busya
2d8cae563f
- Added plugin base and loader for backend extensibility - Implemented application settings management with config persistence - Created Svelte-based frontend with Dashboard and Settings pages - Added API routes for plugins, tasks, and settings - Updated documentation and specifications - Improved project structure and developer tools
52 lines
1.9 KiB
Python
Executable File
52 lines
1.9 KiB
Python
Executable File
# [DEF:AuthModule:Module]
|
|
# @SEMANTICS: auth, authentication, adfs, oauth, middleware
|
|
# @PURPOSE: Implements ADFS authentication using Authlib for FastAPI. It provides a dependency to protect endpoints.
|
|
# @LAYER: UI (API)
|
|
# @RELATION: Used by API routers to protect endpoints that require authentication.
|
|
|
|
from fastapi import Depends, HTTPException, status
|
|
from fastapi.security import OAuth2AuthorizationCodeBearer
|
|
from authlib.integrations.starlette_client import OAuth
|
|
from starlette.config import Config
|
|
|
|
# Placeholder for ADFS configuration. In a real app, this would come from a secure source.
|
|
# Create an in-memory .env file
|
|
from io import StringIO
|
|
config_data = StringIO("""
|
|
ADFS_CLIENT_ID=your-client-id
|
|
ADFS_CLIENT_SECRET=your-client-secret
|
|
ADFS_SERVER_METADATA_URL=https://your-adfs-server/.well-known/openid-configuration
|
|
""")
|
|
config = Config(config_data)
|
|
oauth = OAuth(config)
|
|
|
|
oauth.register(
|
|
name='adfs',
|
|
server_metadata_url=config('ADFS_SERVER_METADATA_URL'),
|
|
client_kwargs={'scope': 'openid profile email'}
|
|
)
|
|
|
|
oauth2_scheme = OAuth2AuthorizationCodeBearer(
|
|
authorizationUrl="https://your-adfs-server/adfs/oauth2/authorize",
|
|
tokenUrl="https://your-adfs-server/adfs/oauth2/token",
|
|
)
|
|
|
|
async def get_current_user(token: str = Depends(oauth2_scheme)):
|
|
"""
|
|
Dependency to get the current user from the ADFS token.
|
|
This is a placeholder and needs to be fully implemented.
|
|
"""
|
|
# In a real implementation, you would:
|
|
# 1. Validate the token with ADFS.
|
|
# 2. Fetch user information.
|
|
# 3. Create a user object.
|
|
# For now, we'll just check if a token exists.
|
|
if not token:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Not authenticated",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
# A real implementation would return a user object.
|
|
return {"placeholder_user": "user@example.com"}
|
|
# [/DEF] |