second commit

2026-08-19 22:33:19 +02:00
parent 411812e954
commit 199f306993
107 changed files with 5984 additions and 0 deletions
--- a/app/auth/deps.py
+++ b/app/auth/deps.py
@ -0,0 +1,122 @@
+"""FastAPI-Dependencies fuer Authentifizierung und Autorisierung."""
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from fastapi import Cookie, Depends, HTTPException, Request, Response, WebSocket, status
+
+from app.db import get_db
+from app.rbac import user_has_role, user_has_role_for_host
+from app.security.sessions import (
+    SESSION_COOKIE_NAME,
+    decode_session_token,
+    is_expired,
+    refresh_session_token,
+)
+
+
+@dataclass
+class CurrentUser:
+    id: int
+    username: str
+    is_admin: bool
+
+
+async def get_current_user(
+    response: Response,
+    jh_session: str | None = Cookie(default=None, alias=SESSION_COOKIE_NAME),
+) -> CurrentUser:
+    if jh_session is None:
+        raise HTTPException(status.HTTP_401_UNAUTHORIZED, "Nicht angemeldet")
+
+    payload = decode_session_token(jh_session)
+    if payload is None or is_expired(payload):
+        response.delete_cookie(SESSION_COOKIE_NAME)
+        raise HTTPException(status.HTTP_401_UNAUTHORIZED, "Session abgelaufen oder ungueltig")
+
+    conn = get_db()
+    cursor = await conn.execute(
+        "SELECT id, username, is_admin, is_active, session_version FROM users WHERE id = ?",
+        (payload.user_id,),
+    )
+    row = await cursor.fetchone()
+    if row is None or not row[3] or row[4] != payload.session_version:
+        response.delete_cookie(SESSION_COOKIE_NAME)
+        raise HTTPException(status.HTTP_401_UNAUTHORIZED, "Session ungueltig")
+
+    # Gleitenden Idle-Timeout verlaengern (gleiche session_version/login_ts).
+    new_token = refresh_session_token(payload)
+    response.set_cookie(
+        SESSION_COOKIE_NAME,
+        new_token,
+        httponly=True,
+        secure=True,
+        samesite="strict",
+        max_age=None,  # Session-Cookie; Ablauf wird serverseitig durchgesetzt
+        path="/",
+    )
+
+    return CurrentUser(id=row[0], username=row[1], is_admin=bool(row[2]))
+
+
+async def get_current_user_ws(websocket: WebSocket) -> CurrentUser | None:
+    """Wie get_current_user(), aber fuer WebSocket-Handshakes: kein Cookie-Refresh
+    (WebSockets erlauben nach dem Handshake kein Set-Cookie mehr), stattdessen
+    wird der Idle-Timeout beim naechsten regulaeren HTTP-Request durchgesetzt."""
+    token = websocket.cookies.get(SESSION_COOKIE_NAME)
+    if token is None:
+        return None
+    payload = decode_session_token(token)
+    if payload is None or is_expired(payload):
+        return None
+
+    conn = get_db()
+    cursor = await conn.execute(
+        "SELECT id, username, is_admin, is_active, session_version FROM users WHERE id = ?",
+        (payload.user_id,),
+    )
+    row = await cursor.fetchone()
+    if row is None or not row[3] or row[4] != payload.session_version:
+        return None
+    return CurrentUser(id=row[0], username=row[1], is_admin=bool(row[2]))
+
+
+async def require_global_admin(user: CurrentUser = Depends(get_current_user)) -> CurrentUser:
+    if not user.is_admin:
+        raise HTTPException(status.HTTP_403_FORBIDDEN, "Admin-Rechte erforderlich")
+    return user
+
+
+def require_host_group_role(role_name: str):
+    """Dependency-Factory: prueft Rolle des Users fuer eine per Pfad-/Query-Param
+    uebergebene host_group_id. Globale Admins duerfen immer."""
+
+    async def _dep(host_group_id: int, user: CurrentUser = Depends(get_current_user)) -> CurrentUser:
+        if user.is_admin:
+            return user
+        conn = get_db()
+        allowed = await user_has_role(
+            conn, user_id=user.id, host_group_id=host_group_id, role_name=role_name
+        )
+        if not allowed:
+            raise HTTPException(status.HTTP_403_FORBIDDEN, "Keine Berechtigung fuer diese Hostgruppe")
+        return user
+
+    return _dep
+
+
+def require_host_role(role_name: str):
+    """Dependency-Factory: prueft Rolle des Users fuer einen konkreten host_id."""
+
+    async def _dep(host_id: int, user: CurrentUser = Depends(get_current_user)) -> CurrentUser:
+        if user.is_admin:
+            return user
+        conn = get_db()
+        allowed = await user_has_role_for_host(
+            conn, user_id=user.id, host_id=host_id, role_name=role_name
+        )
+        if not allowed:
+            raise HTTPException(status.HTTP_403_FORBIDDEN, "Keine Berechtigung fuer diesen Host")
+        return user
+
+    return _dep