root
3ae1062d65
- Remove POST /api/auth/register (404); no sign-up UI; users are admin-managed - Add admin-only POST/PATCH/DELETE /api/auth/users (forced canonical roles, self-lockout + reference guards) - Unify role model in app/core/roles.py; reject unknown roles at creation and at login/JWT validation; startup normalizes unambiguous legacy aliases - Login rate limiting ~5 fails/15 min per IP+email -> 429 (in-process, tunable) - WhatsApp webhook requires X-Webhook-Secret; fail-closed when env unset; GET handshake uses constant-time verify token (403 on mismatch) - GET /api/whatsapp/mock-log now requires auth - Security headers middleware: X-Frame-Options DENY, nosniff, CSP on HTML, HSTS behind TLS - Pagination: limit alias for page_size, hard cap enforced, both -> 422
124 lines
4.9 KiB
Python
124 lines
4.9 KiB
Python
"""Password hashing, JWT token creation / verification, and RBAC."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from datetime import datetime, timedelta, timezone
|
|
from typing import Annotated, Any, Callable
|
|
|
|
import bcrypt
|
|
from fastapi import Depends, HTTPException, status
|
|
from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
|
|
from jose import JWTError, jwt
|
|
from jose.exceptions import JWTClaimsError
|
|
from sqlalchemy import select
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.core.config import settings
|
|
from app.core.database import get_db
|
|
from app.core.roles import is_known_role
|
|
from app.models.user import User
|
|
|
|
bearer_scheme = HTTPBearer(auto_error=False)
|
|
|
|
|
|
# ── Password helpers ─────────────────────────────────────────────────
|
|
def hash_password(password: str) -> str:
|
|
"""Return bcrypt hash of *password*."""
|
|
salt = bcrypt.gensalt()
|
|
return bcrypt.hashpw(password.encode("utf-8"), salt).decode("utf-8")
|
|
|
|
|
|
def verify_password(plain: str, hashed: str) -> bool:
|
|
"""Return True if *plain* matches *hashed*."""
|
|
return bcrypt.checkpw(plain.encode("utf-8"), hashed.encode("utf-8"))
|
|
|
|
|
|
# ── JWT helpers ──────────────────────────────────────────────────────
|
|
def create_access_token(data: dict[str, Any], expires_delta: timedelta | None = None) -> str:
|
|
"""Create a signed JWT access token."""
|
|
to_encode = data.copy()
|
|
expire = datetime.now(timezone.utc) + (expires_delta or timedelta(minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES))
|
|
to_encode.update({"exp": expire, "type": "access"})
|
|
return jwt.encode(to_encode, settings.SECRET_KEY, algorithm=settings.ALGORITHM)
|
|
|
|
|
|
def create_refresh_token(data: dict[str, Any]) -> str:
|
|
"""Create a signed JWT refresh token."""
|
|
to_encode = data.copy()
|
|
expire = datetime.now(timezone.utc) + timedelta(minutes=settings.REFRESH_TOKEN_EXPIRE_MINUTES)
|
|
to_encode.update({"exp": expire, "type": "refresh"})
|
|
return jwt.encode(to_encode, settings.SECRET_KEY, algorithm=settings.ALGORITHM)
|
|
|
|
|
|
def decode_token(token: str) -> dict[str, Any]:
|
|
"""Decode and validate a JWT token. Raises 401 on failure."""
|
|
try:
|
|
payload = jwt.decode(
|
|
token,
|
|
settings.SECRET_KEY,
|
|
algorithms=[settings.ALGORITHM],
|
|
options={"verify_sub": False},
|
|
)
|
|
return payload
|
|
except (JWTError, JWTClaimsError):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Invalid or expired token",
|
|
)
|
|
|
|
|
|
# ── Dependencies ─────────────────────────────────────────────────────
|
|
async def get_current_user(
|
|
credentials: Annotated[HTTPAuthorizationCredentials | None, Depends(bearer_scheme)],
|
|
db: Annotated[AsyncSession, Depends(get_db)],
|
|
) -> User:
|
|
"""Return the authenticated User from the Bearer token."""
|
|
if credentials is None:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Not authenticated",
|
|
)
|
|
payload = decode_token(credentials.credentials)
|
|
raw_sub = payload.get("sub")
|
|
if raw_sub is None:
|
|
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid token payload")
|
|
try:
|
|
user_id = int(raw_sub)
|
|
except (ValueError, TypeError):
|
|
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid token payload")
|
|
|
|
result = await db.execute(select(User).where(User.id == user_id))
|
|
user = result.scalar_one_or_none()
|
|
if user is None or not user.active:
|
|
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="User not found or inactive")
|
|
# Unified role model: reject rows whose stored role is not canonical or a
|
|
# known legacy alias. Legacy junk roles (e.g. lowercase ``admin``) must
|
|
# fail closed here so they can never ride an access token into the app.
|
|
if not is_known_role(user.role):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Account role is not recognised; contact an administrator",
|
|
)
|
|
return user
|
|
|
|
|
|
def require_roles(*roles: str) -> Callable:
|
|
"""Decorator for route dependencies that enforces one of the given roles.
|
|
|
|
Usage::
|
|
|
|
@router.get("/admin-only")
|
|
async def admin_endpoint(current_user: Annotated[User, Depends(require_roles("Admin/Jerome"))]):
|
|
...
|
|
"""
|
|
|
|
async def role_checker(current_user: Annotated[User, Depends(get_current_user)]) -> User:
|
|
if current_user.role not in roles:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail=f"Role '{current_user.role}' not in {roles}",
|
|
)
|
|
return current_user
|
|
|
|
return role_checker
|