bruno
1d1cdbd618
- Panneau peek: les bindings Alpine (x-data absent du conteneur) rendaient loovverture et le redimensionnement inoperants -> cblage direct sur le document. - Helper unique window.fdWirePeekResize (app.js): pointer capture, 300px-90vw, clic=fermer, largeur persiste fd_peek_width partagee entre les 4 peeks. - database-table-container margin:0 (tableau colle a gauche, marge Library). - .lib-container remonte dans app.css (trash etait pleine largeur), .db-index 1100px. - ObsiGate verifie sans code: creation .xlsx OK (openpyxl, #186).
572 lines
28 KiB
Python
572 lines
28 KiB
Python
"""FlowDeck — Auth routes: login, callback, logout."""
|
|
from __future__ import annotations
|
|
|
|
import logging
|
|
import secrets
|
|
|
|
from fastapi import APIRouter, Body, Query, Request
|
|
from fastapi.responses import HTMLResponse, RedirectResponse
|
|
|
|
from app.auth.session import SessionManager
|
|
from app.config import settings
|
|
from app.templating import CSP_NONCE
|
|
|
|
logger = logging.getLogger(__name__)
|
|
router = APIRouter(tags=["auth"], prefix="/auth")
|
|
|
|
|
|
def get_redirect_uri(request: Request) -> str:
|
|
"""OAuth redirect URI for this request.
|
|
|
|
Explicit `OAUTH_REDIRECT_URI` env override wins (must be registered in the
|
|
provider's OAuth app). Otherwise it is derived from the request so it always
|
|
matches the URL the user actually used: scheme from `X-Forwarded-Proto`
|
|
(reverse proxies) falling back to the request scheme, host from
|
|
`X-Forwarded-Host` falling back to the `Host` header.
|
|
"""
|
|
if settings.oauth_redirect_uri:
|
|
return settings.oauth_redirect_uri
|
|
proto = request.headers.get("x-forwarded-proto", "")
|
|
scheme = proto.split(",")[0].strip() or request.url.scheme or "http"
|
|
fwd_host = request.headers.get("x-forwarded-host", "")
|
|
host = fwd_host.split(",")[0].strip() or request.headers.get("host", "localhost:8080")
|
|
return f"{scheme}://{host}/auth/callback"
|
|
|
|
def _with_nonce(html: str) -> str:
|
|
"""A20 : injecte le nonce CSP au moment du rendu.
|
|
|
|
`LOCAL_LOGIN_HTML` est une constante de module — le nonce, lui, est par
|
|
requête, donc il ne peut être figé qu'ici.
|
|
"""
|
|
return html.replace("<script>", f'<script nonce="{CSP_NONCE.get()}">', 1)
|
|
|
|
|
|
LOCAL_LOGIN_HTML = """<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>FlowDeck — Login</title>
|
|
<style>
|
|
*{margin:0;padding:0;box-sizing:border-box;}
|
|
body{background:#191919;color:#fff;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;}
|
|
.login-box{background:#222;border:1px solid rgba(255,255,255,.08);border-radius:12px;padding:40px;width:100%;max-width:400px;}
|
|
.login-box h1{font-size:24px;margin-bottom:8px;}
|
|
.login-box p{color:rgba(255,255,255,.5);font-size:14px;margin-bottom:24px;}
|
|
.form-group{margin-bottom:16px;}
|
|
.form-group label{display:block;font-size:13px;color:rgba(255,255,255,.6);margin-bottom:6px;}
|
|
.form-group input{width:100%;padding:10px 36px 10px 12px;background:#2A2A2A;border:1px solid rgba(255,255,255,.1);border-radius:8px;color:#fff;font-size:14px;outline:none;}
|
|
.pw-wrapper{position:relative;}
|
|
.pw-toggle{position:absolute;right:8px;top:50%;transform:translateY(-50%);background:none;border:none;color:rgba(255,255,255,.4);cursor:pointer;font-size:16px;padding:4px;line-height:1;}
|
|
.pw-toggle:hover{color:rgba(255,255,255,.8);}
|
|
.form-group input:focus{border-color:#2383E2;box-shadow:0 0 0 1px #2383E2;}
|
|
.btn{width:100%;padding:12px;border:none;border-radius:8px;font-size:14px;font-weight:500;cursor:pointer;margin-top:8px;}
|
|
.btn-primary{background:#2383E2;color:#fff;}
|
|
.btn-primary:hover{background:#2C8CEB;}
|
|
.btn-secondary{background:#333;color:#fff;margin-top:12px;}
|
|
.btn-secondary:hover{background:#444;}
|
|
.tabs{display:flex;gap:0;margin-bottom:24px;border-bottom:1px solid rgba(255,255,255,.08);}
|
|
.tab{flex:1;text-align:center;padding:12px;cursor:pointer;font-size:14px;color:rgba(255,255,255,.5);border-bottom:2px solid transparent;background:none;border-top:none;border-left:none;border-right:none;}
|
|
.tab.active{color:#fff;border-bottom-color:#2383E2;}
|
|
.error{background:rgba(255,80,80,.15);color:#ff5050;padding:10px;border-radius:8px;font-size:13px;margin-bottom:12px;display:none;}
|
|
.success{background:rgba(80,255,80,.15);color:#50ff50;padding:10px;border-radius:8px;font-size:13px;margin-bottom:12px;display:none;}
|
|
.oauth-section{margin-top:20px;border-top:1px solid rgba(255,255,255,.08);padding-top:20px;}
|
|
.oauth-btn{display:flex;align-items:center;justify-content:center;gap:8px;width:100%;padding:10px;border-radius:8px;font-size:14px;cursor:pointer;border:1px solid rgba(255,255,255,.12);background:#2A2A2A;color:#fff;}
|
|
.oauth-btn:hover{background:#333;}
|
|
.sso-btn{border-color:rgba(35,131,226,.5);}
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<div class="login-box">
|
|
<h1>FlowDeck</h1>
|
|
<p>Login or create an account to continue</p>
|
|
<div class="tabs">
|
|
<button class="tab active" onclick="switchTab('login')" id="tab-login">Login</button>
|
|
<button class="tab" onclick="switchTab('register')" id="tab-register">Register</button>
|
|
</div>
|
|
<div id="expired-msg" class="success" style="display:none">⚠️ Your session has expired. Please log in again.</div>
|
|
<div id="error-msg" class="error"></div>
|
|
<div id="success-msg" class="success"></div>
|
|
<form id="login-form" onsubmit="handleLogin(event)">
|
|
<div class="form-group"><label>Email or username</label><input type="text" id="email" required autocomplete="username"></div>
|
|
<div class="form-group">
|
|
<label>Password</label>
|
|
<div class="pw-wrapper">
|
|
<input type="password" id="password" required minlength="6" autocomplete="current-password">
|
|
<button type="button" class="pw-toggle" onclick="togglePassword()" title="Show password">👁</button>
|
|
</div>
|
|
</div>
|
|
<div class="form-group" id="name-group" style="display:none"><label>Name</label><input type="text" id="name"></div>
|
|
<button type="submit" class="btn btn-primary" id="submit-btn">Login</button>
|
|
</form>
|
|
<div class="oauth-section" id="oauth-section">
|
|
<p style="font-size:13px;color:rgba(255,255,255,.4);margin-bottom:8px;">Or continue with</p>
|
|
<button class="oauth-btn" onclick="window.location='/auth/login?provider=gitea'" style="margin-bottom:8px">🔗 <span id="gitea-btn-label">Login</span> with Gitea</button>
|
|
<button class="oauth-btn" onclick="window.location='/auth/login?provider=github'">🐙 <span id="github-btn-label">Login</span> with GitHub</button>
|
|
</div>
|
|
<!-- SSO / SAML + OIDC (v6.7.0) — buttons injected by loadSsoProviders() -->
|
|
<div class="oauth-section" id="sso-section" style="display:none">
|
|
<p id="sso-divider" style="font-size:13px;color:rgba(255,255,255,.4);margin-bottom:8px;">Or continue with</p>
|
|
<div id="sso-buttons"></div>
|
|
<p id="sso-only-note" style="display:none;font-size:12px;color:rgba(255,255,255,.45);margin-top:12px;line-height:1.5;">This instance only accepts your organization account — local login is disabled.</p>
|
|
</div>
|
|
</div>
|
|
<script>
|
|
// Show session expired banner if ?expired=1 in URL
|
|
(function(){if(location.search.includes('expired=1')){var el=document.getElementById('expired-msg');if(el)el.style.display='block';}})();
|
|
let mode='login';
|
|
function switchTab(t){mode=t;document.querySelectorAll('.tab').forEach(el=>el.classList.remove('active'));document.getElementById('tab-'+t).classList.add('active');document.getElementById('name-group').style.display=t==='register'?'block':'none';document.getElementById('submit-btn').textContent=t==='register'?'Register':'Login';document.getElementById('error-msg').style.display='none';document.getElementById('success-msg').style.display='none';var lbl=t==='register'?'Register':'Login';var e1=document.getElementById('gitea-btn-label');var e2=document.getElementById('github-btn-label');if(e1)e1.textContent=lbl;if(e2)e2.textContent=lbl;}
|
|
function togglePassword(){var pw=document.getElementById('password');var btn=pw.parentElement.querySelector('.pw-toggle');if(pw.type==='password'){pw.type='text';btn.textContent='🙈';}else{pw.type='password';btn.textContent='👁';}}
|
|
async function handleLogin(e){e.preventDefault();const email=document.getElementById('email').value;const password=document.getElementById('password').value;const name=document.getElementById('name').value;const url=mode==='register'?'/auth/register':'/auth/local-login';const body={email,password};if(mode==='register')body.name=name;try{const r=await fetch(url,{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify(body)});const d=await r.json();if(!r.ok){document.getElementById('error-msg').textContent=d.error||'Error';document.getElementById('error-msg').style.display='block';return;}if(d.status==='ok'){window.location='/workspaces';}}catch(err){document.getElementById('error-msg').textContent='Network error';document.getElementById('error-msg').style.display='block';}}
|
|
// SSO buttons (v6.7.0) — rendered from /api/v2/sso/providers
|
|
(async function loadSsoProviders(){
|
|
try{
|
|
const r = await fetch('/api/v2/sso/providers');
|
|
if(!r.ok) return;
|
|
const d = await r.json();
|
|
const providers = d.providers || [];
|
|
if(!providers.length) return;
|
|
const wrap = document.getElementById('sso-buttons');
|
|
providers.forEach(function(p){
|
|
const b = document.createElement('button');
|
|
b.className = 'oauth-btn sso-btn';
|
|
b.style.marginBottom = '8px';
|
|
b.title = 'Sign in with ' + (p.name || 'SSO');
|
|
b.onclick = function(){ window.location = p.login_url; };
|
|
const icon = document.createElement('span'); icon.textContent = p.icon || '🏢';
|
|
const label = document.createElement('span');
|
|
label.textContent = (mode === 'register' ? 'Sign up' : 'Login') + ' with ' + (p.name || 'SSO');
|
|
b.appendChild(icon); b.appendChild(label);
|
|
wrap.appendChild(b);
|
|
});
|
|
document.getElementById('sso-section').style.display = 'block';
|
|
if(d.sso_only){
|
|
// Local auth is refused server-side too — don't show a dead form.
|
|
const form = document.getElementById('login-form'); if(form) form.style.display = 'none';
|
|
const tabs = document.querySelector('.tabs'); if(tabs) tabs.style.display = 'none';
|
|
const oauth = document.getElementById('oauth-section'); if(oauth) oauth.style.display = 'none';
|
|
const note = document.getElementById('sso-only-note'); if(note) note.style.display = 'block';
|
|
const intro = document.querySelector('.login-box p'); if(intro) intro.textContent = 'Sign in with your organization account to continue';
|
|
}
|
|
}catch(e){}
|
|
})();
|
|
</script>
|
|
</body>
|
|
</html>"""
|
|
|
|
|
|
@router.get("/register")
|
|
def register_page(request: Request):
|
|
"""Show the registration page (local login page with register tab active)."""
|
|
return HTMLResponse(_with_nonce(LOCAL_LOGIN_HTML.replace(
|
|
'class="tab active" onclick="switchTab(\'login\')"',
|
|
'class="tab" onclick="switchTab(\'login\')"'
|
|
).replace(
|
|
'class="tab" onclick="switchTab(\'register\')"',
|
|
'class="tab active" onclick="switchTab(\'register\')"'
|
|
).replace(
|
|
'let mode=\'login\';',
|
|
'let mode=\'register\';'
|
|
).replace(
|
|
'id="name-group" style="display:none"',
|
|
'id="name-group" style="display:block"'
|
|
).replace(
|
|
'id="submit-btn">Login<',
|
|
'id="submit-btn">Register<'
|
|
)), status_code=200)
|
|
|
|
|
|
@router.get("/login")
|
|
def login(request: Request, provider: str = Query("gitea")):
|
|
"""Redirect to OAuth2 authorize page or show local login page."""
|
|
# Local login page (POST handled by /auth/local-login)
|
|
from fastapi.responses import HTMLResponse
|
|
if provider == "local":
|
|
return HTMLResponse(_with_nonce(LOCAL_LOGIN_HTML), status_code=200)
|
|
|
|
# OAuth flow — check if provider is configured
|
|
from app.auth.providers import get_provider
|
|
oauth_provider = get_provider(provider)
|
|
if not oauth_provider:
|
|
# OAuth provider not configured — show error instead of auto-creating admin
|
|
return HTMLResponse(
|
|
f"""<!DOCTYPE html><html><head><title>FlowDeck</title><style>
|
|
body{{background:#191919;color:#fff;font-family:sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;text-align:center;}}
|
|
.box{{background:#222;border:1px solid rgba(255,255,255,.08);border-radius:12px;padding:40px;max-width:420px;}}
|
|
h1{{font-size:20px;margin-bottom:12px;}}p{{color:rgba(255,255,255,.5);font-size:14px;margin-bottom:16px;}}
|
|
a{{color:#2383E2;}}
|
|
</style></head><body><div class="box">
|
|
<h1>⚠️ {provider.title()} OAuth not configured</h1>
|
|
<p>The {provider} integration has not been set up by the server administrator.</p>
|
|
<p><a href="/auth/login?provider=local">↩ Use local login</a></p>
|
|
</div></body></html>""",
|
|
status_code=200,
|
|
)
|
|
|
|
state = secrets.token_hex(32)
|
|
request.session["oauth_state"] = state
|
|
request.session["oauth_provider"] = provider
|
|
# Link mode: connect OAuth to current local account instead of creating new user
|
|
mode = request.query_params.get("mode", "")
|
|
# Encode auth mode in state to survive session loss during OAuth redirect
|
|
signed_state = f"{state}:{mode}" if mode else state
|
|
request.session["oauth_mode"] = mode
|
|
# Redirect URI derived from the incoming request (scheme-aware); stored in
|
|
# session so the callback reuses the EXACT same URI for token exchange
|
|
redirect_uri = get_redirect_uri(request)
|
|
request.session["oauth_redirect_uri"] = redirect_uri
|
|
auth_url = oauth_provider.get_authorize_url(signed_state, redirect_uri=redirect_uri, force_login=(mode == "link"))
|
|
return RedirectResponse(url=auth_url, status_code=302)
|
|
|
|
|
|
@router.post("/register")
|
|
def register(request: Request, body: dict = Body(default={})):
|
|
"""Register a new local account."""
|
|
|
|
from app.db import get_conn
|
|
from app.password_utils import hash_password
|
|
email = body.get("email", "").strip()
|
|
password = body.get("password", "").strip()
|
|
name = body.get("name", email.split("@")[0] if "@" in email else email)
|
|
|
|
if not email or not password:
|
|
from fastapi.responses import JSONResponse
|
|
return JSONResponse({"error": "Email and password required"}, status_code=400)
|
|
if len(password) < 6:
|
|
from fastapi.responses import JSONResponse
|
|
return JSONResponse({"error": "Password must be at least 6 characters"}, status_code=400)
|
|
|
|
# SSO-only instance (v6.7.0): local registration is refused — accounts are
|
|
# auto-provisioned by the IdP instead (admins still come from Settings).
|
|
from app.services.sso_provisioning import is_sso_only
|
|
if is_sso_only():
|
|
from fastapi.responses import JSONResponse
|
|
return JSONResponse(
|
|
{"error": "Registration is disabled — sign in with your organization SSO"},
|
|
status_code=403,
|
|
)
|
|
|
|
with get_conn() as conn:
|
|
existing = conn.execute("SELECT id FROM users WHERE login=?", (email,)).fetchone()
|
|
if existing:
|
|
from fastapi.responses import JSONResponse
|
|
return JSONResponse({"error": "Account already exists"}, status_code=409)
|
|
# First real user (excluding default admin with no password) is admin
|
|
real_user_count = conn.execute(
|
|
"SELECT COUNT(*) FROM users WHERE password_hash IS NOT NULL AND password_hash != ''"
|
|
).fetchone()[0]
|
|
is_admin = 1 if real_user_count == 0 else 0
|
|
conn.execute(
|
|
"INSERT INTO users (login, full_name, email, password_hash, is_admin) VALUES (?, ?, ?, ?, ?)",
|
|
(email, name, email, hash_password(password), is_admin),
|
|
)
|
|
conn.commit()
|
|
user = conn.execute("SELECT * FROM users WHERE login=?", (email,)).fetchone()
|
|
user_data = dict(user)
|
|
# Log login
|
|
_log_login(user_data["id"], request)
|
|
session = SessionManager.create_session(user_data, request)
|
|
from fastapi.responses import JSONResponse
|
|
response = JSONResponse({"status": "ok", "user": {"login": email, "name": name}})
|
|
response.set_cookie("flowdeck_session", session, httponly=True, max_age=86400 * 7, samesite="lax", path="/")
|
|
return response
|
|
|
|
|
|
@router.post("/local-login")
|
|
def local_login(request: Request, body: dict = Body(default={})):
|
|
"""Login with email + password."""
|
|
import time
|
|
|
|
from fastapi.responses import JSONResponse
|
|
|
|
from app.db import get_conn
|
|
from app.password_utils import is_locked, verify_password
|
|
email = body.get("email", "").strip()
|
|
password = body.get("password", "").strip()
|
|
|
|
if not email or not password:
|
|
return JSONResponse({"error": "Email and password required"}, status_code=400)
|
|
|
|
with get_conn() as conn:
|
|
user = conn.execute("SELECT * FROM users WHERE login=?", (email,)).fetchone()
|
|
if not user:
|
|
return JSONResponse({"error": "Invalid credentials"}, status_code=401)
|
|
|
|
ud = dict(user)
|
|
if not ud.get("is_active"):
|
|
return JSONResponse({"error": "Account disabled"}, status_code=403)
|
|
if is_locked(ud.get("locked_until")):
|
|
return JSONResponse({"error": "Account temporarily locked. Try again later."}, status_code=423)
|
|
|
|
if not verify_password(password, ud.get("password_hash", "")):
|
|
with get_conn() as conn:
|
|
attempts = (ud.get("login_attempts", 0) or 0) + 1
|
|
lock = None
|
|
if attempts >= 5:
|
|
lock = str(time.time() + 900) # 15 min lock
|
|
conn.execute(
|
|
"UPDATE users SET login_attempts=?, locked_until=? WHERE id=?",
|
|
(attempts, lock, ud["id"]),
|
|
)
|
|
conn.commit()
|
|
return JSONResponse({"error": "Invalid credentials"}, status_code=401)
|
|
|
|
# Successful local login — SSO-only instances keep a way in for admins
|
|
# only (every other account must use the IdP, design §7.1).
|
|
from app.services.sso_provisioning import is_sso_only
|
|
if is_sso_only() and not ud.get("is_admin"):
|
|
return JSONResponse(
|
|
{"error": "Local login is disabled on this instance — sign in with SSO"},
|
|
status_code=403,
|
|
)
|
|
|
|
# v7.2.0: verified domain with SSO enforcement (admins keep local access).
|
|
if not ud.get("is_admin"):
|
|
with get_conn() as conn:
|
|
dom = (ud.get("email") or "").split("@")[-1].lower() if "@" in (ud.get("email") or "") else ""
|
|
if dom:
|
|
enforced = conn.execute(
|
|
"SELECT id FROM domain_claims WHERE domain=? AND verified=1"
|
|
" AND enforce_sso=1", (dom,)).fetchone()
|
|
if enforced:
|
|
return JSONResponse(
|
|
{"error": "Local login is disabled for your domain — sign in with SSO"},
|
|
status_code=403)
|
|
|
|
with get_conn() as conn:
|
|
conn.execute(
|
|
"UPDATE users SET login_attempts=0, locked_until=NULL, last_login=? WHERE id=?",
|
|
(str(time.time()), ud["id"]),
|
|
)
|
|
conn.commit()
|
|
|
|
# v7.2.0: TOTP 2FA — password OK, but hold the session until code check.
|
|
from app.services import two_factor as _2fa
|
|
if _2fa.is_enabled(ud["id"]):
|
|
return JSONResponse({"status": "2fa_required",
|
|
"pending": _2fa.mint_pending(ud["id"])})
|
|
|
|
session = SessionManager.create_session(ud, request)
|
|
_log_login(ud["id"], request)
|
|
response = JSONResponse({"status": "ok", "user": {"login": ud["login"], "name": ud["full_name"]}})
|
|
response.set_cookie("flowdeck_session", session, httponly=True, max_age=86400 * 7, samesite="lax", path="/")
|
|
return response
|
|
|
|
|
|
@router.get("/callback")
|
|
async def callback(
|
|
request: Request,
|
|
code: str = Query(...),
|
|
state: str = Query(...),
|
|
):
|
|
"""Handle OAuth2 callback from Gitea."""
|
|
# Recover mode from state suffix (state:mode format), then validate
|
|
expected_state = request.session.get("oauth_state", "")
|
|
provider_name = request.session.get("oauth_provider", "gitea")
|
|
|
|
auth_mode = ""
|
|
raw_state = state
|
|
if ":" in state:
|
|
raw_state, auth_mode = state.rsplit(":", 1)
|
|
if auth_mode:
|
|
request.session["oauth_mode"] = auth_mode
|
|
|
|
# Validate: state token must match session, unless session lost and mode present
|
|
if expected_state and raw_state != expected_state:
|
|
return HTMLResponse("<h1>Invalid state</h1>", status_code=400)
|
|
if not expected_state and not auth_mode:
|
|
return HTMLResponse("<h1>Session expired — please try connecting again</h1>", status_code=400)
|
|
|
|
from app.auth.providers import get_provider
|
|
oauth_provider = get_provider(provider_name)
|
|
if not oauth_provider:
|
|
return HTMLResponse(f"<h1>Unknown provider: {provider_name}</h1>", status_code=400)
|
|
|
|
# Exchange code for token — reuse the redirect URI from the authorize step
|
|
# (stored in session), falling back to deriving it from this request
|
|
redirect_uri = request.session.get("oauth_redirect_uri") or get_redirect_uri(request)
|
|
token_data = await oauth_provider.exchange_code(code, redirect_uri=redirect_uri)
|
|
if not token_data:
|
|
return HTMLResponse("<h1>Token exchange failed</h1>", status_code=400)
|
|
|
|
access_token = token_data.get("access_token")
|
|
if not access_token:
|
|
return HTMLResponse("<h1>No access token</h1>", status_code=400)
|
|
|
|
# Get user info
|
|
oauth_user = await oauth_provider.get_user(access_token)
|
|
if not oauth_user:
|
|
return HTMLResponse("<h1>Failed to get user</h1>", status_code=400)
|
|
|
|
# Link mode: connect OAuth to current session user (for Settings → Integrations)
|
|
oauth_mode = request.session.pop("oauth_mode", "")
|
|
if oauth_mode == "link":
|
|
from app.auth.session import get_current_user as gcu
|
|
current = gcu(request)
|
|
if not current:
|
|
return HTMLResponse("<h1>Not logged in — please log in first</h1>", status_code=400)
|
|
from app.db import get_conn as _gc
|
|
with _gc() as conn:
|
|
conn.execute(
|
|
"""INSERT OR REPLACE INTO user_oauth_tokens
|
|
(user_id, provider, access_token, refresh_token, expires_at, updated_at)
|
|
VALUES (?, ?, ?, ?, ?, CURRENT_TIMESTAMP)""",
|
|
(current["id"], provider_name, access_token, token_data.get("refresh_token"), token_data.get("expires_at")),
|
|
)
|
|
conn.commit()
|
|
return RedirectResponse(url="/settings#integrations", status_code=302)
|
|
|
|
# Store user in DB
|
|
from app.db import get_conn
|
|
login_id = f"{provider_name}_{oauth_user['login']}"
|
|
with get_conn() as conn:
|
|
conn.execute(
|
|
"""INSERT INTO users (login, full_name, email, avatar_url, auth_method)
|
|
VALUES (?, ?, ?, ?, ?)
|
|
ON CONFLICT(login)
|
|
DO UPDATE SET full_name=excluded.full_name, email=excluded.email, avatar_url=excluded.avatar_url, auth_method=excluded.auth_method""",
|
|
(login_id, oauth_user.get("full_name", ""), oauth_user.get("email", ""), oauth_user.get("avatar_url", ""), provider_name),
|
|
)
|
|
conn.commit()
|
|
# Store OAuth token
|
|
uid = conn.execute("SELECT id FROM users WHERE login=?", (login_id,)).fetchone()
|
|
if uid:
|
|
conn.execute(
|
|
"""INSERT OR REPLACE INTO user_oauth_tokens
|
|
(user_id, provider, access_token, refresh_token, expires_at, updated_at)
|
|
VALUES (?, ?, ?, ?, ?, CURRENT_TIMESTAMP)""",
|
|
(uid["id"], provider_name, access_token, token_data.get("refresh_token"), token_data.get("expires_at")),
|
|
)
|
|
conn.commit()
|
|
user = conn.execute("SELECT * FROM users WHERE id=?", (uid["id"],)).fetchone()
|
|
else:
|
|
user = conn.execute("SELECT * FROM users WHERE login=?", (login_id,)).fetchone()
|
|
user_data = dict(user) if user else oauth_user
|
|
|
|
# Create session
|
|
session = SessionManager.create_session(user_data, request)
|
|
_log_login(user_data["id"], request)
|
|
response = RedirectResponse(url="/workspaces", status_code=302)
|
|
response.set_cookie("flowdeck_session", session, httponly=True, max_age=86400 * 7, samesite="lax", path="/")
|
|
return response
|
|
|
|
|
|
@router.get("/logout")
|
|
def logout(request: Request):
|
|
"""Clear session and redirect to login page.
|
|
|
|
SAML sessions additionally hand over to the IdP's Single Logout when one
|
|
is configured (the actual cookie clearing happens on the SLO route).
|
|
"""
|
|
cookie = request.cookies.get("flowdeck_session", "")
|
|
user = SessionManager.decode_session(cookie) if cookie else None
|
|
local_target = "/auth/login?provider=local"
|
|
|
|
if user and user.get("_sso_name_id"):
|
|
# SSO session → let /auth/saml/logout revoke locally + notify the IdP.
|
|
return RedirectResponse(url=f"/auth/saml/logout?next={local_target}", status_code=302)
|
|
|
|
response = RedirectResponse(url=local_target, status_code=302)
|
|
response.delete_cookie("flowdeck_session")
|
|
return response
|
|
|
|
|
|
@router.get("/user")
|
|
def current_user(request: Request):
|
|
"""Return current user info as JSON."""
|
|
from app.auth.session import get_current_user as gcu
|
|
from app.auth.session import public_user
|
|
user = gcu(request)
|
|
if not user:
|
|
return {"authenticated": False}
|
|
return {"authenticated": True, "user": public_user(user)}
|
|
|
|
|
|
# ── v7.2.0 — TOTP 2FA ─────────────────────────────────────────────────────
|
|
|
|
@router.post("/local-verify")
|
|
def local_verify(request: Request, body: dict = Body(default={})):
|
|
"""Exchange a 2FA ``pending`` token + TOTP/backup code for a session."""
|
|
from fastapi.responses import JSONResponse
|
|
|
|
from app.db import get_conn
|
|
from app.services import two_factor as _2fa
|
|
user_id = _2fa.redeem_pending(body.get("pending", ""))
|
|
if not user_id:
|
|
return JSONResponse({"error": "Challenge expired — log in again"}, status_code=401)
|
|
if not _2fa.verify_code(user_id, body.get("code", "")):
|
|
return JSONResponse({"error": "Invalid code"}, status_code=401)
|
|
with get_conn() as conn:
|
|
row = conn.execute("SELECT * FROM users WHERE id=?", (user_id,)).fetchone()
|
|
if not row or not row["is_active"]:
|
|
return JSONResponse({"error": "Account disabled"}, status_code=403)
|
|
ud = dict(row)
|
|
session = SessionManager.create_session(ud, request)
|
|
_log_login(ud["id"], request)
|
|
response = JSONResponse({"status": "ok", "user": {"login": ud["login"]}})
|
|
response.set_cookie("flowdeck_session", session, httponly=True,
|
|
max_age=86400 * 7, samesite="lax", path="/")
|
|
return response
|
|
|
|
|
|
def _session_user_or_401(request: Request) -> dict:
|
|
from fastapi import HTTPException
|
|
user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
|
|
if not user or not user.get("id"):
|
|
raise HTTPException(401, "Authentication required")
|
|
return user
|
|
|
|
|
|
@router.get("/2fa/status")
|
|
def twofa_status(request: Request):
|
|
from app.services import two_factor as _2fa
|
|
user = _session_user_or_401(request)
|
|
return {"enabled": _2fa.is_enabled(user["id"]),
|
|
"backup_remaining": _2fa.remaining_backup_codes(user["id"])}
|
|
|
|
|
|
@router.post("/2fa/setup")
|
|
def twofa_setup(request: Request):
|
|
from app.services import two_factor as _2fa
|
|
user = _session_user_or_401(request)
|
|
return _2fa.setup_secret(user["id"])
|
|
|
|
|
|
@router.post("/2fa/activate")
|
|
def twofa_activate(request: Request, body: dict = Body(default={})):
|
|
from fastapi.responses import JSONResponse
|
|
|
|
from app.services import two_factor as _2fa
|
|
user = _session_user_or_401(request)
|
|
try:
|
|
codes = _2fa.activate_secret(user["id"], body.get("secret", ""),
|
|
body.get("code", ""))
|
|
except ValueError:
|
|
return JSONResponse({"error": "Invalid code — secret not activated"},
|
|
status_code=400)
|
|
return {"status": "enabled", "backup_codes": codes}
|
|
|
|
|
|
@router.post("/2fa/disable")
|
|
def twofa_disable(request: Request):
|
|
from app.services import two_factor as _2fa
|
|
user = _session_user_or_401(request)
|
|
_2fa.disable(user["id"])
|
|
return {"status": "disabled"}
|
|
|
|
# ── Helpers ──
|
|
def _log_login(user_id: int, request: Request):
|
|
"""Record login in history."""
|
|
try:
|
|
from app.db import get_conn
|
|
ip = request.client.host if request.client else ''
|
|
ua = request.headers.get('user-agent', '')[:500]
|
|
with get_conn() as conn:
|
|
conn.execute(
|
|
"INSERT INTO login_history (user_id, ip_address, user_agent) VALUES (?, ?, ?)",
|
|
(user_id, ip, ua),
|
|
)
|
|
conn.commit()
|
|
except Exception:
|
|
logger.exception("_log_login")
|