342 lines
14 KiB
Python
Executable File
342 lines
14 KiB
Python
Executable File
# /opt/docker/dev/service_finder/backend/app/api/deps.py
|
|
from typing import Optional, Dict, Any, Union, List
|
|
import logging
|
|
from fastapi import Depends, HTTPException, status
|
|
from fastapi.security import OAuth2PasswordBearer
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
from sqlalchemy import select
|
|
from sqlalchemy.orm import selectinload, joinedload
|
|
|
|
from app.db.session import get_db
|
|
from app.core.security import decode_token, DEFAULT_RANK_MAP
|
|
from app.models.identity import User, UserRole # JAVÍTVA: Új Identity modell használata
|
|
from app.models.marketplace.organization import OrgRole, OrganizationMember
|
|
from app.core.config import settings
|
|
from app.core.translation_helper import t # Translation helper
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
# --- GONDOLATMENET / THOUGHT PROCESS ---
|
|
# 1. Az OAuth2 folyamat a központosított bejelentkezési végponton keresztül fut.
|
|
# 2. A token visszafejtésekor ellenőrizni kell a 'type' mezőt, hogy ne lehessen refresh tokennel belépni.
|
|
# 3. A felhasználó lekérésekor a SQLAlchemy 2.0 aszinkron 'execute' és 'scalar_one_or_none' metódusait használjuk.
|
|
# 4. A Scoped RBAC (Role-Based Access Control) biztosítja, hogy a felhasználók ne férjenek hozzá egymás flottáihoz.
|
|
# ---------------------------------------
|
|
|
|
# Az OAuth2 folyamat a bejelentkezési végponton keresztül
|
|
reusable_oauth2 = OAuth2PasswordBearer(
|
|
tokenUrl=f"{settings.API_V1_STR}/auth/login"
|
|
)
|
|
|
|
async def get_current_token_payload(
|
|
token: str = Depends(reusable_oauth2)
|
|
) -> Dict[str, Any]:
|
|
"""
|
|
JWT token visszafejtése és a típus (access) ellenőrzése.
|
|
"""
|
|
# Fejlesztői bypass (opcionális, csak DEBUG módban)
|
|
if settings.DEBUG and token == "dev_bypass_active":
|
|
return {
|
|
"sub": "1",
|
|
"role": "superadmin",
|
|
"rank": 100,
|
|
"scope_level": "global",
|
|
"scope_id": "all",
|
|
"type": "access"
|
|
}
|
|
|
|
payload = decode_token(token)
|
|
if not payload or payload.get("type") != "access":
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail=t("AUTH.INVALID_OR_EXPIRED_SESSION")
|
|
)
|
|
return payload
|
|
|
|
async def get_current_user(
|
|
db: AsyncSession = Depends(get_db),
|
|
payload: Dict = Depends(get_current_token_payload)
|
|
) -> User:
|
|
"""
|
|
Lekéri a felhasználót a token 'sub' mezője alapján (SQLAlchemy 2.0 aszinkron módon).
|
|
"""
|
|
user_id = payload.get("sub")
|
|
if not user_id:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail=t("AUTH.TOKEN_IDENTIFICATION_ERROR")
|
|
)
|
|
|
|
# JAVÍTVA: Modern SQLAlchemy 2.0 aszinkron lekérdezés with eager loading
|
|
# We need to load the person relationship to avoid lazy loading issues
|
|
# Also load Person.address for nested profile response
|
|
from app.models.identity import Person
|
|
from app.models.identity.address import Address, GeoPostalCode
|
|
stmt = (
|
|
select(User)
|
|
.where(User.id == int(user_id))
|
|
.options(
|
|
joinedload(User.person)
|
|
.joinedload(Person.address)
|
|
.joinedload(Address.postal_code) # <-- EZ KELL IDE: postal_code eager loading a zip/city property-khez
|
|
)
|
|
)
|
|
result = await db.execute(stmt)
|
|
user = result.unique().scalar_one_or_none()
|
|
|
|
if not user or user.is_deleted:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_404_NOT_FOUND,
|
|
detail=t("AUTH.USER_NOT_FOUND")
|
|
)
|
|
return user
|
|
|
|
async def get_current_active_user(
|
|
current_user: User = Depends(get_current_user),
|
|
) -> User:
|
|
"""
|
|
Ellenőrzi, hogy a felhasználó aktív-e (KYC Step 2 kész).
|
|
"""
|
|
if not current_user.is_active:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail=t("AUTH.ACTIVE_PROFILE_KYC_REQUIRED")
|
|
)
|
|
return current_user
|
|
|
|
async def check_resource_access(
|
|
resource_scope_id: Union[str, int],
|
|
current_user: User = Depends(get_current_user)
|
|
):
|
|
"""
|
|
Scoped RBAC: Megakadályozza a jogosulatlan hozzáférést mások adataihoz.
|
|
"""
|
|
if current_user.role == UserRole.SUPERADMIN:
|
|
return True
|
|
|
|
user_scope = str(current_user.scope_id) if current_user.scope_id else None
|
|
requested_scope = str(resource_scope_id)
|
|
|
|
# 1. Saját ID ellenőrzése
|
|
if str(current_user.id) == requested_scope:
|
|
return True
|
|
|
|
# 2. Szervezeti/Flotta scope ellenőrzése
|
|
if user_scope and user_scope == requested_scope:
|
|
return True
|
|
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail=t("AUTH.NO_PERMISSION_FOR_RESOURCE")
|
|
)
|
|
|
|
def check_min_rank(role_key: str):
|
|
"""
|
|
Dinamikus Rank ellenőrzés a system_parameters tábla alapján.
|
|
"""
|
|
async def rank_checker(
|
|
db: AsyncSession = Depends(get_db),
|
|
payload: Dict = Depends(get_current_token_payload)
|
|
):
|
|
# A settings.get_db_setting-et használjuk a dinamikus lekéréshez
|
|
ranks = await settings.get_db_setting(
|
|
db, "rbac_rank_matrix", default=DEFAULT_RANK_MAP
|
|
)
|
|
|
|
# A DEFAULT_RANK_MAP nagybetűs kulcsokat vár, ezért átalakítjuk
|
|
role_key_upper = role_key.upper()
|
|
required_rank = ranks.get(role_key_upper, 0)
|
|
user_rank = payload.get("rank", 0)
|
|
|
|
if user_rank < required_rank:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail=f"Alacsony jogosultsági szint. (Elvárt: {required_rank})"
|
|
)
|
|
return True
|
|
return rank_checker
|
|
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# RBAC Phase 1.5: Staff & Flexible Role Dependencies
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
# All internal staff roles that can access the Backoffice (admin.servicefinder.hu)
|
|
STAFF_ROLES = {
|
|
UserRole.SUPERADMIN,
|
|
UserRole.ADMIN,
|
|
UserRole.MODERATOR,
|
|
UserRole.SALES_REP,
|
|
UserRole.SERVICE_MGR,
|
|
}
|
|
|
|
async def get_current_staff(
|
|
current_user: User = Depends(get_current_user)
|
|
) -> User:
|
|
"""
|
|
🎯 Staff-level access dependency.
|
|
|
|
Admits all internal staff roles: SUPERADMIN, ADMIN, MODERATOR,
|
|
SALES_REP, and SERVICE_MGR.
|
|
|
|
Use this for Backoffice (admin.servicefinder.hu) endpoints that
|
|
should be accessible to all staff members, not just superadmins.
|
|
"""
|
|
if current_user.role not in STAFF_ROLES:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail="AUTH.STAFF_ONLY"
|
|
)
|
|
return current_user
|
|
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# RBAC Phase 2: Capability Dependencies (Kapuőrök)
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
def RequireOrgCapability(capability_name: str):
|
|
"""
|
|
🎯 Szervezeti képesség-ellenőrző dependency.
|
|
|
|
Használat:
|
|
@router.post("/expenses")
|
|
async def create_expense(
|
|
expense: AssetCostCreate,
|
|
db: AsyncSession = Depends(get_db),
|
|
current_user: User = Depends(get_current_user),
|
|
_ = Depends(RequireOrgCapability("can_add_expense"))
|
|
):
|
|
|
|
Logika:
|
|
1. Ha a user SUPERADMIN → azonnal átengedi (True).
|
|
2. Lekéri a user OrgRole-ját az adott organization_id alapján
|
|
a fleet.organization_members táblából.
|
|
3. Kikeresi a fleet.org_roles táblából a szerepkörhöz tartozó
|
|
permissions JSONB oszlopot.
|
|
4. Ha a JSONB-ben a kért capability_name nem True → 403 Forbidden.
|
|
|
|
Fontos: Ez a dependency egy organization_id paramétert vár a végponttól.
|
|
A végpontnak át kell adnia az org_id-t a dependency-nek.
|
|
"""
|
|
async def org_capability_checker(
|
|
organization_id: int,
|
|
db: AsyncSession = Depends(get_db),
|
|
current_user: User = Depends(get_current_user),
|
|
) -> bool:
|
|
# SUPERADMIN mindent visz
|
|
if current_user.role == UserRole.SUPERADMIN:
|
|
return True
|
|
|
|
# 1. Lekérjük a user szerepkörét a szervezetben
|
|
member_stmt = select(OrganizationMember.role).where(
|
|
OrganizationMember.user_id == current_user.id,
|
|
OrganizationMember.organization_id == organization_id,
|
|
OrganizationMember.status == "active"
|
|
).limit(1)
|
|
member_result = await db.execute(member_stmt)
|
|
org_role_name = member_result.scalar_one_or_none()
|
|
|
|
if not org_role_name:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail="ORG_MEMBERSHIP_REQUIRED: You are not a member of this organization."
|
|
)
|
|
|
|
# 2. Lekérjük a szerepkör permissions JSONB-jét a fleet.org_roles táblából
|
|
role_stmt = select(OrgRole.permissions).where(
|
|
OrgRole.name_key == org_role_name,
|
|
OrgRole.is_active == True
|
|
).limit(1)
|
|
role_result = await db.execute(role_stmt)
|
|
permissions = role_result.scalar_one_or_none()
|
|
|
|
if not permissions:
|
|
# Fallback: ha nincs a fleet.org_roles táblában, használjuk a
|
|
# OrganizationMember.permissions mezőt (örökölt viselkedés)
|
|
member_perm_stmt = select(OrganizationMember.permissions).where(
|
|
OrganizationMember.user_id == current_user.id,
|
|
OrganizationMember.organization_id == organization_id,
|
|
OrganizationMember.status == "active"
|
|
).limit(1)
|
|
member_perm_result = await db.execute(member_perm_stmt)
|
|
permissions = member_perm_result.scalar_one_or_none() or {}
|
|
|
|
# 3. Ellenőrizzük a kért képességet
|
|
if not isinstance(permissions, dict):
|
|
permissions = {}
|
|
|
|
if not permissions.get(capability_name, False):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail=f"ORG_CAPABILITY_DENIED: A '{capability_name}' képesség nem elérhető a '{org_role_name}' szerepkör számára ebben a szervezetben."
|
|
)
|
|
|
|
return True
|
|
|
|
return org_capability_checker
|
|
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# RBAC Phase 2: DB-Driven Permission Code Dependency (RequirePermission)
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
def RequirePermission(permission_code: str):
|
|
"""
|
|
🎯 DB-driven permission code dependency factory.
|
|
|
|
Queries the system.role_permissions table (via RBACService.get_role_permissions)
|
|
to check if the current user's role has the specified permission code granted.
|
|
|
|
SUPERADMIN bypass: If the user's role rank is 100 (SUPERADMIN), access is
|
|
granted immediately without a database lookup.
|
|
|
|
Usage:
|
|
@router.get("/admin/sensitive-data")
|
|
async def get_sensitive_data(
|
|
current_user: User = Depends(get_current_user),
|
|
_ = Depends(RequirePermission("fleet:view")),
|
|
):
|
|
|
|
Args:
|
|
permission_code: The permission code to check (e.g., "fleet:view", "user:create")
|
|
|
|
Returns:
|
|
A dependency callable that returns the current_user if permission is granted,
|
|
or raises HTTPException(403) if denied.
|
|
"""
|
|
async def permission_checker(
|
|
current_user: User = Depends(get_current_active_user),
|
|
db: AsyncSession = Depends(get_db),
|
|
) -> User:
|
|
# ── SUPERADMIN bypass ──
|
|
# SUPERADMIN has rank 100 → bypass all permission checks
|
|
if current_user.role == UserRole.SUPERADMIN:
|
|
return current_user
|
|
|
|
# ── Resolve role_id ──
|
|
# Use the DB-driven role_id if available, otherwise fall back to
|
|
# the legacy UserRole enum for backward compatibility
|
|
role_id = getattr(current_user, 'role_id', None)
|
|
if role_id is None:
|
|
# Fallback: SUPERADMIN already handled above, so this is a non-admin
|
|
# user without a role_id assigned yet. Deny access.
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail=f"Missing permission: {permission_code}. No role_id assigned to user."
|
|
)
|
|
|
|
# ── Query permissions from DB ──
|
|
from app.services.rbac_service import rbac_service
|
|
user_permissions = await rbac_service.get_role_permissions(db, role_id)
|
|
|
|
# ── Check the specific permission ──
|
|
if permission_code not in user_permissions:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail=f"Missing permission: {permission_code}"
|
|
)
|
|
|
|
return current_user
|
|
|
|
return permission_checker
|