whqreza
1f16e44874
Task 1 — PM 1:N + access-loss handling:
- projects.pm_user_id had no UNIQUE constraint (verified live + in schema); added a lookup index via init_db
- auth: UserContext.project_ids = every project of a PM (oldest first); project_id stays the first for compatibility
- GET /users/me/projects — assigned projects of the caller (drives the switcher + revocation validation)
- login / /users/me / /users list now return the full projects array per user
- /inventory/* and /pm/* scopes accept an explicit ?project_id=… and verify the PM manages it (403 otherwise); without the param they fall back to the first project; admin/manager use it as an optional filter
- POST /users/{id}/project is multi-aware: assigns one project (replacing that project's previous PM) and KEEPS the user's other assignments; null clears all
- PATCH /projects/{id} accepts pm_user_id (admin / procurement manager only)
- frontend: auth store holds projects + the active project (persisted via the existing localStorage store); RequirePmProjects re-validates on load, falls back when the active project was revoked, and shows a dedicated no-projects screen with logout (no redirect loop, no re-auth)
- Panels menu: «مدیریت انبار» gets a ChevronDown accordion listing the PM's projects with «✓ فعلی»; selecting one switches only the active project and reloads the section data
- inventory/pm API calls now send the active project_id explicitly
Task 2 — Organization page:
- new searchable ProjectMultiSelect combobox (chips with ×, live Persian filtering via normalize, assigned projects hidden) replaces the single select for PM users
- add = PATCH project pm_user_id=<user>; × = pm_user_id=null; table and project cards sync immediately; RBAC unchanged (role column admin-only, combobox editable for admin + procurement manager)
Verified locally: 17 scripted checks — multi-project assignment without unique conflicts, /users/me/projects, explicit project_id authorization (foreign project 403 on /inventory, /pm/on-the-way, /pm/receipts), PM blocked from pm_user_id changes, legacy assign endpoint keeps other assignments, revocation removes the project from the list, zero-project PM gets an empty list and a guarded inventory endpoint. All test data cleaned up afterwards.
86 lines
3.4 KiB
Python
86 lines
3.4 KiB
Python
"""Auth router — in-page login against Casdoor (password grant).
|
|
|
|
POST /auth/login: the frontend sends username/password; this router exchanges
|
|
them at Casdoor's OAuth token endpoint (grant_type=password), verifies the
|
|
issued JWT locally (JWKS), auto-provisions the `users` row and returns the
|
|
token + profile (role resolved from users.role). No browser redirect.
|
|
|
|
Error mapping (documented in docs/casdoor-auth.md):
|
|
- wrong credentials -> 401 UNAUTHORIZED
|
|
- Casdoor unreachable -> 503 UPSTREAM_UNAVAILABLE
|
|
- Casdoor misconfigured -> 503 UPSTREAM_UNAVAILABLE (details in api logs)
|
|
"""
|
|
import logging
|
|
|
|
import httpx
|
|
from fastapi import APIRouter, Depends
|
|
from pydantic import BaseModel
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.auth import _verify_token, context_from_claims
|
|
from app.config import settings
|
|
from app.db.engine import get_db
|
|
from app.routers.users import _user_projects, user_to_dict
|
|
from app.utils.errors import ServiceUnavailableError, UnauthorizedError
|
|
|
|
logger = logging.getLogger("procurement.auth")
|
|
|
|
router = APIRouter(prefix="/auth", tags=["auth"])
|
|
|
|
|
|
class LoginRequest(BaseModel):
|
|
username: str
|
|
password: str
|
|
|
|
|
|
@router.post("/login")
|
|
async def login(payload: LoginRequest, db: AsyncSession = Depends(get_db)):
|
|
"""Exchange username/password for a Casdoor JWT (OAuth password grant)."""
|
|
url = f"{settings.CASDOOR_ENDPOINT}/api/login/oauth/access_token"
|
|
form = {
|
|
"grant_type": "password",
|
|
"client_id": settings.CASDOOR_CLIENT_ID,
|
|
"client_secret": settings.CASDOOR_CLIENT_SECRET,
|
|
"username": payload.username.strip(),
|
|
"password": payload.password,
|
|
"scope": "openid profile email",
|
|
}
|
|
try:
|
|
async with httpx.AsyncClient(timeout=10) as client:
|
|
resp = await client.post(url, data=form)
|
|
except httpx.HTTPError as exc:
|
|
logger.error("Casdoor token endpoint unreachable (%s): %s", url, exc)
|
|
raise ServiceUnavailableError("سرویس احراز هویت (Casdoor) در دسترس نیست") from exc
|
|
|
|
try:
|
|
body = resp.json()
|
|
except ValueError as exc:
|
|
logger.error("Casdoor token endpoint returned non-JSON (status %s)", resp.status_code)
|
|
raise ServiceUnavailableError("پاسخ نامعتبر از سرویس احراز هویت") from exc
|
|
|
|
access_token = body.get("access_token")
|
|
if not access_token:
|
|
err = body.get("error") or "unknown_error"
|
|
if err in ("invalid_username_or_password", "invalid_grant"):
|
|
raise UnauthorizedError("نام کاربری یا رمز عبور نادرست است", field="password")
|
|
logger.error(
|
|
"Casdoor rejected password grant: error=%s description=%s",
|
|
err,
|
|
body.get("error_description", ""),
|
|
)
|
|
raise ServiceUnavailableError("سرویس احراز هویت به درستی پیکربندی نشده است")
|
|
|
|
# Verify the freshly issued token with our own JWKS checks, then resolve
|
|
# the app-side user (auto-provision on first login).
|
|
claims = await _verify_token(access_token)
|
|
ctx = await context_from_claims(claims, db)
|
|
projects = await _user_projects(db, ctx.user)
|
|
return {
|
|
"data": {
|
|
"access_token": access_token,
|
|
"token_type": "bearer",
|
|
"expires_in": body.get("expires_in"),
|
|
"user": user_to_dict(ctx.user, projects),
|
|
}
|
|
}
|