B0rbor4d
cf7c29639c
Backend: config/db/security/logging core, SQLAlchemy models (Server, Credential, UpdateJob, UpdateLog, AuditLog, User), services (winrm, ssh, cau, audit, job_runner), REST API (auth, servers, updates, audit), Socket.io WebSocket layer. Frontend: Vue 3 + TS + Pinia + Tailwind, Views (Dashboard, Servers, Updates, Audit, Login), axios + socket.io-client, nginx prod config.
43 lines
1.4 KiB
Python
43 lines
1.4 KiB
Python
"""Shared API dependencies: current user extraction from JWT."""
|
|
|
|
from fastapi import Depends, Request
|
|
from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.core.database import get_db
|
|
from app.core.exceptions import ForbiddenError, UnauthorizedError
|
|
from app.core.security import decode_token
|
|
from app.models.user import User
|
|
|
|
bearer_scheme = HTTPBearer(auto_error=False)
|
|
|
|
|
|
async def get_current_user(
|
|
credentials: HTTPAuthorizationCredentials | None = Depends(bearer_scheme),
|
|
db: AsyncSession = Depends(get_db),
|
|
) -> User:
|
|
if credentials is None:
|
|
raise UnauthorizedError("Authorization header fehlt")
|
|
payload = decode_token(credentials.credentials)
|
|
username = payload.get("sub")
|
|
if not username:
|
|
raise UnauthorizedError("Token enthält keinen Benutzer")
|
|
|
|
from sqlalchemy import select
|
|
|
|
result = await db.execute(select(User).where(User.username == username))
|
|
user = result.scalar_one_or_none()
|
|
if not user or not user.is_active:
|
|
raise UnauthorizedError("Benutzer unbekannt oder deaktiviert")
|
|
return user
|
|
|
|
|
|
async def require_admin(user: User = Depends(get_current_user)) -> User:
|
|
if not user.is_admin:
|
|
raise ForbiddenError("Administratorrechte erforderlich")
|
|
return user
|
|
|
|
|
|
def client_ip(request: Request) -> str | None:
|
|
return request.client.host if request.client else None
|