feat(security): JWT required on every API route, gated dev fallback, role checks
- main.py: global get_current_user dependency on all routers except /auth/login and /health; prod fail-fast startup guard rejects wildcard CORS, default credentials, DEV_LOGIN_ENABLED - inventory/pm: X-User-Role header identity fallback now only active when PROCUREMENT_DEV_LOGIN_ENABLED=true (was unconditional in production) - item_decisions writes + attachment deletes: require_role( procurement_manager, admin) — require_role was defined but never used - config.py: ENVIRONMENT flag, comma-separated CORS_ORIGINS, no default Casdoor client secret/admin password, DEV_LOGIN_ENABLED=false - frontend: authenticated file downloads (Bearer + blob) — <a href> links cannot send the token; FileList/QuoteDetail/AcceptModal/EditModal/ PurchaseHistory converted; DEV_LOGIN_ENABLED build arg defaults false - smoke tests authenticate via POST /auth/login (SMOKE_USER/SMOKE_PASSWORD) - traefik: security headers, API rate limit, 12MB body cap (prod overlay) - nginx client_max_body_size aligned to 12MB
This commit is contained in:
MMD
+45
-8
@@ -1,7 +1,14 @@
|
||||
"""Application configuration.
|
||||
|
||||
All settings can be overridden with environment variables prefixed with
|
||||
``PROCUREMENT_`` (e.g. ``PROCUREMENT_DATABASE_URL=...``) or a local ``.env`` file.
|
||||
``PROCUREMENT_`` (e.g. ``PROCUREMENT_DATABASE_URL=...``) or a local ``.env``
|
||||
file. The docker-compose files inject them from the git-ignored ``.env`` —
|
||||
real credentials never live in this repository.
|
||||
|
||||
``ENVIRONMENT`` is the safety switch: when it is ``"prod"``, the API runs
|
||||
fail-fast startup checks (see app.main._verify_production_settings) that
|
||||
refuse to boot with wildcard CORS, default credentials or dev login
|
||||
enabled.
|
||||
"""
|
||||
from pydantic_settings import BaseSettings, SettingsConfigDict
|
||||
|
||||
@@ -14,7 +21,10 @@ class Settings(BaseSettings):
|
||||
extra="ignore",
|
||||
)
|
||||
|
||||
# PostgreSQL DSN — the schema (migration.sql + seed.sql) must already exist.
|
||||
# "dev" (local defaults allowed) | "prod" (fail-fast checks on startup).
|
||||
ENVIRONMENT: str = "dev"
|
||||
|
||||
# PostgreSQL DSN — the schema (migration.sql) must already exist.
|
||||
DATABASE_URL: str = "postgresql+asyncpg://postgres:postgres@localhost:5432/procurement"
|
||||
|
||||
# Echo SQL statements to the console (dev aid).
|
||||
@@ -22,6 +32,8 @@ class Settings(BaseSettings):
|
||||
|
||||
# MinIO object storage — invoice / proforma attachments (S3-compatible).
|
||||
# Endpoint is the compose service name (`minio:9000`) inside Docker.
|
||||
# Defaults are LOCAL DEV ONLY — production values come from .env and the
|
||||
# prod startup checks reject them.
|
||||
MINIO_ENDPOINT: str = "localhost:9000"
|
||||
MINIO_ACCESS_KEY: str = "minioadmin"
|
||||
MINIO_SECRET_KEY: str = "minioadmin"
|
||||
@@ -36,27 +48,52 @@ class Settings(BaseSettings):
|
||||
DEFAULT_PAGE_SIZE: int = 20
|
||||
MAX_PAGE_SIZE: int = 100
|
||||
|
||||
# CORS (dev-friendly default; the frontend is a static site).
|
||||
CORS_ORIGINS: list[str] = ["*"]
|
||||
# CORS — comma-separated exact browser origins (NOT "*" with
|
||||
# credentials; the prod checks reject wildcard). Example:
|
||||
# PROCUREMENT_CORS_ORIGINS=https://aramesh.bennu-api-bahrestan.ir
|
||||
CORS_ORIGINS: str = "http://localhost,http://localhost:3000,http://localhost:5173"
|
||||
|
||||
# Developer Mode: in-page dev login panel (frontend build arg) AND the
|
||||
# X-User-Role / X-User-Name-B64 header identity fallback in the
|
||||
# inventory/pm routers. MUST stay false in production.
|
||||
DEV_LOGIN_ENABLED: bool = False
|
||||
|
||||
# Casdoor (OIDC) — JWT verification against the issuer's JWKS.
|
||||
CASDOOR_ENDPOINT: str = "http://localhost:8080"
|
||||
CASDOOR_ISSUER: str = "" # expected token iss claim (default: CASDOOR_ENDPOINT)
|
||||
CASDOOR_CLIENT_ID: str = "inventory-app-client"
|
||||
CASDOOR_CLIENT_SECRET: str = "inventory-app-secret-2026"
|
||||
CASDOOR_CLIENT_SECRET: str = "" # no default secret — set via env/.env
|
||||
CASDOOR_ORGANIZATION: str = "inventory"
|
||||
CASDOOR_APP_NAME: str = "inventory-app"
|
||||
CASDOOR_JWKS_URL: str = "" # default: {endpoint}/api/public_jwks
|
||||
CASDOOR_AUDIENCE: str = "inventory-app-client" # expected token aud (falls back to client_id)
|
||||
|
||||
# Casdoor console admin — used by POST /users/sync to mirror Casdoor
|
||||
# identities into the app's users table (dev defaults: admin / 123).
|
||||
# identities into the app's users table. No default password.
|
||||
CASDOOR_ADMIN_USER: str = "admin"
|
||||
CASDOOR_ADMIN_PASSWORD: str = "123"
|
||||
CASDOOR_ADMIN_PASSWORD: str = ""
|
||||
|
||||
# Inventory dev fallback (only when no Authorization header is sent).
|
||||
# Inventory dev fallback defaults (only used when DEV_LOGIN_ENABLED).
|
||||
INVENTORY_DEFAULT_ROLE: str = "pm"
|
||||
INVENTORY_DEFAULT_PROJECT_ID: str = ""
|
||||
|
||||
# ---- Observability (Phase 2) -------------------------------------------
|
||||
# Sentry/GlitchTip DSN — backend exception capture (empty = disabled).
|
||||
SENTRY_DSN: str = ""
|
||||
SENTRY_TRACES_SAMPLE_RATE: float = 0.0
|
||||
# OpenPanel server-side event ingestion (empty = disabled).
|
||||
OPENPANEL_API_URL: str = "" # e.g. http://openpanel-api:8080 (self-hosted)
|
||||
OPENPANEL_CLIENT_ID: str = ""
|
||||
OPENPANEL_CLIENT_SECRET: str = ""
|
||||
|
||||
@property
|
||||
def cors_origin_list(self) -> list[str]:
|
||||
"""Comma-separated CORS_ORIGINS → list for CORSMiddleware."""
|
||||
return [o.strip() for o in self.CORS_ORIGINS.split(",") if o.strip()]
|
||||
|
||||
@property
|
||||
def is_prod(self) -> bool:
|
||||
return self.ENVIRONMENT.lower() == "prod"
|
||||
|
||||
|
||||
settings = Settings()
|
||||
|
||||
+40
-3
@@ -9,12 +9,13 @@ import asyncio
|
||||
import logging
|
||||
from contextlib import asynccontextmanager
|
||||
|
||||
from fastapi import FastAPI, Request
|
||||
from fastapi import Depends, FastAPI, Request
|
||||
from fastapi.exceptions import RequestValidationError
|
||||
from fastapi.middleware.cors import CORSMiddleware
|
||||
from fastapi.responses import JSONResponse
|
||||
from sqlalchemy.exc import IntegrityError
|
||||
|
||||
from app.auth import get_current_user
|
||||
from app.config import settings
|
||||
from app.db.engine import AsyncSessionLocal, engine
|
||||
from app.db.init_db import (
|
||||
@@ -45,8 +46,35 @@ async def _auto_expire_loop() -> None:
|
||||
logger.exception("Auto-expiry pass failed")
|
||||
|
||||
|
||||
def _verify_production_settings() -> None:
|
||||
"""Fail-fast guard: refuse to boot in prod with dev defaults.
|
||||
|
||||
These exact misconfigurations are what previously shipped (wildcard CORS
|
||||
with credentials, default MinIO/Postgres/Casdoor credentials, and the
|
||||
always-on X-User-Role identity fallback). Ops fix: set the real values
|
||||
in the server-side .env — see docs/SECRET-MANAGEMENT.md.
|
||||
"""
|
||||
problems: list[str] = []
|
||||
if not settings.cors_origin_list or "*" in settings.cors_origin_list:
|
||||
problems.append("PROCUREMENT_CORS_ORIGINS must list exact origins (no '*')")
|
||||
if settings.MINIO_ACCESS_KEY == "minioadmin" or settings.MINIO_SECRET_KEY == "minioadmin":
|
||||
problems.append("MinIO credentials are still the default minioadmin")
|
||||
if not settings.CASDOOR_CLIENT_SECRET:
|
||||
problems.append("PROCUREMENT_CASDOOR_CLIENT_SECRET is not set")
|
||||
if not settings.CASDOOR_ADMIN_PASSWORD:
|
||||
problems.append("PROCUREMENT_CASDOOR_ADMIN_PASSWORD is not set")
|
||||
if settings.DEV_LOGIN_ENABLED:
|
||||
problems.append("PROCUREMENT_DEV_LOGIN_ENABLED must be false in production")
|
||||
if problems:
|
||||
raise RuntimeError(
|
||||
"Refusing to start in production — fix the environment:\n - " + "\n - ".join(problems)
|
||||
)
|
||||
|
||||
|
||||
@asynccontextmanager
|
||||
async def lifespan(_app: FastAPI):
|
||||
if settings.is_prod:
|
||||
_verify_production_settings()
|
||||
await ensure_dashboard_tables(engine)
|
||||
await ensure_attachment_table(engine)
|
||||
await ensure_material_topic_column(engine)
|
||||
@@ -74,7 +102,7 @@ app = FastAPI(
|
||||
|
||||
app.add_middleware(
|
||||
CORSMiddleware,
|
||||
allow_origins=settings.CORS_ORIGINS,
|
||||
allow_origins=settings.cors_origin_list,
|
||||
allow_credentials=True,
|
||||
allow_methods=["*"],
|
||||
allow_headers=["*"],
|
||||
@@ -158,9 +186,18 @@ async def unhandled_error_handler(_request: Request, exc: Exception):
|
||||
# ---------------------------------------------------------------------------
|
||||
# Routes
|
||||
# ---------------------------------------------------------------------------
|
||||
# JWT auth is required on EVERY router; the auth router stays public
|
||||
# (POST /auth/login issues the tokens) and /health lives below, outside the
|
||||
# /api/v1 prefix. Routers with their own finer-grained scopes (inventory,
|
||||
# pm, users) keep them — the global dependency guarantees nothing is open
|
||||
# by omission.
|
||||
from app.routers.auth import router as _auth_router # noqa: E402
|
||||
|
||||
for router in ROUTERS:
|
||||
app.include_router(router, prefix=API_V1_PREFIX)
|
||||
if router is _auth_router:
|
||||
app.include_router(router, prefix=API_V1_PREFIX)
|
||||
else:
|
||||
app.include_router(router, prefix=API_V1_PREFIX, dependencies=[Depends(get_current_user)])
|
||||
|
||||
|
||||
@app.get("/health", tags=["system"])
|
||||
|
||||
@@ -20,6 +20,7 @@ from urllib.parse import quote
|
||||
from fastapi import APIRouter, Depends, File, Response, UploadFile
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.auth import require_role
|
||||
from app.db.engine import get_db
|
||||
from app.models.procurement import Quote
|
||||
from app.services import file_service
|
||||
@@ -27,6 +28,10 @@ from app.utils.errors import NotFoundError, ValidationError
|
||||
|
||||
router = APIRouter(prefix="/quotes", tags=["files"])
|
||||
|
||||
# حذف پیوستها = عملیات تدارکات (ادمین / مدیر تدارکات)؛ بارگذاری و دانلود
|
||||
# برای هر کاربر واردشده آزاد است.
|
||||
_attachment_deleter = require_role("procurement_manager", "admin")
|
||||
|
||||
ALLOWED_MIME_TYPES = {
|
||||
"image/png", "image/jpeg", "image/webp", "image/gif", "application/pdf",
|
||||
}
|
||||
@@ -120,7 +125,7 @@ async def download_invoice(quote_id: uuid.UUID, attachment_id: uuid.UUID, db: As
|
||||
)
|
||||
|
||||
|
||||
@router.delete("/{quote_id}/invoice/{attachment_id}")
|
||||
@router.delete("/{quote_id}/invoice/{attachment_id}", dependencies=[Depends(_attachment_deleter)])
|
||||
async def delete_invoice(quote_id: uuid.UUID, attachment_id: uuid.UUID, db: AsyncSession = Depends(get_db)):
|
||||
await _quote_or_404(db, quote_id)
|
||||
attachment = await _attachment_or_404(db, quote_id, attachment_id, "invoice")
|
||||
@@ -165,7 +170,7 @@ async def download_proforma(quote_id: uuid.UUID, attachment_id: uuid.UUID, db: A
|
||||
)
|
||||
|
||||
|
||||
@router.delete("/{quote_id}/proforma/{attachment_id}")
|
||||
@router.delete("/{quote_id}/proforma/{attachment_id}", dependencies=[Depends(_attachment_deleter)])
|
||||
async def delete_proforma(quote_id: uuid.UUID, attachment_id: uuid.UUID, db: AsyncSession = Depends(get_db)):
|
||||
await _quote_or_404(db, quote_id)
|
||||
attachment = await _attachment_or_404(db, quote_id, attachment_id, "proforma")
|
||||
|
||||
@@ -95,9 +95,11 @@ async def inventory_scope(
|
||||
return Scope(role="admin", project_id=project_id, actor=user.display_name)
|
||||
|
||||
# Dev fallback: header-based identity (fork's placeholder mode) — only
|
||||
# when an explicit X-User-Role header is sent. No auth info at all → 401.
|
||||
if not request.headers.get("x-user-role"):
|
||||
raise UnauthorizedError("احراز هویت لازم است — توکن Casdoor یا حالت توسعه را ارسال کنید")
|
||||
# when DEV_LOGIN_ENABLED is explicitly turned on (local testing without
|
||||
# Casdoor). Disabled by default: unauthenticated header identity in
|
||||
# production would hand admin access to anyone who can reach the API.
|
||||
if not settings.DEV_LOGIN_ENABLED or not request.headers.get("x-user-role"):
|
||||
raise UnauthorizedError("احراز هویت لازم است — توکن Casdoor ارسال کنید")
|
||||
role = (request.headers.get("x-user-role") or settings.INVENTORY_DEFAULT_ROLE or ROLE_PM).strip().lower()
|
||||
if role == "procurement_manager":
|
||||
role = ROLE_ADMIN # مدیر تدارکات = ادمین (فقطخواندنی)
|
||||
|
||||
@@ -4,11 +4,16 @@ State machine (P1 cross-endpoint rules):
|
||||
pending -> chosen (requires chosen_item_termsheet_id of the SAME line item)
|
||||
pending -> rejected
|
||||
chosen/rejected -> pending/anything-else = 409
|
||||
|
||||
Auth: JWT required globally (main.py). The state-changing endpoints are a
|
||||
purchase decision — restricted to procurement_manager / admin via
|
||||
require_role; reads stay open to every authenticated role.
|
||||
"""
|
||||
from fastapi import APIRouter, Depends
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.auth import require_role
|
||||
from app.db.engine import get_db
|
||||
from app.models.procurement import ItemDecision, ItemTermsheet, LineItem
|
||||
from app.schemas.procurement import DecisionPatch, DecisionPut, DecisionStatusUpdate
|
||||
@@ -21,6 +26,9 @@ router = APIRouter(
|
||||
tags=["item-decisions"],
|
||||
)
|
||||
|
||||
# خرید/رد اقلام = تصمیم تدارکات؛ ادمین و مدیر تدارکات
|
||||
_decision_writer = require_role("procurement_manager", "admin")
|
||||
|
||||
|
||||
async def _line_item_or_404(db: AsyncSession, quote_id, line_item_id) -> LineItem:
|
||||
li = await db.scalar(
|
||||
@@ -59,7 +67,7 @@ async def get_decision(quote_id, line_item_id, db: AsyncSession = Depends(get_db
|
||||
return {"data": decision_full(decision)}
|
||||
|
||||
|
||||
@router.put("")
|
||||
@router.put("", dependencies=[Depends(_decision_writer)])
|
||||
async def put_decision(
|
||||
quote_id, line_item_id, payload: DecisionPut, db: AsyncSession = Depends(get_db)
|
||||
):
|
||||
@@ -93,7 +101,7 @@ async def put_decision(
|
||||
return {"data": decision_full(decision), "status_code_hint": 201 if created else 200}
|
||||
|
||||
|
||||
@router.patch("/status")
|
||||
@router.patch("/status", dependencies=[Depends(_decision_writer)])
|
||||
async def patch_decision_status(
|
||||
quote_id, line_item_id, payload: DecisionStatusUpdate, db: AsyncSession = Depends(get_db)
|
||||
):
|
||||
@@ -118,7 +126,7 @@ async def patch_decision_status(
|
||||
return {"data": decision_full(decision)}
|
||||
|
||||
|
||||
@router.patch("")
|
||||
@router.patch("", dependencies=[Depends(_decision_writer)])
|
||||
async def patch_decision(
|
||||
quote_id, line_item_id, payload: DecisionPatch, db: AsyncSession = Depends(get_db)
|
||||
):
|
||||
|
||||
@@ -19,8 +19,9 @@ Rules enforced here:
|
||||
the canonical unit for auto-posted purchases.
|
||||
- quote.status flips to 'arrived' when ALL chosen items are fully received.
|
||||
|
||||
Auth: Casdoor JWT primary; dev fallback headers (X-User-Role: pm|admin +
|
||||
X-Project-Id for pm) when no Authorization header — same pattern as the
|
||||
Auth: Casdoor JWT (a global dependency in main.py) resolves the caller;
|
||||
optional dev-header fallback (X-User-Role: pm|admin + X-Project-Id for pm)
|
||||
exists only when PROCUREMENT_DEV_LOGIN_ENABLED=true — same pattern as the
|
||||
inventory router.
|
||||
"""
|
||||
import base64
|
||||
@@ -35,6 +36,7 @@ from sqlalchemy.dialects.postgresql import insert as pg_insert
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.auth import UserContext, get_optional_user
|
||||
from app.config import settings
|
||||
from app.db.engine import get_db
|
||||
from app.models.catalog import BrandMaterial, Material, MaterialCategory, Unit
|
||||
from app.models.inventory import InventoryItem, InventoryTransaction, Warehouse
|
||||
@@ -98,9 +100,12 @@ async def arrivals_scope(
|
||||
if ctx.role in ("admin", "procurement_manager"):
|
||||
return ArrivalScope(role="admin", user_id=ctx.user.id, project_id=project_id, display_name=ctx.display_name)
|
||||
raise ForbiddenError("این بخش فقط برای مدیر پروژه یا مدیر تدارکات است")
|
||||
# Dev fallback: X-User-Role: pm | admin (procurement_manager maps to admin)
|
||||
if not request.headers.get("x-user-role"):
|
||||
raise UnauthorizedError("احراز هویت لازم است — توکن Casdoor یا حالت توسعه را ارسال کنید")
|
||||
# Dev fallback: X-User-Role: pm | admin (procurement_manager maps to
|
||||
# admin) — ONLY when DEV_LOGIN_ENABLED (local testing without Casdoor).
|
||||
# Disabled by default: an ungated header identity in production would
|
||||
# let anyone confirm receipts as PM.
|
||||
if not settings.DEV_LOGIN_ENABLED or not request.headers.get("x-user-role"):
|
||||
raise UnauthorizedError("احراز هویت لازم است — توکن Casdoor ارسال کنید")
|
||||
role = (request.headers.get("x-user-role") or "").strip().lower()
|
||||
if role == "procurement_manager":
|
||||
role = "admin"
|
||||
|
||||
Reference in New Issue
Block a user