123 lines
4.2 KiB
Python
123 lines
4.2 KiB
Python
"""FastAPI-Dependencies fuer Authentifizierung und Autorisierung."""
|
|
from __future__ import annotations
|
|
|
|
from dataclasses import dataclass
|
|
|
|
from fastapi import Cookie, Depends, HTTPException, Request, Response, WebSocket, status
|
|
|
|
from app.db import get_db
|
|
from app.rbac import user_has_role, user_has_role_for_host
|
|
from app.security.sessions import (
|
|
SESSION_COOKIE_NAME,
|
|
decode_session_token,
|
|
is_expired,
|
|
refresh_session_token,
|
|
)
|
|
|
|
|
|
@dataclass
|
|
class CurrentUser:
|
|
id: int
|
|
username: str
|
|
is_admin: bool
|
|
|
|
|
|
async def get_current_user(
|
|
response: Response,
|
|
jh_session: str | None = Cookie(default=None, alias=SESSION_COOKIE_NAME),
|
|
) -> CurrentUser:
|
|
if jh_session is None:
|
|
raise HTTPException(status.HTTP_401_UNAUTHORIZED, "Nicht angemeldet")
|
|
|
|
payload = decode_session_token(jh_session)
|
|
if payload is None or is_expired(payload):
|
|
response.delete_cookie(SESSION_COOKIE_NAME)
|
|
raise HTTPException(status.HTTP_401_UNAUTHORIZED, "Session abgelaufen oder ungueltig")
|
|
|
|
conn = get_db()
|
|
cursor = await conn.execute(
|
|
"SELECT id, username, is_admin, is_active, session_version FROM users WHERE id = ?",
|
|
(payload.user_id,),
|
|
)
|
|
row = await cursor.fetchone()
|
|
if row is None or not row[3] or row[4] != payload.session_version:
|
|
response.delete_cookie(SESSION_COOKIE_NAME)
|
|
raise HTTPException(status.HTTP_401_UNAUTHORIZED, "Session ungueltig")
|
|
|
|
# Gleitenden Idle-Timeout verlaengern (gleiche session_version/login_ts).
|
|
new_token = refresh_session_token(payload)
|
|
response.set_cookie(
|
|
SESSION_COOKIE_NAME,
|
|
new_token,
|
|
httponly=True,
|
|
secure=True,
|
|
samesite="strict",
|
|
max_age=None, # Session-Cookie; Ablauf wird serverseitig durchgesetzt
|
|
path="/",
|
|
)
|
|
|
|
return CurrentUser(id=row[0], username=row[1], is_admin=bool(row[2]))
|
|
|
|
|
|
async def get_current_user_ws(websocket: WebSocket) -> CurrentUser | None:
|
|
"""Wie get_current_user(), aber fuer WebSocket-Handshakes: kein Cookie-Refresh
|
|
(WebSockets erlauben nach dem Handshake kein Set-Cookie mehr), stattdessen
|
|
wird der Idle-Timeout beim naechsten regulaeren HTTP-Request durchgesetzt."""
|
|
token = websocket.cookies.get(SESSION_COOKIE_NAME)
|
|
if token is None:
|
|
return None
|
|
payload = decode_session_token(token)
|
|
if payload is None or is_expired(payload):
|
|
return None
|
|
|
|
conn = get_db()
|
|
cursor = await conn.execute(
|
|
"SELECT id, username, is_admin, is_active, session_version FROM users WHERE id = ?",
|
|
(payload.user_id,),
|
|
)
|
|
row = await cursor.fetchone()
|
|
if row is None or not row[3] or row[4] != payload.session_version:
|
|
return None
|
|
return CurrentUser(id=row[0], username=row[1], is_admin=bool(row[2]))
|
|
|
|
|
|
async def require_global_admin(user: CurrentUser = Depends(get_current_user)) -> CurrentUser:
|
|
if not user.is_admin:
|
|
raise HTTPException(status.HTTP_403_FORBIDDEN, "Admin-Rechte erforderlich")
|
|
return user
|
|
|
|
|
|
def require_host_group_role(role_name: str):
|
|
"""Dependency-Factory: prueft Rolle des Users fuer eine per Pfad-/Query-Param
|
|
uebergebene host_group_id. Globale Admins duerfen immer."""
|
|
|
|
async def _dep(host_group_id: int, user: CurrentUser = Depends(get_current_user)) -> CurrentUser:
|
|
if user.is_admin:
|
|
return user
|
|
conn = get_db()
|
|
allowed = await user_has_role(
|
|
conn, user_id=user.id, host_group_id=host_group_id, role_name=role_name
|
|
)
|
|
if not allowed:
|
|
raise HTTPException(status.HTTP_403_FORBIDDEN, "Keine Berechtigung fuer diese Hostgruppe")
|
|
return user
|
|
|
|
return _dep
|
|
|
|
|
|
def require_host_role(role_name: str):
|
|
"""Dependency-Factory: prueft Rolle des Users fuer einen konkreten host_id."""
|
|
|
|
async def _dep(host_id: int, user: CurrentUser = Depends(get_current_user)) -> CurrentUser:
|
|
if user.is_admin:
|
|
return user
|
|
conn = get_db()
|
|
allowed = await user_has_role_for_host(
|
|
conn, user_id=user.id, host_id=host_id, role_name=role_name
|
|
)
|
|
if not allowed:
|
|
raise HTTPException(status.HTTP_403_FORBIDDEN, "Keine Berechtigung fuer diesen Host")
|
|
return user
|
|
|
|
return _dep
|