ali_mohaghegh
3cd76d335f
- verify kid from the JWT header (pyjwt decode() returns claims, not the header — the old lookup was always None and rejected every token) - convert JWK entries to crypto keys explicitly (pyjwt 2.13 dropped dict keys) and fetch the JWKS from /.well-known/jwks - 401 for missing/invalid/expired/wrong-issuer/wrong-audience tokens (was 403/400); 403 stays for valid-but-roleless users; 503 when Casdoor is unreachable; new CASDOOR_ISSUER setting separates the in-network endpoint from the browser-facing issuer - dev-header fallback in inventory/pm scopes now requires an explicit X-User-Role header (no auth info at all -> 401) - new POST /api/v1/auth/login: password grant against Casdoor, local JWT verification, auto-provisioning, returns token + profile with the role resolved from the app users table
87 lines
3.5 KiB
Python
87 lines
3.5 KiB
Python
"""Auth router — in-page login against Casdoor (password grant).
|
|
|
|
POST /auth/login: the frontend sends username/password; this router exchanges
|
|
them at Casdoor's OAuth token endpoint (grant_type=password), verifies the
|
|
issued JWT locally (JWKS), auto-provisions the `users` row and returns the
|
|
token + profile (role resolved from users.role). No browser redirect.
|
|
|
|
Error mapping (documented in docs/casdoor-auth.md):
|
|
- wrong credentials -> 401 UNAUTHORIZED
|
|
- Casdoor unreachable -> 503 UPSTREAM_UNAVAILABLE
|
|
- Casdoor misconfigured -> 503 UPSTREAM_UNAVAILABLE (details in api logs)
|
|
"""
|
|
import logging
|
|
|
|
import httpx
|
|
from fastapi import APIRouter, Depends
|
|
from pydantic import BaseModel
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.auth import _verify_token, context_from_claims
|
|
from app.config import settings
|
|
from app.db.engine import get_db
|
|
from app.routers.users import _user_project, user_to_dict
|
|
from app.utils.errors import ServiceUnavailableError, UnauthorizedError
|
|
|
|
logger = logging.getLogger("procurement.auth")
|
|
|
|
router = APIRouter(prefix="/auth", tags=["auth"])
|
|
|
|
|
|
class LoginRequest(BaseModel):
|
|
username: str
|
|
password: str
|
|
organization: str | None = None # optional override; defaults to CASDOOR_ORGANIZATION
|
|
|
|
|
|
@router.post("/login")
|
|
async def login(payload: LoginRequest, db: AsyncSession = Depends(get_db)):
|
|
"""Exchange username/password for a Casdoor JWT (OAuth password grant)."""
|
|
url = f"{settings.CASDOOR_ENDPOINT}/api/login/oauth/access_token"
|
|
form = {
|
|
"grant_type": "password",
|
|
"client_id": settings.CASDOOR_CLIENT_ID,
|
|
"client_secret": settings.CASDOOR_CLIENT_SECRET,
|
|
"username": payload.username.strip(),
|
|
"password": payload.password,
|
|
"scope": "openid profile email",
|
|
}
|
|
try:
|
|
async with httpx.AsyncClient(timeout=10) as client:
|
|
resp = await client.post(url, data=form)
|
|
except httpx.HTTPError as exc:
|
|
logger.error("Casdoor token endpoint unreachable (%s): %s", url, exc)
|
|
raise ServiceUnavailableError("سرویس احراز هویت (Casdoor) در دسترس نیست") from exc
|
|
|
|
try:
|
|
body = resp.json()
|
|
except ValueError as exc:
|
|
logger.error("Casdoor token endpoint returned non-JSON (status %s)", resp.status_code)
|
|
raise ServiceUnavailableError("پاسخ نامعتبر از سرویس احراز هویت") from exc
|
|
|
|
access_token = body.get("access_token")
|
|
if not access_token:
|
|
err = body.get("error") or "unknown_error"
|
|
if err in ("invalid_username_or_password", "invalid_grant"):
|
|
raise UnauthorizedError("نام کاربری یا رمز عبور نادرست است", field="password")
|
|
logger.error(
|
|
"Casdoor rejected password grant: error=%s description=%s",
|
|
err,
|
|
body.get("error_description", ""),
|
|
)
|
|
raise ServiceUnavailableError("سرویس احراز هویت به درستی پیکربندی نشده است")
|
|
|
|
# Verify the freshly issued token with our own JWKS checks, then resolve
|
|
# the app-side user (auto-provision on first login).
|
|
claims = await _verify_token(access_token)
|
|
ctx = await context_from_claims(claims, db)
|
|
project = await _user_project(db, ctx.user) if ctx.role == "pm" else None
|
|
return {
|
|
"data": {
|
|
"access_token": access_token,
|
|
"token_type": "bearer",
|
|
"expires_in": body.get("expires_in"),
|
|
"user": user_to_dict(ctx.user, project),
|
|
}
|
|
}
|