119 lines
3.3 KiB
Python
119 lines
3.3 KiB
Python
"""FastAPI dependencies for authentication, RBAC, and RLS context."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from enum import Enum
|
|
from typing import Annotated, AsyncIterator, Optional
|
|
|
|
import asyncpg
|
|
from fastapi import Cookie, Depends, HTTPException, status
|
|
|
|
from .auth_sessions import get_session
|
|
from .config import Settings, get_settings
|
|
from .db import acquire
|
|
|
|
|
|
class Role(str, Enum):
|
|
LEARNER = "learner"
|
|
TEACHER = "teacher"
|
|
ADMIN = "admin"
|
|
|
|
|
|
class AIView(str, Enum):
|
|
CLIENT = "client"
|
|
COUNSELOR = "counselor"
|
|
EVALUATOR = "evaluator"
|
|
|
|
|
|
class Principal:
|
|
"""Authenticated human principal."""
|
|
|
|
def __init__(
|
|
self,
|
|
user_id: str,
|
|
role: Role,
|
|
cohort_ids: Optional[list[str]] = None,
|
|
email: str = "",
|
|
display_name: str = "",
|
|
) -> None:
|
|
self.user_id = user_id
|
|
self.role = role
|
|
self.cohort_ids = cohort_ids or []
|
|
self.email = email
|
|
self.display_name = display_name
|
|
|
|
|
|
def get_settings_dep() -> Settings:
|
|
return get_settings()
|
|
|
|
|
|
async def get_current_principal(
|
|
session_cookie: Annotated[Optional[str], Cookie(alias="__Host-vignette_sid")] = None,
|
|
dev_session_cookie: Annotated[Optional[str], Cookie(alias="vignette_sid")] = None,
|
|
) -> Principal:
|
|
"""Restore the principal from the opaque HttpOnly browser session cookie."""
|
|
raw_cookie = session_cookie or (dev_session_cookie if get_settings().environment == "dev" else None)
|
|
session = await get_session(raw_cookie)
|
|
if session is None:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="not authenticated",
|
|
)
|
|
|
|
try:
|
|
role = Role(session.role)
|
|
except ValueError as exc:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="invalid session role",
|
|
) from exc
|
|
|
|
return Principal(
|
|
user_id=session.user_id,
|
|
role=role,
|
|
cohort_ids=session.cohort_ids,
|
|
email=session.email,
|
|
display_name=session.display_name,
|
|
)
|
|
|
|
|
|
def require_role(*allowed: Role):
|
|
"""Role allowlist dependency factory."""
|
|
|
|
async def _checker(
|
|
principal: Annotated[Principal, Depends(get_current_principal)],
|
|
) -> Principal:
|
|
if principal.role not in allowed:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail=f"role {principal.role.value} not permitted",
|
|
)
|
|
return principal
|
|
|
|
return _checker
|
|
|
|
|
|
async def db_for_human(
|
|
principal: Annotated[Principal, Depends(get_current_principal)],
|
|
) -> AsyncIterator[asyncpg.Connection]:
|
|
"""Acquire a DB connection with the human RBAC context attached."""
|
|
async with acquire(
|
|
role=principal.role.value,
|
|
user_id=principal.user_id,
|
|
cohort_ids=principal.cohort_ids,
|
|
) as conn:
|
|
yield conn
|
|
|
|
|
|
def db_for_ai_view(view: AIView):
|
|
"""Dependency factory for AI-side RLS visibility context."""
|
|
|
|
async def _provider() -> AsyncIterator[asyncpg.Connection]:
|
|
async with acquire(ai_view=view.value, ai_context=True) as conn:
|
|
yield conn
|
|
|
|
return _provider
|
|
|
|
|
|
CurrentPrincipal = Annotated[Principal, Depends(get_current_principal)]
|
|
HumanDB = Annotated[asyncpg.Connection, Depends(db_for_human)]
|