57 lines
1.4 KiB
Python
57 lines
1.4 KiB
Python
"""
|
|
OIDC-Authentifizierung via Authlib und Zitadel.
|
|
|
|
Konfiguriert den OAuth2-Client und stellt ``login_required`` sowie
|
|
``role_required`` als Route-Guard-Dekoratoren bereit.
|
|
|
|
:author: <Björn Runden>
|
|
:date: 2026-06-17
|
|
:version: 0.1
|
|
"""
|
|
|
|
import logging
|
|
from functools import wraps
|
|
from authlib.integrations.flask_client import OAuth
|
|
from flask import session, redirect, url_for
|
|
|
|
logger = logging.getLogger(__name__)
|
|
oauth = OAuth()
|
|
|
|
|
|
def init_oauth(app):
|
|
oauth.init_app(app)
|
|
oauth.register(
|
|
name="zitadel",
|
|
server_metadata_url=app.config["ZITADEL_SERVER_METADATA_URL"],
|
|
client_id=app.config["ZITADEL_CLIENT_ID"],
|
|
client_secret=app.config["ZITADEL_CLIENT_SECRET"],
|
|
client_kwargs={"scope": "openid profile email"},
|
|
)
|
|
|
|
|
|
def get_current_user():
|
|
return session.get("user")
|
|
|
|
|
|
def login_required(f):
|
|
@wraps(f)
|
|
def decorated(*args, **kwargs):
|
|
if not session.get("user"):
|
|
return redirect(url_for("main.login"))
|
|
return f(*args, **kwargs)
|
|
return decorated
|
|
|
|
|
|
def role_required(*roles):
|
|
def decorator(f):
|
|
@wraps(f)
|
|
def decorated(*args, **kwargs):
|
|
user = session.get("user")
|
|
if not user:
|
|
return redirect(url_for("main.login"))
|
|
if user.get("role") not in roles:
|
|
return redirect(url_for("main.error"))
|
|
return f(*args, **kwargs)
|
|
return decorated
|
|
return decorator
|