54 lines
1.6 KiB
Python
54 lines
1.6 KiB
Python
"""Session-cookie dependencies. Handlers stay thin; DB via get_session."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from collections.abc import Iterator
|
|
from typing import Annotated
|
|
|
|
from fastapi import Depends, HTTPException, Request
|
|
from sqlmodel import Session
|
|
|
|
from app.db import get_session
|
|
from app.models import User
|
|
|
|
from . import service
|
|
|
|
SESSION_COOKIE = "kirche_session"
|
|
SESSION_MAX_AGE = int(service.SESSION_TTL.total_seconds())
|
|
|
|
|
|
def get_db() -> Iterator[Session]:
|
|
yield from get_session()
|
|
|
|
|
|
def get_optional_user(
|
|
request: Request, session: Annotated[Session, Depends(get_db)]
|
|
) -> User | None:
|
|
session_id = request.cookies.get(SESSION_COOKIE)
|
|
if not session_id:
|
|
return None
|
|
record = service.get_valid_session(session, session_id)
|
|
if record is None:
|
|
return None
|
|
return service.get_user(session, record.user_id)
|
|
|
|
|
|
def get_current_user(request: Request, session: Annotated[Session, Depends(get_db)]) -> User:
|
|
user = get_optional_user(request, session)
|
|
if user is None:
|
|
raise HTTPException(status_code=401, detail="not authenticated")
|
|
return user
|
|
|
|
|
|
def require_admin(user: Annotated[User, Depends(get_current_user)]) -> User:
|
|
if user.role != "admin":
|
|
raise HTTPException(status_code=403, detail="admin only")
|
|
return user
|
|
|
|
|
|
def resolve_tenant(user: User | None, explicit: str | None, default: str = "default") -> str:
|
|
"""Tenant comes from the session; the body/query param is a deprecated
|
|
fallback for unauthenticated callers."""
|
|
if user is not None:
|
|
return user.tenant_id
|
|
return explicit or default
|