MMD
e5d6c77c3c
- db-backup sidecar: pg_dump -Fc of procurement+casdoor every BACKUP_INTERVAL_SECONDS into BACKUP_DIR, retention via BACKUP_KEEP_DAYS - audit_log table (migration.sql + runtime ensure_audit_table) with model + transactional helper (utils/audit.record) — wired into user create/role-change and inventory transaction creation - get_actor: quote_events.actor now stores the VERIFIED user's display name instead of the raw bearer token
32 lines
1.2 KiB
Python
32 lines
1.2 KiB
Python
"""Attribution for quote_events.actor — the VERIFIED user, not the raw token.
|
|
|
|
Historically this stored the bearer token string verbatim (unverifiable and
|
|
a token leak into the database). All routes that use it now sit behind the
|
|
global JWT dependency, so the token is resolved to the authenticated user
|
|
and the display name is recorded instead.
|
|
"""
|
|
from fastapi import Depends, Request
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.auth import get_optional_user
|
|
from app.db.engine import get_db
|
|
|
|
|
|
async def get_actor(request: Request, db: AsyncSession = Depends(get_db)) -> str | None:
|
|
"""Resolve the caller's display name from the Casdoor Bearer token."""
|
|
ctx = await get_optional_user(request, db)
|
|
if ctx is not None:
|
|
return ctx.display_name
|
|
# Dev-mode header fallback (only active when DEV_LOGIN_ENABLED) carries
|
|
# the name in X-User-Name / X-User-Name-B64 — keep attribution useful.
|
|
name = request.headers.get("x-user-name")
|
|
import base64
|
|
|
|
b64 = request.headers.get("x-user-name-b64")
|
|
if b64:
|
|
try:
|
|
name = base64.b64decode(b64.encode()).decode("utf-8")
|
|
except Exception:
|
|
pass
|
|
return name
|