auth logic

Author: petrCher

auth_backend/admin/auth.py

@@ -2,25 +2,48 @@
 from sqladmin.authentication import AuthenticationBackend
 
 from auth_backend.settings import get_settings
-
+from auth_backend.utils.security import UnionAuth
+from auth_lib.methods import AuthLib
 
 settings = get_settings()
 
-
 class AdminAuth(AuthenticationBackend):
+
     async def login(self, request: Request) -> bool:
         form = await request.form()
         username = form.get("username")
-        password = form.get("password")
-        if username == settings.ADMIN_LOGIN and password == settings.ADMIN_PASSWORD:
-            request.session["user"] = username
+        token = form.get("password")
+        if username != settings.ADMIN_LOGIN:
+            return False
+        valid = await self._is_valid_token(token)
+        if valid:
+            request.session["token"] = token
             return True
-        return False
+        else:
+            return False
+
+    async def authenticate(self, request: Request) -> bool:
+        token = request.session.get("token")
+        if not token:
+            return False
+        return await self._is_valid_token(token)
 
     async def logout(self, request: Request) -> bool:
         request.session.clear()
         return True
 
-    async def authenticate(self, request: Request) -> bool:
-        user = request.session.get("user")
-        return user is not None
+    @staticmethod
+    async def _is_valid_token(token: str) -> bool:
+        try:
+            result = AuthLib(auth_url=settings.AUTH_URL).check_token(token)
+            if not result:
+                return False
+            session_scopes = {
+                scope["name"].lower() for scope in result.get("session_scopes", [])
+            }
+            required_scopes = "auth.sqladmin.admin"
+            if required_scopes not in session_scopes:
+                return False
+            return True
+        except Exception:
+            return False

auth_backend/settings.py

@@ -23,6 +23,7 @@ class Settings(BaseSettings):
     ADMIN_SECRET_KEY: str = "default"
     ADMIN_LOGIN: str = "admin"
     ADMIN_PASSWORD: str = "admin"
+    AUTH_URL: str = "https://api.test.profcomff.com/auth/"
 
     ROOT_PATH: str = '/' + os.getenv('APP_NAME', '')
 

requirements.txt

@@ -17,6 +17,7 @@ event-schema-profcomff
 aiocache
 python-multipart
 sqladmin[full]
+auth-lib-profcomff[fastapi]
 
 # Google Auth Method
 google-api-python-client