CCCHH/dooris
1
1
Fork 0
Code Issues 5 Pull requests 1 Releases Packages 1 Activity Actions

fix bug in API static tokens where not actually extracted from request

Browse source
This commit is contained in:
lilly 2026-07-18 21:10:32 +02:00
commit a7692dc894
Signed by: lilly
SSH key fingerprint: SHA256:y9T5GFw2A20WVklhetIxG1+kcg/Ce0shnQmbu1LQ37g
1 changed files with 21 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

28
api/src/dooris_api/deps.py
View file

@ -1,7 +1,7 @@
from typing import Annotated, Optional
import logging
from datetime import datetime, UTC, timedelta
from fastapi import Request, Depends, Response, Header
from fastapi import Request, Depends, Response
from fastapi.security import APIKeyHeader
from simple_openid_connect.data import TokenSuccessResponse
from simple_openid_connect.client import OpenidClient
@ -14,7 +14,12 @@ from dooris_api.ccujack import CCUJackClient
logger = logging.getLogger(__name__)
api_key_security_scheme = APIKeyHeader(name="Authorization", scheme_name="Static-Token", auto_error=False)
api_key_security_scheme = APIKeyHeader(
name="authorization",
scheme_name="Static-Token",
description="Set the Authorization header to 'Static-Token foobar123' with a token that is statically configured at application parameter",
auto_error=False,
)
async def get_oidc_client(req: Request) -> OpenidClient:
@ -134,14 +139,17 @@ def clear_oidc_auth_state(resp: Response):
def get_logged_in_token_user(req: Request, token: Optional[str]):
print(req.headers)
print(token)
if not token or not token.startswith("Static-Token "):
logger.debug("No static API-Token was part of the request")
return None
token = token.removeprefix("Static-Token ")
valid_tokens = app_config.get().static_api_tokens
if any((i == token for i in valid_tokens)):
if any((i == token for i in valid_tokens)):
logger.debug("Successfully authenticated a static API-Token")
return models.ApiUser(
is_anonymous=False,
@ -157,7 +165,10 @@ def get_logged_in_token_user(req: Request, token: Optional[str]):
async def get_api_user(
req: Request, resp: Response, oidc_client: OpenidClient, token: Annotated[Optional[str], Depends(api_key_security_scheme)] = None
req: Request,
resp: Response,
oidc_client: OpenidClient,
token: Annotated[Optional[str], Depends(api_key_security_scheme)] = None,
) -> models.ApiUser:
oidc_user = await get_logged_in_oidc_user(req, resp, oidc_client)
token_user = get_logged_in_token_user(req, token)
@ -182,9 +193,12 @@ ApiUser = Annotated[models.ApiUser, Depends(get_api_user)]
async def get_authenticated_user(
req: Request, resp: Response, oidc_client: OpenidClient
req: Request,
resp: Response,
oidc_client: OpenidClient,
token: Annotated[Optional[str], Depends(api_key_security_scheme)] = None,
) -> models.ApiUser:
user = await get_api_user(req, resp, oidc_client)
user = await get_api_user(req, resp, oidc_client, token)
if user.is_anonymous:
raise exceptions.HttpProblemException.unauthorized(req.url)
else: