feat: iam rbac system
Endpoints and db architecture to support a role based IAM system.
This commit is contained in:
parent
7b3ee9d5fa
commit
23f2ce98d7
31 changed files with 634 additions and 317 deletions
|
|
@ -8,54 +8,4 @@ from fastapi import APIRouter
|
|||
|
||||
router = APIRouter(
|
||||
tags=["auth"],
|
||||
)
|
||||
|
||||
|
||||
|
||||
|
||||
# oauth = OAuth()
|
||||
# oauth.register(
|
||||
# name="oidc",
|
||||
# server_metadata_url=auth_settings.OIDC_CONFIG,
|
||||
# client_id=auth_settings.CLIENT_ID,
|
||||
# client_secret=None,
|
||||
# code_challenge_method="S256",
|
||||
# client_kwargs={
|
||||
# "code_challenge_method": "S256",
|
||||
# "scope": "openid profile email",
|
||||
# }
|
||||
# )
|
||||
|
||||
|
||||
# @auth_router.get('/login')
|
||||
# async def login(request: Request):
|
||||
# redirect_uri = request.url_for('auth')
|
||||
# return await oauth.oidc.authorize_redirect(request, redirect_uri, code_challenge_method="S256")
|
||||
#
|
||||
#
|
||||
# @auth_router.get('/auth', include_in_schema=False)
|
||||
# async def auth(db: db_dependency, request: Request):
|
||||
# token = await oauth.oidc.authorize_access_token(request)
|
||||
# user = token.get("userinfo")
|
||||
# request.session["user"] = user
|
||||
#
|
||||
# try:
|
||||
# valid_user = OIDCUser(first_name=user["given_name"], last_name=user["family_name"], email=user["email"], oidc_id=user["sub"])
|
||||
# except Exception as e:
|
||||
# print(e)
|
||||
# raise HTTPException(status_code=422, detail="Invalid or missing OIDC data")
|
||||
#
|
||||
# user_exists = db.query(exists().where(User.oidc_id == valid_user.oidc_id)).scalar()
|
||||
#
|
||||
# if not user_exists:
|
||||
# user_model = User(**valid_user.model_dump())
|
||||
# db.add(user_model)
|
||||
# db.commit()
|
||||
#
|
||||
# return RedirectResponse(url="/")
|
||||
#
|
||||
#
|
||||
# @auth_router.get('/logout')
|
||||
# async def logout(request: Request):
|
||||
# request.session.pop('user', None)
|
||||
# return RedirectResponse(url='/')
|
||||
)
|
||||
|
|
@ -88,33 +88,6 @@ async def is_org_user(claims: claims_dependency, db: db_dependency, org_id: int
|
|||
org_user_dependency = Annotated[dict[str, Any], Depends(is_org_user)]
|
||||
|
||||
|
||||
async def is_org_admin(claims: claims_dependency, db: db_dependency, org_id: int = Path(gt=0)):
|
||||
org_exists = db.query(exists().where(Org.id == org_id)).scalar()
|
||||
if not org_exists:
|
||||
raise HTTPException(status_code=404, detail="Organisation not found")
|
||||
|
||||
db_id = claims.get("db_id", None)
|
||||
if db_id is None:
|
||||
raise HTTPException(status_code=404, detail="User not found in db")
|
||||
|
||||
exists_query = (db.query(OrgUsers)
|
||||
.filter(OrgUsers.org_id == org_id,
|
||||
OrgUsers.user_id == db_id,
|
||||
OrgUsers.is_admin == True
|
||||
).exists()
|
||||
)
|
||||
|
||||
org_admin_exists = db.query(exists_query).scalar()
|
||||
|
||||
if not org_admin_exists:
|
||||
raise HTTPException(status_code=401, detail="Not authorised")
|
||||
|
||||
return org_admin_exists
|
||||
|
||||
|
||||
org_admin_dependency = Annotated[dict[str, Any], Depends(is_org_admin)]
|
||||
|
||||
|
||||
async def is_super_admin(claims: claims_dependency):
|
||||
super_admin_ids = []
|
||||
|
||||
|
|
@ -128,114 +101,3 @@ async def is_super_admin(claims: claims_dependency):
|
|||
|
||||
|
||||
super_admin_dependency = Annotated[dict[str, Any], Depends(is_super_admin)]
|
||||
|
||||
|
||||
async def is_admin(claims: claims_dependency, db: db_dependency, org_id: int = Path(gt=0)):
|
||||
try:
|
||||
await is_super_admin(claims)
|
||||
return True
|
||||
except HTTPException as e:
|
||||
pass
|
||||
try:
|
||||
await is_org_admin(claims, db, org_id)
|
||||
return True
|
||||
except HTTPException as e:
|
||||
raise HTTPException(status_code=401, detail="Not authorised")
|
||||
|
||||
org_or_super_admin_dependency = Annotated[dict[str, Any], Depends(is_admin)]
|
||||
|
||||
# Middleware version of user auth
|
||||
# import json
|
||||
# import logging
|
||||
#
|
||||
# from threading import Timer
|
||||
# from urllib.request import urlopen
|
||||
# from starlette.requests import HTTPConnection, Request
|
||||
#
|
||||
# from authlib.jose.rfc7517.jwk import JsonWebKey
|
||||
# from authlib.jose.rfc7517.key_set import KeySet
|
||||
# from authlib.oauth2 import OAuth2Error, ResourceProtector
|
||||
# from authlib.oauth2.rfc6749 import MissingAuthorizationError
|
||||
# from authlib.oauth2.rfc7523 import JWTBearerTokenValidator
|
||||
# from authlib.oauth2.rfc7523.validator import JWTBearerToken
|
||||
#
|
||||
# from starlette.authentication import (
|
||||
# AuthCredentials,
|
||||
# AuthenticationBackend,
|
||||
# AuthenticationError,
|
||||
# SimpleUser,
|
||||
# )
|
||||
#
|
||||
# logger = logging.getLogger(__name__)
|
||||
#
|
||||
#
|
||||
# class RepeatTimer(Timer):
|
||||
# def __init__(self, *args, **kwargs) -> None:
|
||||
# super().__init__(*args, **kwargs)
|
||||
# self.daemon = True
|
||||
#
|
||||
# def run(self):
|
||||
# while not self.finished.wait(self.interval):
|
||||
# self.function(*self.args, **self.kwargs)
|
||||
#
|
||||
#
|
||||
# class BearerTokenValidator(JWTBearerTokenValidator):
|
||||
# def __init__(self, issuer: str, audience: str):
|
||||
# self._issuer = issuer
|
||||
# self._jwks_uri: str | None = None
|
||||
# super().__init__(public_key=self.fetch_key(), issuer=issuer)
|
||||
# self.claims_options = {
|
||||
# "exp": {"essential": True},
|
||||
# "aud": {"essential": True, "value": audience},
|
||||
# "iss": {"essential": True, "value": issuer},
|
||||
# }
|
||||
# self._timer = RepeatTimer(3600, self.refresh)
|
||||
# self._timer.start()
|
||||
#
|
||||
# def refresh(self):
|
||||
# try:
|
||||
# self.public_key = self.fetch_key()
|
||||
# except Exception as exc:
|
||||
# logger.warning(f"Could not update jwks public key: {exc}")
|
||||
#
|
||||
# def fetch_key(self) -> KeySet:
|
||||
# """Fetch the jwks_uri document and return the KeySet."""
|
||||
# response = urlopen(self.jwks_uri)
|
||||
# logger.debug(f"OK GET {self.jwks_uri}")
|
||||
# return JsonWebKey.import_key_set(json.loads(response.read()))
|
||||
#
|
||||
# @property
|
||||
# def jwks_uri(self) -> str:
|
||||
# """The jwks_uri field of the openid-configuration document."""
|
||||
# if self._jwks_uri is None:
|
||||
# config_url = urlopen(f"{self._issuer}/.well-known/openid-configuration")
|
||||
# config = json.loads(config_url.read())
|
||||
# self._jwks_uri = config["jwks_uri"]
|
||||
# return self._jwks_uri
|
||||
#
|
||||
#
|
||||
# class BearerTokenAuthBackend(AuthenticationBackend):
|
||||
# def __init__(self, issuer: str, audience: str) -> None:
|
||||
# rp = ResourceProtector()
|
||||
# validator = BearerTokenValidator(
|
||||
# issuer=issuer,
|
||||
# audience=audience,
|
||||
# )
|
||||
# rp.register_token_validator(validator)
|
||||
# self.resource_protector = rp
|
||||
#
|
||||
# async def authenticate(self, conn: HTTPConnection):
|
||||
# if "Authorization" not in conn.headers:
|
||||
# return
|
||||
# request = Request(conn.scope)
|
||||
# try:
|
||||
# token: JWTBearerToken = self.resource_protector.validate_request(
|
||||
# scopes=["openid"],
|
||||
# request=request,
|
||||
# )
|
||||
# except (MissingAuthorizationError, OAuth2Error) as error:
|
||||
# raise AuthenticationError(error.description) from error
|
||||
# scope: str = token.get_scope()
|
||||
# scopes = scope.split()
|
||||
# scopes.append("authenticated")
|
||||
# return AuthCredentials(scopes=scopes), SimpleUser(username=token["email"])
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue