initial commit after split

src/govoplan_core/auth/dependencies.py

@@ -0,0 +1,223 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from fastapi import Depends, Header, HTTPException, Request, status
+from sqlalchemy.orm import Session
+
+from govoplan_core.db.models import Account, ApiKey, AuthSession, Tenant, User
+from govoplan_core.db.session import get_session
+from govoplan_core.security.module_permissions import scopes_grant_compatible
+from govoplan_core.access.auth.principals import Principal
+from govoplan_core.security.api_keys import authenticate_api_key
+from govoplan_core.security.permissions import intersect_api_key_scopes, scopes_grant
+from govoplan_core.security.sessions import authenticate_session_token, collect_user_groups, collect_user_scopes, verify_auth_session_csrf
+from govoplan_core.settings import settings
+
+
+@dataclass(slots=True)
+class ApiPrincipal:
+    """Compatibility wrapper around the platform Principal DTO.
+
+    Existing routers still expect ORM ``account`` and ``user`` objects. New
+    platform/module code should use the stable ID fields or
+    ``to_platform_principal()`` instead.
+    """
+
+    principal: Principal
+    account: Account
+    user: User
+    api_key: ApiKey | None = None
+    auth_session: AuthSession | None = None
+
+    @property
+    def account_id(self) -> str:
+        return self.principal.account_id
+
+    @property
+    def membership_id(self) -> str | None:
+        return self.principal.membership_id
+
+    @property
+    def tenant_id(self) -> str:
+        if self.principal.tenant_id is None:
+            raise RuntimeError("Tenant principal has no active tenant id.")
+        return self.principal.tenant_id
+
+    @property
+    def scopes(self) -> frozenset[str]:
+        return self.principal.scopes
+
+    @property
+    def group_ids(self) -> frozenset[str]:
+        return self.principal.group_ids
+
+    @property
+    def auth_method(self) -> str:
+        return self.principal.auth_method
+
+    @property
+    def api_key_id(self) -> str | None:
+        return self.principal.api_key_id
+
+    @property
+    def session_id(self) -> str | None:
+        return self.principal.session_id
+
+    @property
+    def email(self) -> str | None:
+        return self.principal.email
+
+    @property
+    def display_name(self) -> str | None:
+        return self.principal.display_name
+
+    def has(self, required_scope: str) -> bool:
+        # Keep legacy scope aliases alive while current routers still use the
+        # pre-platform permission catalogue.
+        return scopes_grant_compatible(self.scopes, required_scope)
+
+    def to_platform_principal(self) -> Principal:
+        return self.principal
+
+
+def _extract_token(request: Request, authorization: str | None, x_api_key: str | None) -> tuple[str | None, str]:
+    if x_api_key:
+        return x_api_key.strip(), "api_key"
+    if authorization and authorization.lower().startswith("bearer "):
+        return authorization[7:].strip(), "bearer"
+    cookie_token = request.cookies.get(settings.auth_session_cookie_name)
+    if cookie_token:
+        return cookie_token.strip(), "cookie"
+    return None, "none"
+
+
+def _requires_csrf(request: Request) -> bool:
+    return request.method.upper() not in {"GET", "HEAD", "OPTIONS", "TRACE"}
+
+
+def _principal_group_ids(session: Session, user: User) -> frozenset[str]:
+    return frozenset(group.id for group in collect_user_groups(session, user))
+
+
+def _build_api_principal(
+    session: Session,
+    *,
+    account: Account,
+    user: User,
+    tenant_id: str,
+    scopes: list[str],
+    auth_method: str,
+    api_key: ApiKey | None = None,
+    auth_session: AuthSession | None = None,
+) -> ApiPrincipal:
+    principal = Principal(
+        account_id=account.id,
+        membership_id=user.id,
+        tenant_id=tenant_id,
+        scopes=frozenset(scopes),
+        group_ids=_principal_group_ids(session, user),
+        auth_method=auth_method,  # type: ignore[arg-type]
+        api_key_id=api_key.id if api_key else None,
+        session_id=auth_session.id if auth_session else None,
+        email=account.email,
+        display_name=account.display_name or user.display_name,
+    )
+    return ApiPrincipal(
+        principal=principal,
+        account=account,
+        user=user,
+        api_key=api_key,
+        auth_session=auth_session,
+    )
+
+
+def get_api_principal(
+    request: Request,
+    session: Session = Depends(get_session),
+    authorization: str | None = Header(default=None),
+    x_api_key: str | None = Header(default=None, alias="X-API-Key"),
+) -> ApiPrincipal:
+    token, source = _extract_token(request, authorization, x_api_key)
+    if not token:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Missing API key or session token")
+
+    # API keys remain supported for CLI/automation. Their permissions are the
+    # intersection of the key grant and the owner's current tenant roles.
+    api_key = authenticate_api_key(session, token)
+    if api_key:
+        user = session.get(User, api_key.user_id)
+        account = session.get(Account, user.account_id) if user else None
+        tenant = session.get(Tenant, api_key.tenant_id)
+        if (
+            not user or not account or not tenant
+            or not user.is_active or not account.is_active or not tenant.is_active
+            or user.tenant_id != api_key.tenant_id
+        ):
+            raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Inactive or inconsistent API-key principal")
+        user_scopes = collect_user_scopes(session, user, include_system=False)
+        effective_scopes = intersect_api_key_scopes(user_scopes, api_key.scopes or [])
+        session.commit()
+        return _build_api_principal(
+            session,
+            api_key=api_key,
+            account=account,
+            user=user,
+            tenant_id=api_key.tenant_id,
+            scopes=effective_scopes,
+            auth_method="api_key",
+        )
+
+    auth_session = authenticate_session_token(session, token)
+    if auth_session:
+        user = session.get(User, auth_session.user_id)
+        account = session.get(Account, auth_session.account_id)
+        tenant = session.get(Tenant, auth_session.tenant_id)
+        if (
+            not user or not account or not tenant
+            or not user.is_active or not account.is_active or not tenant.is_active
+            or user.account_id != account.id
+            or user.tenant_id != tenant.id
+        ):
+            raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Inactive or inconsistent session principal")
+        if source == "cookie" and _requires_csrf(request):
+            header_token = request.headers.get("x-csrf-token")
+            cookie_token = request.cookies.get(settings.auth_csrf_cookie_name)
+            if not header_token or not cookie_token or header_token != cookie_token or not verify_auth_session_csrf(auth_session, header_token):
+                raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Invalid or missing CSRF token")
+        scopes = collect_user_scopes(session, user, include_system=True)
+        session.commit()
+        return _build_api_principal(
+            session,
+            auth_session=auth_session,
+            account=account,
+            user=user,
+            tenant_id=user.tenant_id,
+            scopes=scopes,
+            auth_method="session",
+        )
+
+    raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid API key or session token")
+
+
+def has_scope(principal: ApiPrincipal, required_scope: str) -> bool:
+    return principal.has(required_scope)
+
+
+def require_scope(required_scope: str):
+    def dependency(principal: ApiPrincipal = Depends(get_api_principal)) -> ApiPrincipal:
+        if not has_scope(principal, required_scope):
+            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=f"Missing scope: {required_scope}")
+        return principal
+
+    return dependency
+
+
+def require_any_scope(*required_scopes: str):
+    def dependency(principal: ApiPrincipal = Depends(get_api_principal)) -> ApiPrincipal:
+        if not any(has_scope(principal, required) for required in required_scopes):
+            joined = ", ".join(required_scopes)
+            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=f"Requires one of: {joined}")
+        return principal
+
+    return dependency