mirror of
https://gitlab.com/MoonTestUse1/AdministrationItDepartmens.git
synced 2025-08-14 00:25:46 +02:00
89 lines
3.0 KiB
Python
89 lines
3.0 KiB
Python
"""Authentication utilities"""
|
|
from fastapi import Depends, HTTPException, status
|
|
from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
|
|
from passlib.context import CryptContext
|
|
from sqlalchemy.orm import Session
|
|
import re
|
|
|
|
from .jwt import verify_token
|
|
from ..database import get_db
|
|
from ..crud import employees
|
|
|
|
pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
|
|
security = HTTPBearer(auto_error=False)
|
|
|
|
def get_password_hash(password: str) -> str:
|
|
"""Hash password"""
|
|
return pwd_context.hash(password)
|
|
|
|
def verify_password(plain_password: str, hashed_password: str) -> bool:
|
|
"""Verify password"""
|
|
return pwd_context.verify(plain_password, hashed_password)
|
|
|
|
def get_current_admin(
|
|
credentials: HTTPAuthorizationCredentials = Depends(security),
|
|
db: Session = Depends(get_db)
|
|
) -> dict:
|
|
"""Get current admin from token"""
|
|
if not credentials:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Not authenticated",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
|
|
try:
|
|
token = credentials.credentials
|
|
payload = verify_token(token, db)
|
|
employee_id = int(payload.get("sub"))
|
|
|
|
# Проверяем, что это админ
|
|
employee = employees.get_employee(db, employee_id)
|
|
if not employee or not employee.is_admin:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail="Not enough permissions",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
|
|
return employee
|
|
except Exception as e:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Invalid authentication credentials",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
|
|
def get_current_employee(
|
|
credentials: HTTPAuthorizationCredentials = Depends(security),
|
|
db: Session = Depends(get_db)
|
|
) -> dict:
|
|
"""Get current employee from token"""
|
|
if not credentials:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Not authenticated",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
|
|
try:
|
|
token = credentials.credentials
|
|
payload = verify_token(token, db)
|
|
employee_id = int(payload.get("sub"))
|
|
|
|
# Проверяем существование сотрудника
|
|
employee = employees.get_employee(db, employee_id)
|
|
if not employee:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Employee not found",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
|
|
return employee
|
|
except Exception:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Invalid authentication credentials",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
) |