mirror of
https://gitlab.com/MoonTestUse1/AdministrationItDepartmens.git
synced 2025-08-14 00:25:46 +02:00
91 lines
3.0 KiB
Python
91 lines
3.0 KiB
Python
"""Authentication utilities"""
|
|
from fastapi import Depends, HTTPException, status
|
|
from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
|
|
from passlib.context import CryptContext
|
|
from sqlalchemy.orm import Session
|
|
import logging
|
|
|
|
from .jwt import verify_token
|
|
from ..database import get_db
|
|
|
|
# Настраиваем логирование
|
|
logger = logging.getLogger(__name__)
|
|
|
|
pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
|
|
security = HTTPBearer(auto_error=False)
|
|
|
|
def get_password_hash(password: str) -> str:
|
|
"""Hash password"""
|
|
return pwd_context.hash(password)
|
|
|
|
def verify_password(plain_password: str, hashed_password: str) -> bool:
|
|
"""Verify password"""
|
|
return pwd_context.verify(plain_password, hashed_password)
|
|
|
|
def get_current_admin(
|
|
credentials: HTTPAuthorizationCredentials = Depends(security),
|
|
db: Session = Depends(get_db)
|
|
) -> dict:
|
|
"""Get current admin from token"""
|
|
if not credentials:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Not authenticated",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
|
|
try:
|
|
token = credentials.credentials
|
|
payload = verify_token(token, db)
|
|
employee_id = int(payload.get("sub"))
|
|
|
|
# Проверяем, что это админ (id = -1)
|
|
if employee_id != -1:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Not an admin",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
|
|
return {"is_admin": True}
|
|
except Exception as e:
|
|
logger.error(f"Authentication error: {e}")
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Invalid authentication credentials",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
|
|
def get_current_employee(
|
|
credentials: HTTPAuthorizationCredentials = Depends(security),
|
|
db: Session = Depends(get_db)
|
|
) -> dict:
|
|
"""Get current employee from token"""
|
|
if not credentials:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Not authenticated",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
|
|
try:
|
|
token = credentials.credentials
|
|
payload = verify_token(token, db)
|
|
employee_id = int(payload.get("sub"))
|
|
|
|
# Проверяем, что это не админ
|
|
if employee_id == -1:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Admin cannot access employee endpoints",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
|
|
return {"id": employee_id}
|
|
except Exception as e:
|
|
logger.error(f"Authentication error: {e}")
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Invalid authentication credentials",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
) |