c3d31c06e2
- Auth/roles (no self-reg), admin user provision, JWT - Analyze: sales kit + initial pain-fit from form/upload - Persona generator: 15 personas (5/tier) w/ pain variety, negotiation, init mode, channel, latent/revealable, wrong_text special - Chat simulator: per-mode initiation, one-shot, hidden signals, judge-LLM debrief+coaching - Trainee loop: win/lose board, weak-areas, user-generated personas - Admin analytics; EN+TH Vue SPA served by Flask - Deploy: Dockerfile, docker-compose, README, eng-log + HANDOFF - Tests (mock LLM): m0/m1/routes/e2e all pass
74 lines
2.0 KiB
Python
74 lines
2.0 KiB
Python
"""JWT auth decorators + role guards + shared API helpers."""
|
|
from __future__ import annotations
|
|
|
|
import functools
|
|
from typing import Any, Callable
|
|
|
|
from flask import g, jsonify, request
|
|
|
|
from ..auth.users import AuthError
|
|
from ..config import Config
|
|
|
|
|
|
class ApiError(Exception):
|
|
def __init__(self, message: str, status: int = 400):
|
|
super().__init__(message)
|
|
self.message = message
|
|
self.status = status
|
|
|
|
|
|
def _get_store():
|
|
from flask import current_app
|
|
|
|
return current_app.extensions["user_store"]
|
|
|
|
|
|
def current_user() -> dict[str, Any]:
|
|
return g.user
|
|
|
|
|
|
def require_auth(fn: Callable) -> Callable:
|
|
@functools.wraps(fn)
|
|
def wrapper(*args, **kwargs):
|
|
header = request.headers.get("Authorization", "")
|
|
scheme, _, token = header.partition(" ")
|
|
if scheme.lower() != "bearer" or not token:
|
|
raise ApiError("authentication required", 401)
|
|
try:
|
|
payload = _get_store().decode_token(token)
|
|
except AuthError as exc:
|
|
raise ApiError(str(exc), 401)
|
|
user = _get_store().get_user_or_none(payload.get("sub", ""))
|
|
if not user or not user.get("active", True):
|
|
raise ApiError("account is inactive", 401)
|
|
g.user = user
|
|
g.token_payload = payload
|
|
return fn(*args, **kwargs)
|
|
|
|
return wrapper
|
|
|
|
|
|
def require_roles(*roles: str) -> Callable:
|
|
def deco(fn: Callable) -> Callable:
|
|
@functools.wraps(fn)
|
|
def wrapper(*args, **kwargs):
|
|
role = g.user.get("role")
|
|
# super_admin passes any role gate
|
|
allowed = {"super_admin", *roles}
|
|
if role not in allowed:
|
|
raise ApiError("permission denied", 403)
|
|
return fn(*args, **kwargs)
|
|
|
|
return wrapper
|
|
|
|
return deco
|
|
|
|
|
|
def api_error_handler(err: ApiError):
|
|
return jsonify({"error": err.message}), err.status
|
|
|
|
|
|
def register_error_handlers(app) -> None:
|
|
app.register_error_handler(ApiError, api_error_handler)
|
|
app.register_error_handler(ValueError, lambda e: (jsonify({"error": str(e)}), 400))
|