70 lines
2.7 KiB
Python
70 lines
2.7 KiB
Python
from typing import Optional
|
|
|
|
import jwt
|
|
from fastapi import Depends, Header, HTTPException, Request
|
|
|
|
from app.core.ctx import CTX_USER_ID
|
|
from app.models import Role, User, WeixinUser
|
|
from app.settings import settings
|
|
|
|
|
|
class AuthControl:
|
|
@classmethod
|
|
async def is_authed(cls, token: str = Header(..., description="token验证")) -> Optional["User"]:
|
|
try:
|
|
if token == "dev":
|
|
user = await User.filter().first()
|
|
user_id = user.id
|
|
else:
|
|
decode_data = jwt.decode(token, settings.SECRET_KEY, algorithms=settings.JWT_ALGORITHM)
|
|
user_id = decode_data.get("user_id")
|
|
user = await User.filter(id=user_id).first()
|
|
if not user:
|
|
raise HTTPException(status_code=401, detail="Authentication failed")
|
|
CTX_USER_ID.set(int(user_id))
|
|
return user
|
|
except jwt.DecodeError:
|
|
raise HTTPException(status_code=401, detail="无效的Token")
|
|
except jwt.ExpiredSignatureError:
|
|
raise HTTPException(status_code=401, detail="登录已过期")
|
|
except Exception as e:
|
|
raise HTTPException(status_code=500, detail=f"{repr(e)}")
|
|
|
|
@classmethod
|
|
async def weixin_user(cls, request: Request) -> WeixinUser:
|
|
path = request.url.path
|
|
if path in [
|
|
"/api/v1/msg/new_order",
|
|
"/api/v1/event/feishu",
|
|
"/api/v1/msg/get_order_user_days_before",
|
|
]:
|
|
return None
|
|
|
|
token = request.headers.get("token")
|
|
user = await WeixinUser.filter(userid=token).first()
|
|
assert user, "Authentication failed"
|
|
CTX_USER_ID.set(int(user.id))
|
|
return user # 返回的是 WeixinUser 实例
|
|
|
|
class PermissionControl:
|
|
@classmethod
|
|
async def has_permission(cls, request: Request, current_user: User = Depends(AuthControl.is_authed)) -> None:
|
|
if current_user.is_superuser:
|
|
return
|
|
method = request.method
|
|
path = request.url.path
|
|
roles: list[Role] = await current_user.roles
|
|
if not roles:
|
|
raise HTTPException(status_code=403, detail="The user is not bound to a role")
|
|
apis = [await role.apis for role in roles]
|
|
permission_apis = list(set((api.method, api.path) for api in sum(apis, [])))
|
|
# path = "/api/v1/auth/userinfo"
|
|
# method = "GET"
|
|
if (method, path) not in permission_apis:
|
|
raise HTTPException(status_code=403, detail=f"Permission denied method:{method} path:{path}")
|
|
|
|
|
|
DependAuth = Depends(AuthControl.is_authed)
|
|
DependWeixinUser = Depends(AuthControl.weixin_user)
|
|
DependPermisson = Depends(PermissionControl.has_permission)
|