217 lines
9.7 KiB
Python
217 lines
9.7 KiB
Python
"""User identities, persistent sessions and server-enforced capabilities."""
|
|
from __future__ import annotations
|
|
|
|
import hashlib
|
|
import hmac
|
|
import secrets
|
|
from contextvars import ContextVar
|
|
from time import time
|
|
from urllib.parse import urlsplit
|
|
|
|
from fastapi import HTTPException, Request
|
|
from sqlalchemy import delete
|
|
from sqlalchemy.exc import IntegrityError
|
|
from sqlmodel import Session
|
|
|
|
from ..core.config import settings
|
|
from ..core.time import utc_now
|
|
from ..db import session as database
|
|
from ..db.models import BootstrapGrant, GatewayUser, UserSession
|
|
|
|
USER_COOKIE = "appops_user_session"
|
|
SESSION_TTL = 8 * 60 * 60
|
|
actor_identity: ContextVar[str | None] = ContextVar("appops_user", default=None)
|
|
PERMISSIONS = {
|
|
"read": "Status, inventaris en audit bekijken",
|
|
"actions.execute": "Operationele acties uitvoeren en aanvragen",
|
|
"inventory.manage": "Inventaris ontdekken en mappings beheren",
|
|
"approvals.manage": "Goedkeuringen behandelen",
|
|
"connectors.manage": "Connectorconfiguratie beheren",
|
|
"policies.manage": "Policies en playbooks beheren",
|
|
"settings.manage": "Systeeminstellingen, exports en backups beheren",
|
|
"notifications.manage": "Meldingen en meldingsregels beheren",
|
|
"voice.use": "Voice-opdrachten testen en aanvragen",
|
|
"users.manage": "Gebruikers en rechten beheren",
|
|
}
|
|
ROLES = {"admin", "operator", "read_only", "custom"}
|
|
OPERATOR_PERMISSIONS = {"read", "actions.execute", "inventory.manage", "voice.use", "notifications.manage"}
|
|
|
|
|
|
def digest(value: str) -> str:
|
|
return hashlib.sha256(value.encode()).hexdigest()
|
|
|
|
|
|
def effective_permissions(user: GatewayUser) -> set[str]:
|
|
if not user.enabled:
|
|
return set()
|
|
if user.role == "admin":
|
|
return set(PERMISSIONS)
|
|
if user.role == "operator":
|
|
return set(OPERATOR_PERMISSIONS)
|
|
if user.role == "custom":
|
|
return {"read"} | (set(user.permissions) & (set(PERMISSIONS) - {"users.manage"}))
|
|
return {"read"}
|
|
|
|
|
|
def user_view(user: GatewayUser) -> dict:
|
|
return {
|
|
"id": user.id, "provider": user.provider, "subject": user.subject,
|
|
"email": user.email, "displayName": user.display_name,
|
|
"role": user.role, "enabled": user.enabled,
|
|
"permissions": sorted(effective_permissions(user)),
|
|
}
|
|
|
|
|
|
def provision_user(db: Session, provider: str, issuer: str, claims: dict) -> GatewayUser:
|
|
subject = str(claims.get("oid") if provider == "entra" else claims.get("sub") or "")
|
|
if not subject or subject == "None":
|
|
raise HTTPException(401, "Identity provider subject missing")
|
|
if provider == "entra":
|
|
subject = subject.casefold()
|
|
user_id = digest(f"{provider}\n{issuer}\n{subject}")
|
|
user = db.get(GatewayUser, user_id)
|
|
email_claim = claims.get("email")
|
|
verified_email = email_claim if isinstance(email_claim, str) else ""
|
|
email = str(verified_email or claims.get("preferred_username") or "")[:320]
|
|
if user is None:
|
|
user = GatewayUser(id=user_id, provider=provider, issuer=issuer, subject=subject)
|
|
# An explicit bootstrap can also recover an initial login made before its
|
|
# provider configuration was complete. Consumed grants never restore roles.
|
|
grant_key = None
|
|
admin_subjects = {item.casefold() if item.startswith("entra:") else item for item in settings.auth_admin_subjects or []}
|
|
if f"{provider}:{subject}" in admin_subjects:
|
|
grant_key = digest(f"subject:{provider}:{issuer}:{subject}")
|
|
elif provider == "authentik" and verified_email and claims.get("email_verified") is True and verified_email.casefold() in {
|
|
item.casefold() for item in settings.auth_admin_emails or []
|
|
}:
|
|
grant_key = digest(f"email:{provider}:{issuer}:{verified_email.casefold()}")
|
|
user_grant_key = digest(f"user-bootstrap:{user_id}")
|
|
if grant_key and db.get(BootstrapGrant, grant_key) is None and db.get(BootstrapGrant, user_grant_key) is None:
|
|
db.add(BootstrapGrant(id=grant_key, user_id=user_id))
|
|
db.add(BootstrapGrant(id=user_grant_key, user_id=user_id))
|
|
user.role = "admin"
|
|
user.email = email
|
|
user.display_name = str(claims.get("name") or claims.get("preferred_username") or email or subject)[:200]
|
|
user.last_login = utc_now()
|
|
db.add(user)
|
|
try:
|
|
db.commit()
|
|
except IntegrityError:
|
|
# Another request consumed this bootstrap grant or provisioned the same
|
|
# identity. Re-evaluate against committed state, never grant twice.
|
|
db.rollback()
|
|
return provision_user(db, provider, issuer, claims)
|
|
db.refresh(user)
|
|
return user
|
|
|
|
|
|
def issue_session(db: Session, user: GatewayUser) -> str:
|
|
if not user.enabled:
|
|
raise HTTPException(403, "Account disabled")
|
|
opaque = secrets.token_urlsafe(48)
|
|
db.exec(delete(UserSession).where(UserSession.expires_at <= int(time())))
|
|
db.add(UserSession(id=digest(opaque), user_id=user.id, expires_at=int(time()) + SESSION_TTL))
|
|
db.commit()
|
|
return opaque
|
|
|
|
|
|
def validate_csrf(request: Request) -> None:
|
|
if request.method in {"GET", "HEAD", "OPTIONS"}:
|
|
return
|
|
if not hmac.compare_digest(request.headers.get("X-AppOps-Session-CSRF", ""), "1"):
|
|
raise HTTPException(403, "Session CSRF validation failed")
|
|
origin = request.headers.get("Origin")
|
|
if origin:
|
|
allowed = {settings.frontend_origin.rstrip("/")}
|
|
if settings.auth_public_url:
|
|
parts = urlsplit(settings.auth_public_url)
|
|
allowed.add(f"{parts.scheme}://{parts.netloc}")
|
|
if origin.rstrip("/") not in allowed:
|
|
raise HTTPException(403, "Session origin validation failed")
|
|
|
|
|
|
def current_user(request: Request) -> GatewayUser:
|
|
cached = getattr(request.state, "gateway_user", None)
|
|
if cached is not None:
|
|
return cached
|
|
with Session(database.engine) as db:
|
|
cookie = request.cookies.get(USER_COOKIE, "")
|
|
record = db.get(UserSession, digest(cookie)) if cookie else None
|
|
user = db.get(GatewayUser, record.user_id) if record and record.expires_at > time() else None
|
|
if user is None:
|
|
# Header identities are accepted only from explicitly trusted
|
|
# Authentik outposts. A stable uid is required; groups grant no role.
|
|
from ..core.security import _request_from_trusted_operator_proxy
|
|
if _request_from_trusted_operator_proxy(request):
|
|
uid = request.headers.get("X-authentik-uid", "").strip()
|
|
if uid:
|
|
user = provision_user(db, "authentik", settings.authentik_issuer or "authentik-proxy", {
|
|
"sub": uid, "email": request.headers.get("X-authentik-email", ""),
|
|
"name": request.headers.get("X-authentik-name") or request.headers.get("X-authentik-username", ""),
|
|
})
|
|
if user is None or not user.enabled:
|
|
raise HTTPException(401, "Sign in with Authentik or Microsoft Entra")
|
|
validate_csrf(request)
|
|
db.expunge(user)
|
|
request.state.gateway_user = user
|
|
return user
|
|
|
|
|
|
def required_permission(path: str, method: str) -> str:
|
|
if path.startswith("/api/auth/users") or path == "/api/auth/permissions":
|
|
return "users.manage"
|
|
if path.startswith(("/api/admin/", "/api/runtime/", "/api/settings/secrets")):
|
|
return "settings.manage"
|
|
if method in {"GET", "HEAD", "OPTIONS"}:
|
|
return "read"
|
|
if path in {"/api/ai/chat", "/api/ai/summarize/logs"} or path.startswith("/api/ai/analyze/incident/"):
|
|
return "read"
|
|
if path.startswith("/api/ai/memory"):
|
|
return "settings.manage"
|
|
if path.startswith(("/api/settings/connectors", "/api/connectors", "/api/setup/")):
|
|
return "connectors.manage"
|
|
if path.startswith(("/api/settings/", "/api/system/")) or path in {
|
|
"/api/ai/rag/reindex",
|
|
"/api/knowledge/reindex",
|
|
"/api/enrollments/trust",
|
|
"/api/enrollments/trust/storage-root",
|
|
}:
|
|
return "settings.manage"
|
|
if path.startswith("/api/apps/") and path.endswith(("/metadata", "/container-mapping")):
|
|
return "inventory.manage"
|
|
if path.startswith(("/api/policies", "/api/playbooks")):
|
|
return "policies.manage"
|
|
if path.startswith("/api/approvals"):
|
|
return "actions.execute" if path.rstrip('/') == "/api/approvals" and method == "POST" else "approvals.manage"
|
|
if path.startswith("/api/inventory"):
|
|
return "inventory.manage"
|
|
if path.startswith("/api/notifications"):
|
|
return "notifications.manage"
|
|
if path.startswith(("/api/voice/", "/api/operator/voice/")):
|
|
return "voice.use"
|
|
return "actions.execute"
|
|
|
|
|
|
def authorize_request(request: Request) -> GatewayUser:
|
|
user = current_user(request)
|
|
permission = required_permission(request.url.path, request.method)
|
|
if permission not in effective_permissions(user):
|
|
raise HTTPException(403, "Your account does not have permission for this operation")
|
|
executes_approval = request.url.path.startswith("/api/approvals/") and request.url.path.endswith("/execute")
|
|
executes_voice = request.url.path.startswith("/api/voice/actions/") or (
|
|
request.url.path.startswith("/api/voice/commands/") and request.url.path.endswith("/request-approval")
|
|
)
|
|
if request.method not in {"GET", "HEAD", "OPTIONS"} and (executes_approval or executes_voice) and "actions.execute" not in effective_permissions(user):
|
|
raise HTTPException(403, "Your account does not have permission to execute or request this action")
|
|
return user
|
|
|
|
|
|
def session_status(request: Request) -> dict:
|
|
try:
|
|
user = current_user(request)
|
|
except HTTPException as exc:
|
|
if exc.status_code != 401:
|
|
raise
|
|
return {"authenticated": False, "user": None, "permissions": []}
|
|
return {"authenticated": True, "user": user_view(user), "permissions": sorted(effective_permissions(user))}
|