feat: validation locale du jeton draco_session — repli SSO dans get_current_user (#217)

backend/auth/middleware.py

@@ -9,6 +9,7 @@ import sys
 from fastapi import Depends, HTTPException, Request
 from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
 
+from backend import draco_session
 from backend.services.net import get_client_ip
 
 from .jwt_handler import decode_token, is_token_revoked, maybe_touch_api_token
@@ -86,20 +87,22 @@ def get_current_user(
         token = request.cookies["access_token"]
 
     if not token:
-        return None
+        return _draco_fallback(request)
 
     payload = decode_token(token)
     if not payload or payload.get("type") != "access":
-        return None
+        return _draco_fallback(request)
 
     # BUG-027: access tokens revoked at logout must be rejected immediately.
+    # (Le repli draco reste sûr : la déconnexion globale révoque aussi
+    # le jti draco et efface son cookie.)
     jti = payload.get("jti")
     if jti and is_token_revoked(jti):
-        return None
+        return _draco_fallback(request)
 
     user = get_user(payload["sub"])
     if not user or not user.get("active"):
-        return None
+        return _draco_fallback(request)
 
     # BUG-028: a password change invalidates every token issued before it.
     pca = user.get("password_changed_at")
@@ -107,9 +110,9 @@ def get_current_user(
     if pca is not None and iat is not None:
         try:
             if int(iat) < int(float(pca)):
-                return None
+                return _draco_fallback(request)
         except (TypeError, ValueError):
-            return None
+            return _draco_fallback(request)
 
     # Attach vault permissions from the token (snapshot at login time)
     user["_token_vaults"] = payload.get("vaults", [])
@@ -127,6 +130,17 @@ def get_current_user(
     return user
 
 
+def _draco_fallback(request: Request) -> dict | None:
+    """Fusion ACC-3.2 (#9) : à défaut de jeton natif valide, le cookie
+    partagé draco_session authentifie l'utilisateur (sub = id
+    ObsiGate, correspondance directe — voir draco_session.user_for_draco).
+    """
+    user = draco_session.user_for_draco(request)
+    if user is not None:
+        user["_request_ip"] = get_client_ip(request)
+    return user
+
+
 def require_auth(current_user=Depends(get_current_user)):
     """Dependency: require a valid authenticated user."""
     if not current_user: