__ import annotations
 from jose import jwt, ExpiredSignatureError, JWTError
 from src.application.contracts import ILogger, IJwtService
 from src.application.domain.dto import AccessTokenPayload
-from src.application.domain.exceptions import ApplicationException
+from src.application.domain.exceptions import ApplicationException,InternalServerException,JwtException
 from src.infrastructure.config.settings import settings
 from src.infrastructure.vault import JwtKeyStore
 
@@ -17,7 +17,7 @@ class JwtService(IJwtService):
 
         if payload.get('type') != 'access':
             self._logger.warning(f'Access token invalid type received_type={payload.get('type')}')
-            raise ApplicationException(status_code=401, message='Invalid token type')
+            raise JwtException(message='Invalid token type')
 
         try:
             return AccessTokenPayload(
@@ -32,7 +32,7 @@ class JwtService(IJwtService):
             )
         except KeyError as exception:
             self._logger.warning(f'Access token missing claim error={str(exception)}')
-            raise ApplicationException(status_code=401, message=f'Missing token claim: {exception}')
+            raise JwtException(message=f'Missing token claim: {exception}')
 
     async def _decode_and_verify(self, token: str) -> dict:
         kid: str | None = None
@@ -42,12 +42,12 @@ class JwtService(IJwtService):
             kid = header.get('kid')
             if not kid:
                 self._logger.warning(f'JWT header missing kid header={header}')
-                raise ApplicationException(status_code=401, message='Missing token header: kid')
+                raise JwtException(message='Missing token header: kid')
 
             received_alg = header.get('alg')
             if received_alg != settings.JWT_ALGORITHM:
                 self._logger.warning(f'JWT invalid algorithm kid={kid} received_alg={received_alg} expected_alg={settings.JWT_ALGORITHM}')
-                raise ApplicationException(status_code=401, message='Invalid token algorithm')
+                raise JwtException(message='Invalid token algorithm')
 
             public_pem = await self._key_store.get_public_key_for_kid(str(kid))
 
@@ -58,7 +58,7 @@ class JwtService(IJwtService):
 
             if not public_pem:
                 self._logger.warning(f'JWT unknown kid kid={kid}')
-                raise ApplicationException(status_code=401, message='Unknown token kid')
+                raise JwtException(message='Unknown token kid')
 
             options = {
                 'verify_signature': True,
@@ -85,25 +85,25 @@ class JwtService(IJwtService):
 
             if 'sid' not in payload:
                 self._logger.warning(f'JWT missing sid claim kid={kid}')
-                raise ApplicationException(status_code=401, message='Missing token claim: sid')
+                raise JwtException(message='Missing token claim: sid')
 
             if 'type' not in payload:
                 self._logger.warning(f'JWT missing type claim kid={kid}')
-                raise ApplicationException(status_code=401, message='Missing token claim: type')
+                raise JwtException(message='Missing token claim: type')
 
             return payload
 
         except ExpiredSignatureError as exception:
             self._logger.info(f'JWT expired kid={kid} error={str(exception)}')
-            raise ApplicationException(status_code=401, message='Token expired')
+            raise JwtException(message='Token expired')
 
         except ApplicationException:
             raise
 
         except JWTError as exception:
             self._logger.warning(f'JWT decode failed kid={kid} error={str(exception)}')
-            raise ApplicationException(status_code=401, message='Invalid token')
+            raise JwtException(message='Invalid token')
 
         except Exception as exception:
             self._logger.error(f'Unexpected JWT decode error kid={kid} error={str(exception)}')
-            raise ApplicationException(status_code=500, message='JWT decode failed')
+            raise InternalServerException(message='JWT decode failed')