whqreza
593c149478
Part 1 — show/hide password: an eye/eye-off button inside the login password input switches its type between password and text. It sits on the right (the input is LTR) with pr-10 clearance so dots never overlap the icon; type=button so a click cannot submit the form, aria-label Show/Hide password, aria-pressed + aria-controls, plus a Persian tooltip.
Part 2 — Organization field removed end-to-end after the audit proved it was a no-op: LoginPage input/state/payload spread (main + dev-mode admin login), api.ts payload type, backend LoginRequest.organization (declared but never forwarded to Casdoor — a bogus org value still logged in successfully), and the casdoor-auth.md flow diagram. The organization actually used remains CASDOOR_ORGANIZATION=inventory for /users/sync.
Verified: api + frontend images rebuilt and redeployed; login works with {username, password}; the served LoginPage chunk contains the toggle and zero org-field leftovers.
86 lines
3.4 KiB
Python
86 lines
3.4 KiB
Python
"""Auth router — in-page login against Casdoor (password grant).
|
|
|
|
POST /auth/login: the frontend sends username/password; this router exchanges
|
|
them at Casdoor's OAuth token endpoint (grant_type=password), verifies the
|
|
issued JWT locally (JWKS), auto-provisions the `users` row and returns the
|
|
token + profile (role resolved from users.role). No browser redirect.
|
|
|
|
Error mapping (documented in docs/casdoor-auth.md):
|
|
- wrong credentials -> 401 UNAUTHORIZED
|
|
- Casdoor unreachable -> 503 UPSTREAM_UNAVAILABLE
|
|
- Casdoor misconfigured -> 503 UPSTREAM_UNAVAILABLE (details in api logs)
|
|
"""
|
|
import logging
|
|
|
|
import httpx
|
|
from fastapi import APIRouter, Depends
|
|
from pydantic import BaseModel
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.auth import _verify_token, context_from_claims
|
|
from app.config import settings
|
|
from app.db.engine import get_db
|
|
from app.routers.users import _user_project, user_to_dict
|
|
from app.utils.errors import ServiceUnavailableError, UnauthorizedError
|
|
|
|
logger = logging.getLogger("procurement.auth")
|
|
|
|
router = APIRouter(prefix="/auth", tags=["auth"])
|
|
|
|
|
|
class LoginRequest(BaseModel):
|
|
username: str
|
|
password: str
|
|
|
|
|
|
@router.post("/login")
|
|
async def login(payload: LoginRequest, db: AsyncSession = Depends(get_db)):
|
|
"""Exchange username/password for a Casdoor JWT (OAuth password grant)."""
|
|
url = f"{settings.CASDOOR_ENDPOINT}/api/login/oauth/access_token"
|
|
form = {
|
|
"grant_type": "password",
|
|
"client_id": settings.CASDOOR_CLIENT_ID,
|
|
"client_secret": settings.CASDOOR_CLIENT_SECRET,
|
|
"username": payload.username.strip(),
|
|
"password": payload.password,
|
|
"scope": "openid profile email",
|
|
}
|
|
try:
|
|
async with httpx.AsyncClient(timeout=10) as client:
|
|
resp = await client.post(url, data=form)
|
|
except httpx.HTTPError as exc:
|
|
logger.error("Casdoor token endpoint unreachable (%s): %s", url, exc)
|
|
raise ServiceUnavailableError("سرویس احراز هویت (Casdoor) در دسترس نیست") from exc
|
|
|
|
try:
|
|
body = resp.json()
|
|
except ValueError as exc:
|
|
logger.error("Casdoor token endpoint returned non-JSON (status %s)", resp.status_code)
|
|
raise ServiceUnavailableError("پاسخ نامعتبر از سرویس احراز هویت") from exc
|
|
|
|
access_token = body.get("access_token")
|
|
if not access_token:
|
|
err = body.get("error") or "unknown_error"
|
|
if err in ("invalid_username_or_password", "invalid_grant"):
|
|
raise UnauthorizedError("نام کاربری یا رمز عبور نادرست است", field="password")
|
|
logger.error(
|
|
"Casdoor rejected password grant: error=%s description=%s",
|
|
err,
|
|
body.get("error_description", ""),
|
|
)
|
|
raise ServiceUnavailableError("سرویس احراز هویت به درستی پیکربندی نشده است")
|
|
|
|
# Verify the freshly issued token with our own JWKS checks, then resolve
|
|
# the app-side user (auto-provision on first login).
|
|
claims = await _verify_token(access_token)
|
|
ctx = await context_from_claims(claims, db)
|
|
project = await _user_project(db, ctx.user) if ctx.role == "pm" else None
|
|
return {
|
|
"data": {
|
|
"access_token": access_token,
|
|
"token_type": "bearer",
|
|
"expires_in": body.get("expires_in"),
|
|
"user": user_to_dict(ctx.user, project),
|
|
}
|
|
}
|