PTah
80320ae698
Close audit findings: anti-spoof client IP for login rate limit, JWT/CORS enforce on startup, SSH host-key verification and sudo via stdin, optional WinRM HTTPS, SSE httpOnly cookie auth, ingest body limit, ILIKE escaping, and HMAC API key hashing with legacy SHA-256 fallback.
91 lines
2.7 KiB
Python
91 lines
2.7 KiB
Python
from fastapi import APIRouter, Depends, HTTPException, Request
|
|
from fastapi.responses import JSONResponse, Response
|
|
from pydantic import BaseModel
|
|
from sqlalchemy import func, select
|
|
from sqlalchemy.orm import Session
|
|
|
|
from app.auth.jwt_auth import CurrentUser, create_access_token, get_current_user
|
|
from app.auth.stream_cookie import clear_stream_auth_cookie, set_stream_auth_cookie
|
|
from app.config import get_settings
|
|
from app.database import get_db
|
|
from app.services.login_rate_limit import (
|
|
ensure_login_allowed,
|
|
record_login_failure,
|
|
record_login_success,
|
|
)
|
|
from app.services.user_auth import authenticate_user
|
|
|
|
router = APIRouter(prefix="/auth", tags=["auth"])
|
|
|
|
|
|
class LoginRequest(BaseModel):
|
|
username: str
|
|
password: str
|
|
|
|
|
|
class TokenResponse(BaseModel):
|
|
access_token: str
|
|
token_type: str = "bearer"
|
|
username: str
|
|
role: str
|
|
|
|
|
|
class MeResponse(BaseModel):
|
|
username: str
|
|
role: str
|
|
|
|
|
|
@router.post("/login", response_model=TokenResponse)
|
|
def login(body: LoginRequest, request: Request, db: Session = Depends(get_db)) -> JSONResponse:
|
|
settings = get_settings()
|
|
if not settings.sac_admin_password and not _has_any_user(db):
|
|
raise HTTPException(
|
|
status_code=503,
|
|
detail="SAC UI users are not configured (run alembic upgrade and set SAC_ADMIN_PASSWORD for bootstrap)",
|
|
)
|
|
|
|
ip_address = ensure_login_allowed(db, request)
|
|
|
|
user = authenticate_user(db, body.username, body.password)
|
|
if user is None:
|
|
record_login_failure(db, ip_address=ip_address, username=body.username)
|
|
db.commit()
|
|
raise HTTPException(status_code=401, detail="Invalid username or password")
|
|
|
|
record_login_success(db, ip_address=ip_address, username=user.username)
|
|
db.commit()
|
|
|
|
token = create_access_token(user.username, user.role)
|
|
payload = TokenResponse(
|
|
access_token=token,
|
|
username=user.username,
|
|
role=user.role,
|
|
)
|
|
response = JSONResponse(content=payload.model_dump())
|
|
set_stream_auth_cookie(response, token, settings)
|
|
return response
|
|
|
|
|
|
@router.post("/logout", status_code=204)
|
|
def logout() -> Response:
|
|
settings = get_settings()
|
|
response = Response(status_code=204)
|
|
clear_stream_auth_cookie(response, settings)
|
|
return response
|
|
|
|
|
|
@router.get("/me", response_model=MeResponse)
|
|
def me(current_user: CurrentUser = Depends(get_current_user)) -> MeResponse:
|
|
return MeResponse(username=current_user.username, role=current_user.role)
|
|
|
|
|
|
def _has_any_user(db: Session) -> bool:
|
|
from app.models.user import User
|
|
|
|
try:
|
|
count = db.scalar(select(func.count()).select_from(User)) or 0
|
|
return count > 0
|
|
except Exception:
|
|
db.rollback()
|
|
return False
|