ske087
73 lines
2.3 KiB
Python
73 lines
2.3 KiB
Python
from flask import Blueprint, request, make_response, current_app
|
|
import jwt
|
|
|
|
bp = Blueprint('api', __name__, url_prefix='/api')
|
|
|
|
|
|
@bp.route('/verify-token')
|
|
def verify_token():
|
|
"""
|
|
Called internally by nginx auth_request.
|
|
Reads the platform JWT cookie, verifies it, and returns 200 with user
|
|
identity headers on success, or 401/403 on failure.
|
|
"""
|
|
token = request.cookies.get(current_app.config['PORTAL_COOKIE_NAME'])
|
|
if not token:
|
|
return '', 401
|
|
|
|
try:
|
|
payload = jwt.decode(
|
|
token,
|
|
current_app.config['PORTAL_JWT_SECRET'],
|
|
algorithms=['HS256'],
|
|
options={'require': ['exp', 'sub', 'user_id']},
|
|
)
|
|
except jwt.ExpiredSignatureError:
|
|
return '', 401
|
|
except jwt.InvalidTokenError:
|
|
return '', 401
|
|
|
|
# Per-app access check based on the original request URI
|
|
original_uri = request.headers.get('X-Original-URI', '')
|
|
required_app = _app_from_uri(original_uri)
|
|
user_id = payload.get('user_id')
|
|
portal_role = payload.get('role', 'user')
|
|
|
|
if required_app:
|
|
user_apps = payload.get('apps', [])
|
|
if required_app not in user_apps:
|
|
return '', 403
|
|
|
|
# Resolve the effective role for this specific app.
|
|
# If the admin has set a per-app role override in AppAccess, use that;
|
|
# otherwise fall back to the portal-level role from the JWT.
|
|
effective_role = portal_role
|
|
if required_app and user_id:
|
|
try:
|
|
from app.models.app_access import AppAccess
|
|
access = AppAccess.query.filter_by(
|
|
user_id=user_id, app_name=required_app, is_active=True
|
|
).first()
|
|
if access and access.app_role:
|
|
effective_role = access.app_role
|
|
except Exception:
|
|
pass # fall back to portal role
|
|
|
|
resp = make_response('', 200)
|
|
resp.headers['X-Auth-User-Id'] = str(user_id or '')
|
|
resp.headers['X-Auth-Username'] = payload.get('sub', '')
|
|
resp.headers['X-Auth-Role'] = effective_role
|
|
return resp
|
|
|
|
|
|
def _app_from_uri(uri):
|
|
if uri.startswith('/digiserver/'):
|
|
return 'digiserver'
|
|
if uri.startswith('/itassets/'):
|
|
return 'itassets'
|
|
if uri.startswith('/networkview/'):
|
|
return 'networkview'
|
|
if uri.startswith('/srvmonitor/'):
|
|
return 'srvmonitor'
|
|
return None
|