127 lines
4.0 KiB
Python
127 lines
4.0 KiB
Python
from collections.abc import Awaitable, Callable
|
|
import logging
|
|
|
|
from fastapi import FastAPI, HTTPException, Request
|
|
from sqlalchemy import text
|
|
|
|
try:
|
|
# For module mode: `uvicorn app.main:app`
|
|
from app.db import SessionLocal
|
|
from app.security import auth_error_response, decode_access_token
|
|
except ModuleNotFoundError:
|
|
# For script mode: `python app/main.py` or VS Code "Run Python File"
|
|
from db import SessionLocal
|
|
from security import auth_error_response, decode_access_token
|
|
|
|
|
|
NO_AUTH_PATH_PREFIXES = (
|
|
"/health",
|
|
"/docs",
|
|
"/redoc",
|
|
"/openapi.json",
|
|
"/auth/login",
|
|
)
|
|
|
|
|
|
def _is_no_auth_path(path: str) -> bool:
|
|
for prefix in NO_AUTH_PATH_PREFIXES:
|
|
if path == prefix or path.startswith(f"{prefix}/"):
|
|
return True
|
|
return False
|
|
|
|
|
|
def _is_excluded_path(path: str) -> bool:
|
|
return _is_no_auth_path(path)
|
|
|
|
logger = logging.getLogger("app.auth")
|
|
|
|
|
|
def _is_no_auth_path(path: str) -> bool:
|
|
for prefix in NO_AUTH_PATH_PREFIXES:
|
|
if path == prefix or path.startswith(f"{prefix}/"):
|
|
return True
|
|
return False
|
|
|
|
|
|
def install_auth_middleware(app: FastAPI) -> None:
|
|
@app.middleware("http")
|
|
async def auth_middleware(
|
|
request: Request,
|
|
call_next: Callable[[Request], Awaitable],
|
|
):
|
|
path = request.url.path
|
|
if request.method == "OPTIONS" or _is_no_auth_path(path):
|
|
return await call_next(request)
|
|
|
|
auth_header = request.headers.get("Authorization")
|
|
if not auth_header:
|
|
logger.warning(
|
|
"auth failed: missing header",
|
|
extra={
|
|
"event": "auth_check",
|
|
"request_id": getattr(request.state, "request_id", None),
|
|
"path": path,
|
|
"reason": "missing_authorization_header",
|
|
},
|
|
)
|
|
return auth_error_response("missing authorization header")
|
|
|
|
parts = auth_header.split(" ", 1)
|
|
if len(parts) != 2 or parts[0].lower() != "bearer":
|
|
logger.warning(
|
|
"auth failed: invalid header format",
|
|
extra={
|
|
"event": "auth_check",
|
|
"request_id": getattr(request.state, "request_id", None),
|
|
"path": path,
|
|
"reason": "invalid_authorization_format",
|
|
},
|
|
)
|
|
return auth_error_response("invalid authorization format")
|
|
|
|
try:
|
|
user_id = decode_access_token(parts[1].strip())
|
|
except HTTPException:
|
|
logger.warning(
|
|
"auth failed: invalid token",
|
|
extra={
|
|
"event": "auth_check",
|
|
"request_id": getattr(request.state, "request_id", None),
|
|
"path": path,
|
|
"reason": "invalid_or_expired_token",
|
|
},
|
|
)
|
|
return auth_error_response("invalid or expired access token")
|
|
|
|
with SessionLocal() as db:
|
|
user_row = (
|
|
db.execute(
|
|
text(
|
|
"""
|
|
SELECT user_id, status
|
|
FROM parents
|
|
WHERE user_id = :user_id
|
|
LIMIT 1
|
|
"""
|
|
),
|
|
{"user_id": user_id},
|
|
)
|
|
.mappings()
|
|
.first()
|
|
)
|
|
if not user_row or int(user_row["status"]) != 1:
|
|
logger.warning(
|
|
"auth failed: user unavailable",
|
|
extra={
|
|
"event": "auth_check",
|
|
"request_id": getattr(request.state, "request_id", None),
|
|
"path": path,
|
|
"user_id": user_id,
|
|
"reason": "user_not_found_or_disabled",
|
|
},
|
|
)
|
|
return auth_error_response("user not found or disabled")
|
|
|
|
request.state.user_id = user_id
|
|
return await call_next(request)
|