Zero Trust Service Auth Mock in Python

import hmac
import hashlib
import json
import time

class ZeroTrustAuth:
    def __init__(self, secret_key):
        self.secret_key = secret_key
        self.service_tokens = {}

    def issue_token(self, service_name, ttl=300):
        payload = {
            "service": service_name,
            "issued_at": int(time.time()),
            "expires_at": int(time.time()) + ttl
        }
        token = hmac.new(
            self.secret_key.encode(),
            json.dumps(payload, sort_keys=True).encode(),
            hashlib.sha256
        ).hexdigest()
        self.service_tokens[token] = payload
        return token

    def validate_request(self, service_name, token):
        if token not in self.service_tokens:
            return False
        
        payload = self.service_tokens[token]
        if payload["service"] != service_name:
            return False
            
        if time.time() > payload["expires_at"]:
            del self.service_tokens[token]
            return False
            
        # Zero trust: verify every request cryptographically
        expected = hmac.new(
            self.secret_key.encode(),
            json.dumps(payload, sort_keys=True).encode(),
            hashlib.sha256
        ).hexdigest()
        
        return hmac.compare_digest(expected, token)


if __name__ == "__main__":
    auth = ZeroTrustAuth("shared-secret-key")
    
    # Service A requests a token
    token_a = auth.issue_token("payments-service", ttl=60)
    
    # Legitimate request from Service A
    print(f"Valid request from Service A: {auth.validate_request('payments-service', token_a)}")
    
    # Forged/spoofed request from Service B using Service A's token
    print(f"Spoofed request from Service B: {auth.validate_request('inventory-service', token_a)}")
    
    # Invalid token
    print(f"Invalid token: {auth.validate_request('payments-service', 'fake-token')}")