添加用户鉴权

mini-program/app/middleware/auth.py

@@ -0,0 +1,75 @@
+from collections.abc import Awaitable, Callable
+
+from fastapi import FastAPI, HTTPException, Request
+from sqlalchemy import text
+
+try:
+    # For module mode: `uvicorn app.main:app`
+    from app.db import SessionLocal
+    from app.security import auth_error_response, decode_access_token
+except ModuleNotFoundError:
+    # For script mode: `python app/main.py` or VS Code "Run Python File"
+    from db import SessionLocal
+    from security import auth_error_response, decode_access_token
+
+
+EXCLUDED_PATH_PREFIXES = (
+    "/health",
+    "/docs",
+    "/redoc",
+    "/openapi.json",
+    "/auth/login",
+)
+
+
+def _is_excluded_path(path: str) -> bool:
+    for prefix in EXCLUDED_PATH_PREFIXES:
+        if path == prefix or path.startswith(f"{prefix}/"):
+            return True
+    return False
+
+
+def install_auth_middleware(app: FastAPI) -> None:
+    @app.middleware("http")
+    async def auth_middleware(
+        request: Request,
+        call_next: Callable[[Request], Awaitable],
+    ):
+        path = request.url.path
+        if request.method == "OPTIONS" or _is_excluded_path(path):
+            return await call_next(request)
+
+        auth_header = request.headers.get("Authorization")
+        if not auth_header:
+            return auth_error_response("missing authorization header")
+
+        parts = auth_header.split(" ", 1)
+        if len(parts) != 2 or parts[0].lower() != "bearer":
+            return auth_error_response("invalid authorization format")
+
+        try:
+            user_id = decode_access_token(parts[1].strip())
+        except HTTPException:
+            return auth_error_response("invalid or expired access token")
+
+        with SessionLocal() as db:
+            user_row = (
+                db.execute(
+                    text(
+                        """
+                        SELECT id, status
+                        FROM chat_user
+                        WHERE id = :user_id
+                        LIMIT 1
+                        """
+                    ),
+                    {"user_id": user_id},
+                )
+                .mappings()
+                .first()
+            )
+            if not user_row or int(user_row["status"]) != 1:
+                return auth_error_response("user not found or disabled")
+
+        request.state.user_id = user_id
+        return await call_next(request)