2197cdb3d5
tkuser에서 프로젝트/사용자를 통합 관리하므로 TKQC에서 불필요한 기능 제거: - 프로젝트 관리: POST/PUT/DELETE API 및 페이지 삭제 (GET 유지) - 사용자 관리: CRUD API 및 admin.html 삭제 (login/me/change-password 유지) - 일일 공수: daily_work.py, daily-work.html 삭제, reports.py에서 DailyWork 참조 제거 - 디버그 페이지 4개 삭제 (check-projects, sync-projects, test_api, mobile-fix) - 네비게이션/권한/키보드 단축키에서 제거된 메뉴 정리 - tkuser permissionModel.js에서 daily_work, projects_manage 키 제거 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
115 lines
3.9 KiB
Python
115 lines
3.9 KiB
Python
from fastapi import APIRouter, Depends, HTTPException, status
|
|
from fastapi.security import OAuth2PasswordBearer, OAuth2PasswordRequestForm
|
|
from sqlalchemy.orm import Session
|
|
from typing import List
|
|
|
|
from database.database import get_db
|
|
from database.models import User, UserRole
|
|
from database import schemas
|
|
from services.auth_service import (
|
|
authenticate_user, create_access_token, verify_token,
|
|
get_password_hash, verify_password
|
|
)
|
|
|
|
router = APIRouter(prefix="/api/auth", tags=["auth"])
|
|
oauth2_scheme = OAuth2PasswordBearer(tokenUrl="/api/auth/login")
|
|
|
|
async def get_current_user(token: str = Depends(oauth2_scheme), db: Session = Depends(get_db)):
|
|
credentials_exception = HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Could not validate credentials",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
payload = verify_token(token, credentials_exception)
|
|
username = payload.get("sub")
|
|
|
|
# 로컬 DB에서 사용자 조회
|
|
user = db.query(User).filter(User.username == username).first()
|
|
if user is not None:
|
|
if not user.is_active:
|
|
raise HTTPException(status_code=400, detail="Inactive user")
|
|
return user
|
|
|
|
# DB에 없는 SSO 사용자: JWT payload로 임시 User 객체 생성
|
|
sso_role = payload.get("role", "user")
|
|
role_map = {
|
|
"Admin": UserRole.admin,
|
|
"System Admin": UserRole.system,
|
|
"system": UserRole.system,
|
|
"admin": UserRole.admin,
|
|
"support_team": UserRole.support_team,
|
|
"leader": UserRole.leader,
|
|
}
|
|
mapped_role = role_map.get(sso_role, UserRole.user)
|
|
|
|
sso_user = User(
|
|
id=0,
|
|
username=username,
|
|
hashed_password="",
|
|
full_name=payload.get("name", username),
|
|
role=mapped_role,
|
|
is_active=True,
|
|
)
|
|
return sso_user
|
|
|
|
async def get_current_admin(current_user: User = Depends(get_current_user)):
|
|
if current_user.role not in [UserRole.admin, UserRole.system]:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail="Not enough permissions"
|
|
)
|
|
return current_user
|
|
|
|
@router.options("/login")
|
|
async def login_options():
|
|
"""OPTIONS preflight 요청 처리"""
|
|
return {"message": "OK"}
|
|
|
|
@router.post("/login", response_model=schemas.Token)
|
|
async def login(form_data: OAuth2PasswordRequestForm = Depends(), db: Session = Depends(get_db)):
|
|
user = authenticate_user(db, form_data.username, form_data.password)
|
|
if not user:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Incorrect username or password",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
access_token = create_access_token(data={"sub": user.username})
|
|
return {
|
|
"access_token": access_token,
|
|
"token_type": "bearer",
|
|
"user": user
|
|
}
|
|
|
|
@router.get("/me", response_model=schemas.User)
|
|
async def read_users_me(current_user: User = Depends(get_current_user)):
|
|
return current_user
|
|
|
|
@router.get("/users", response_model=List[schemas.User])
|
|
async def get_all_users(
|
|
current_admin: User = Depends(get_current_admin),
|
|
db: Session = Depends(get_db)
|
|
):
|
|
"""모든 사용자 목록 조회 (관리자 전용)"""
|
|
users = db.query(User).filter(User.is_active == True).all()
|
|
return users
|
|
|
|
@router.post("/change-password")
|
|
async def change_password(
|
|
password_change: schemas.PasswordChange,
|
|
current_user: User = Depends(get_current_user),
|
|
db: Session = Depends(get_db)
|
|
):
|
|
# 현재 비밀번호 확인
|
|
if not verify_password(password_change.current_password, current_user.hashed_password):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail="Incorrect current password"
|
|
)
|
|
|
|
# 새 비밀번호 설정
|
|
current_user.hashed_password = get_password_hash(password_change.new_password)
|
|
db.commit()
|
|
|
|
return {"detail": "Password changed successfully"}
|