056753e8cb
Phase 1 (tenant isolation):
- g.org_id set on require_auth; assert_tenant()/current_org_id() choke-point helpers.
- Multi-org provisioning: POST /api/admin/users {new_org:true} (super_admin) creates a
new org + its first admin; GET /api/admin/orgs (super_admin sees all, admin own).
- Fixed latent create_org double-id bug (dict id != store key).
- test_saas_tenant.py: org2 admin blocked from org1 group (403), can't list org1
groups/users, sees only own org; super_admin sees all.
Phase 2 (hardening):
- Rate limit login (per-IP + per-username) + chat send (per-user) to protect LLM cost
and slow brute force; services/rate_limit.py (in-memory + disk, no external deps).
- Audit log data/audit/audit.jsonl on org.create, user.promote_super_admin, analytics.export.
- CSV export now org-scoped (admin exports only own org).
All 8 backend suites pass.
91 lines
2.7 KiB
Python
91 lines
2.7 KiB
Python
"""JWT auth decorators + role guards + shared API helpers."""
|
|
from __future__ import annotations
|
|
|
|
import functools
|
|
from typing import Any, Callable
|
|
|
|
from flask import g, jsonify, request
|
|
|
|
from ..auth.users import AuthError
|
|
from ..config import Config
|
|
|
|
|
|
class ApiError(Exception):
|
|
def __init__(self, message: str, status: int = 400):
|
|
super().__init__(message)
|
|
self.message = message
|
|
self.status = status
|
|
|
|
|
|
def _get_store():
|
|
from flask import current_app
|
|
|
|
return current_app.extensions["user_store"]
|
|
|
|
|
|
def current_user() -> dict[str, Any]:
|
|
return g.user
|
|
|
|
|
|
def current_org_id() -> str:
|
|
return getattr(g, "org_id", None) or (g.user or {}).get("org_id") or "org-default"
|
|
|
|
|
|
def assert_tenant(org_id: str | None) -> None:
|
|
"""Raise 403 if the object's org does not belong to the actor's tenant.
|
|
|
|
super_admin is the platform operator and is exempt (can see all orgs)."""
|
|
if (g.user or {}).get("role") == "super_admin":
|
|
return
|
|
if (org_id or "org-default") != current_org_id():
|
|
raise ApiError("permission denied", 403)
|
|
|
|
|
|
def require_auth(fn: Callable) -> Callable:
|
|
@functools.wraps(fn)
|
|
def wrapper(*args, **kwargs):
|
|
header = request.headers.get("Authorization", "")
|
|
scheme, _, token = header.partition(" ")
|
|
if scheme.lower() != "bearer" or not token:
|
|
raise ApiError("authentication required", 401)
|
|
try:
|
|
payload = _get_store().decode_token(token)
|
|
except AuthError as exc:
|
|
raise ApiError(str(exc), 401)
|
|
user = _get_store().get_user_or_none(payload.get("sub", ""))
|
|
if not user or not user.get("active", True):
|
|
raise ApiError("account is inactive", 401)
|
|
g.user = user
|
|
g.token_payload = payload
|
|
# Tenant context: every request carries the actor's org id so downstream guards
|
|
# can enforce per-org isolation without re-reading the user each time.
|
|
g.org_id = (user or {}).get("org_id") or "org-default"
|
|
return fn(*args, **kwargs)
|
|
|
|
return wrapper
|
|
|
|
|
|
def require_roles(*roles: str) -> Callable:
|
|
def deco(fn: Callable) -> Callable:
|
|
@functools.wraps(fn)
|
|
def wrapper(*args, **kwargs):
|
|
role = g.user.get("role")
|
|
# super_admin passes any role gate
|
|
allowed = {"super_admin", *roles}
|
|
if role not in allowed:
|
|
raise ApiError("permission denied", 403)
|
|
return fn(*args, **kwargs)
|
|
|
|
return wrapper
|
|
|
|
return deco
|
|
|
|
|
|
def api_error_handler(err: ApiError):
|
|
return jsonify({"error": err.message}), err.status
|
|
|
|
|
|
def register_error_handlers(app) -> None:
|
|
app.register_error_handler(ApiError, api_error_handler)
|
|
app.register_error_handler(ValueError, lambda e: (jsonify({"error": str(e)}), 400))
|