chmln-app-dev/formeleon
5
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

gemini (kostenintensives) app-aufbauen

Browse Source
This commit is contained in:
br committed 2026-08-01 16:42:30 +02:00
1 parent c74bca1e13
commit 8232f4d8f7
11 files changed
+659 -519
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

routes/auth.py
+18 -120
View File
@@ -34,6 +34,7 @@ from flask import Blueprint, request, redirect, url_for, session, current_app, j
from flask import render_template_string
from models import db, User, UserRole, Tenant, AuditLog
from services.auth_service import AuthService
logger = logging.getLogger(__name__)
@@ -42,86 +43,6 @@ logger = logging.getLogger(__name__)
auth_bp = Blueprint('auth', __name__, template_folder='../templates')
def is_dev_mode() -> bool:
"""Check if application is in development mode."""
return current_app.config.get('DEV_MODE', False)
def create_dev_user_session() -> dict:
"""
Create a development mode user session with fake Zitadel user.
:return: Dictionary with user session data
"""
config = current_app.config
# Use configured dev user settings or defaults
dev_user = {
'id': config.get('DEV_USER_ID', 'user_dev_admin_001'),
'email': config.get('DEV_USER_EMAIL', 'dev@formeleon.local'),
'name': config.get('DEV_USER_NAME', 'Dev Admin'),
'role': config.get('DEV_USER_ROLE', 'admin'),
'sub': f'dev-{uuid.uuid4()}',
'tenant_id': config.get('DEV_TENANT_ID', 'tenant_dev_123'),
'dev_mode': True,
'authenticated': True
}
return dev_user
def ensure_dev_user_exists() -> User:
"""
Ensure the development user exists in the database.
:return: User object from database
"""
config = current_app.config
user_id = config.get('DEV_USER_ID', 'user_dev_admin_001')
user = User.query.get(user_id)
if not user:
role = UserRole.ADMIN if config.get('DEV_USER_ROLE', 'admin') == 'admin' else UserRole.USER
user = User(
id=user_id,
email=config.get('DEV_USER_EMAIL', 'dev@formeleon.local'),
name=config.get('DEV_USER_NAME', 'Dev Admin'),
role=role,
sub=f'dev-{uuid.uuid4()}'
)
db.session.add(user)
db.session.commit()
logger.info(f'Created dev user: {user.id}')
return user
def ensure_dev_tenant_exists() -> Tenant:
"""
Ensure the development tenant exists in the database.
:return: Tenant object from database
"""
config = current_app.config
tenant_id = config.get('DEV_TENANT_ID', 'tenant_dev_123')
tenant = Tenant.query.get(tenant_id)
if not tenant:
tenant = Tenant(
id=tenant_id,
name='Development Tenant',
public_key=f'dev-key-{uuid.uuid4().hex[:16]}',
allowed_origins='*'
)
db.session.add(tenant)
db.session.commit()
logger.info(f'Created dev tenant: {tenant.id}')
return tenant
@auth_bp.before_request
def check_dev_mode_auth():
"""
@@ -139,16 +60,16 @@ def check_dev_mode_auth():
return
# In dev mode, auto-authenticate
if is_dev_mode():
dev_user = create_dev_user_session()
if AuthService.is_dev_mode():
dev_user = AuthService.create_dev_user_session()
session['user_id'] = dev_user['id']
session['user'] = dev_user
session['authenticated'] = True
session.permanent = True
# Ensure user and tenant exist in database
ensure_dev_user_exists()
ensure_dev_tenant_exists()
AuthService.ensure_dev_user_exists()
AuthService.ensure_dev_tenant_exists()
@auth_bp.route('/login')
@@ -165,8 +86,8 @@ def login():
next_url = request.args.get('next', url_for('admin.dashboard'))
# Development mode: create fake session and redirect
if is_dev_mode():
dev_user = create_dev_user_session()
if AuthService.is_dev_mode():
dev_user = AuthService.create_dev_user_session()
session.clear()
session['user_id'] = dev_user['id']
session['user'] = dev_user
@@ -174,8 +95,8 @@ def login():
session.permanent = True
# Ensure user and tenant exist in database
ensure_dev_user_exists()
ensure_dev_tenant_exists()
AuthService.ensure_dev_user_exists()
AuthService.ensure_dev_tenant_exists()
logger.info(f'Dev mode login: {dev_user["email"]}')
@@ -247,7 +168,7 @@ def callback():
Handles the callback from Zitadel after successful authentication.
Exchanges authorization code for tokens and retrieves user info.
"""
if is_dev_mode():
if AuthService.is_dev_mode():
# In dev mode, shouldn't reach here, but handle gracefully
return redirect(url_for('admin.dashboard'))
@@ -287,34 +208,11 @@ def callback():
logger.debug(f'OIDC userinfo: {user_info}')
# Extract user data
sub = user_info.get('sub')
email = user_info.get('email')
name = user_info.get('name', user_info.get('preferred_username', 'Unknown'))
if not email:
return jsonify({'error': 'No email in user info'}), 400
# Create or update user
user = User.query.filter_by(sub=sub).first()
user, error = AuthService.process_oidc_callback(user_info)
if not user:
user_id = f'user_{email.split("@")[0]}_{str(uuid.uuid4())[:8]}'
user = User(
id=user_id,
email=email,
name=name,
role=UserRole.USER, # Default role for new OIDC users
sub=sub
)
db.session.add(user)
db.session.commit()
logger.info(f'Created new user from OIDC: {user.id}')
else:
# Update existing user
user.name = name
user.email = email
db.session.commit()
if error:
return jsonify({'error': error}), 400
# Store in session
session.clear()
@@ -368,7 +266,7 @@ def logout():
session.clear()
# In production, revoke token with Zitadel
if not is_dev_mode() and 'access_token' in session:
if not AuthService.is_dev_mode() and 'access_token' in session:
try:
from authlib.integrations.flask_client import OAuth
oauth = OAuth(current_app)
@@ -388,7 +286,7 @@ def logout():
action='logout',
resource_type='auth',
user=current_user,
details={'mode': 'dev' if is_dev_mode() else 'oidc'}
details={'mode': 'dev' if AuthService.is_dev_mode() else 'oidc'}
)
return redirect(url_for('auth.login'))
@@ -406,12 +304,12 @@ def status():
return jsonify({
'authenticated': True,
'user': user_data,
'dev_mode': is_dev_mode()
'dev_mode': AuthService.is_dev_mode()
})
return jsonify({
'authenticated': False,
'dev_mode': is_dev_mode()
'dev_mode': AuthService.is_dev_mode()
})
@@ -436,5 +334,5 @@ def userinfo():
return jsonify({
'user': user.to_dict(),
'tenants': [tenant.to_dict() for tenant in user.tenants],
'dev_mode': is_dev_mode()
'dev_mode': AuthService.is_dev_mode()
})