
    Eoh}-                        d dl mZ d dlZd dlmZmZmZ d dlmZmZm	Z	 d dl
mZmZmZ d dlmZmZ d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZ d dlmZ d dlm Z  d dl!m"Z" d dl#m$Z$ d dl%m&Z& d dl'm(Z( d dl)m*Z*  ejV                  e,      Z- edgd      Z.de/de/de0fdZ1de/de/fdZ2 G d de      Z3 G d de      Z4 e e3              ee&      fd e/d!ede	e   fd"Z5 e e3              ee&      fd e/d!ede	e"   fd#Z6 G d$ d%      Z7 ee6       ee&      fd&e d!ede"fd'Z8 e e4              ee&      fd e/d!ede	e"   fd(Z9y))    )CryptContextN)datetime	timedeltatimezone)AnyDictOptional)DependsHTTPExceptionRequest)HTTPAuthorizationCredentials
HTTPBearer)Session)status)SessionSchema)
Permission)get_user_permissionsget_user_role_slugs)Users)UserReturnSchema)settings)get_db)UserAccessLevelverify_access_tokenbcryptauto)schemes
deprecatedplain_passwordhashed_passwordreturnc                 .    t         j                  | |      S )z*
    Verify a password against a hash
    )pwd_contextverify)r!   r"   s     I/var/www/html/wine-match-dev/backend/winematch-backend/src/utils/guard.pyverify_passwordr(      s     no>>    passwordc                 ,    t         j                  |       S )z%
    Hash a password for storing
    )r%   hash)r*   s    r'   get_password_hashr-   $   s     H%%r)   c                   L     e Zd Zddef fdZdef fdZdedee	   fdZ
 xZS )		AuthGuard
auto_errorc                 .    t         t        |   |       y )Nr0   )superr/   __init__)selfr0   	__class__s     r'   r4   zAuthGuard.__init__,   s    i':'>r)   requestc                 \  K   t         t        |   |       d {   }|rn|j                  dk(  st	        t
        j                  d      | j                  |j                        }|t	        t
        j                  d      |j                  S t	        t
        j                  d      7 w)NBearerzInvalid authentication scheme.status_codedetailzInvalid or expired token.zInvalid authorization code.)	r3   r/   __call__schemer   r   HTTP_403_FORBIDDEN
verify_jwtcredentialsr5   r7   rA   decoded_tokenr6   s       r'   r=   zAuthGuard.__call__/   s     :?	4:YZa:b4b%%1# & 9 9;  !OOK,C,CDM$# & 9 96 
 ***"554 ! 5cs   B,B*BB,jwtokenr#   c                     t        |      }|S Nr   r5   rD   payloads      r'   r@   zAuthGuard.verify_jwtE       %g.r)   )T)__name__
__module____qualname__boolr4   r   r=   strr	   r   r@   __classcell__r6   s   @r'   r/   r/   +   s2    ?4 ?g ,# (4. r)   r/   c                   D     e Zd Z fdZdef fdZdedee   fdZ	 xZ
S )OptionalAuthGuardc                 .    t         t        |   d       y )NFr2   )r3   rR   r4   )r5   r6   s    r'   r4   zOptionalAuthGuard.__init__K   s    /5/Ar)   r7   c                    K   t         t        |   |       d {   }|sy |j                  dk(  sy | j	                  |j
                        }|y |j
                  S 7 Aw)Nr9   )r3   rR   r=   r>   r@   rA   rB   s       r'   r=   zOptionalAuthGuard.__call__N   sd     :?@QSW:abi:j4j!!X-(?(?@ &&& 5ks   AAAArD   r#   c                     t        |      }|S rF   r   rG   s      r'   r@   zOptionalAuthGuard.verify_jwt\   rI   r)   )rJ   rK   rL   r4   r   r=   rN   r	   r   r@   rO   rP   s   @r'   rR   rR   J   s,    B'g '# (4. r)   rR   tokendbc                    K   |j                  t              j                  t        j                  | k(        j	                         }|t        t        j                  d      |S w)N%Session timed out or does not exists.r:   )querySessionModelfilterrV   firstr   r   r?   )rV   rW   sessions      r'   get_active_sessionr_   a   sZ      hh|$++L,>,>%,GHNNPG11:
 	
 Ns   A#A%c                   K   t        | |       d {   }d}t        |j                        }|j                  s3|0|j	                  di       }|j                  t              j                  t        j                  |j	                  d      k(        j                         }|st        t        j                  d      ddlm}  |||j                  	       d {   }d
|v }	|	r|j                   n|r|j"                  n|j                   }
t%        j&                  t(        j*                        }|
r!|
j-                         |j-                         k  rt        t        j                  d      ||j	                  dt/                     }|j                  t              j                  t        j                  |j	                  d      k(        j                         }|st        t        j                  d      |j	                  dd      st        t        j0                  d      |j	                  dd      st        t        j2                  d      t5        |dg       }t6        j8                  j:                  |v r|j                  t<              j                  t<        j>                  dk(        jA                         }|jB                  D ]<  }|jD                  jF                  t6        j8                  j:                  k(  s5||_$         n tK        di |jM                         |jN                  |jP                  dS t        t        j                  d      7 F7 w)N)rV   rW   FuseridzUser not found.r:   r   r   rW   user_idsuper_adminzAuthentication token expired!	is_activezAccount has been deactivated.is_verifiedzAccount has not been verified.	all_rolesTavatarrh   rY    ))r_   r   rV   persistgetrZ   r   r\   rb   r]   r   r   r?   .src.apps.role_permission.services.role_servicer   rd   
expires_atrefreshed_atr   nowr   utc	timestampdictHTTP_423_LOCKEDHTTP_412_PRECONDITION_FAILEDgetattrr   SUPER_ADMINvaluer   rf   allrolesroleslugpermissionsr   _asdictrj   rh   )rV   rW   r^   auto_session_timeoutrC   decoded_user_datauser_recordr   
user_rolesis_super_adminexpiry_timetoken_expiry_thresholddecoded_userrh   all_permissions
role_entrys                   r'   get_current_userr   m   s     'Ur::G '6M??$&3&7&7&C((5/00=N=R=RSW=X1XY__aK# & 9 9,   3b+BUBUVVJ*j8N
 " "".Bg**HZHZ 
 &.\\(,,%?"+"7"7"9<R<\<\<^"^# & 9 9: 
  *..vtv>hhuo,,UXX9I9I$9O-OPVVX"55(  U3"226 
 u5"??7  Kb9	&&,,	9 hhz299*:N:NRV:VW[[]O)// 
??''?+F+F+L+LL-<J*
  t+"5"5"7t@R@R^i^s^stt
--6 A ;$ Ws*   MMC	MMH#MAMMc                   X    e Zd Zddeee      fdZ ee       ee	      fde
dedefdZy)	AdministratorRoleRequiredGuardNallowed_rolesc           	         g | _         |r7|D ]1  }	 | j                   j                  t        |      j                         3 y t        j                  j                  g| _         y # t        $ rb t        t        |j                               rA| j                   j                  t        t        |j                               j                         Y w xY wrF   )	required_permissionsappendr   ry   
ValueErrorhasattrupperrw   rx   )r5   r   r|   s      r'   r4   z'AdministratorRoleRequiredGuard.__init__   s    $&!% gg--44_T5J5P5PQg *9)D)D)J)J(KD%	 " g

=1188RVR\R\R^9_9e9efgs   .A""A(CCra   rW   r#   c                    K   t        ||j                         d {   }| j                  D ]  }||v s y t        t        j
                  d      7 6w)Nrc   Tz7You do not have the required administrative privileges.r:   )r   rd   r   r   r   rv   )r5   ra   rW   user_permissions
permissions        r'   r=   z'AdministratorRoleRequiredGuard.__call__   s`      "6T\\!RR 33 	J--	 ;;L
 	
 Ss   AAAArF   )rJ   rK   rL   r	   listrN   r4   r
   r   r   r   r   rM   r=   rk   r)   r'   r   r      sL    
LhtCy&9 
L ./fo

 
 
	
r)   r   current_userc                    K   t        || j                         d {   t        fddD              st        t        j
                  d      | S 7 5w)Nrc   c              3   &   K   | ]  }|v  
 y wrF   rk   ).0r|   r   s     r'   	<genexpr>z&admin_required_user.<locals>.<genexpr>   s     Gdtz!Gs   )adminre   z3You do not have permission to access this resource.r:   )r   rd   anyr   r   r?   )r   rW   r   s     @r'   admin_required_userr      sT      +b,:N:NOOJG.FGG11H
 	

  Ps   AA6Ac                 R  K   | sy	 |j                  t              j                  t        j                  | k(        j	                         }|yd}t        |j                        }|j                  s||j                  di       }|j                  t              j                  t        j                  |j                  d      k(        j	                         }|syt        ||j                         d{   }d|v }|r|j                  n|r|j                  n|j                  }	t        j                  t         j"                        }
|	r!|	j%                         |
j%                         k  ry|~|j                  dt'                     }|j                  t              j                  t        j                  |j                  d      k(        j	                         }|sy|j                  dd      sy|j                  dd      syt)        |d	g       }t*        j,                  j.                  |v r|j                  t0              j                  t0        j2                  d
k(        j5                         }|j6                  D ]<  }|j8                  j:                  t*        j,                  j.                  k(  s5||_         n t?        di |jA                         |jB                  |jD                  dS y7 # tF        $ r+}tH        jK                  dtM        |              Y d}~yd}~ww xY ww)a#  
    Similar to get_current_user but doesn't block access if no token is provided.
    If a token is provided, it operates the same as get_current_user.

    Returns:
        UserReturnSchema: If a valid token was provided
        None: If no token was provided or the token was invalid
    NFra   rb   rc   re   rf   rg   rh   Tri   z(Error in optionally_authenticated_user: rk   )'rZ   r[   r\   rV   r]   r   rl   rm   r   rb   r   rd   ro   rp   r   rq   r   rr   rs   rt   rw   r   rx   ry   r   rf   rz   r{   r|   r}   r~   r   r   rj   rh   	ExceptionloggererrorrN   )rV   rW   r^   r   rC   r   r   r   r   r   r   r   rh   r   r   es                   r'   optionally_authenticated_userr      s     8((<(//0B0Be0KLRRT?$+GMM:(*7*;*;FB*G! hhuo44UXXARAVAVW[A\5\]cce" $7"kFYFY#ZZ
!.*!<
 & &&2F'..GL^L^ 
 *2hll)C&"k&;&;&=@V@`@`@b&b$!.!2!2646!BL((5/00\=M=Md=S1STZZ\K##K7##M59["=I**00I="$((:"6"="=j>R>RVZ>Z"["_"_"a"-"3"3 J!++/J/J/P/PP1@
.
 $xk&9&9&;xKDVDVbmbwbwxxK [L  ?AxHIs   L'AK0 L'BK0 L'K0 3K-4A6K0 *L'+A1K0 L'K0 /L'0K0 L'B,K0 0;K0 +L'-K0 0	L$9!LL'L$$L'):passlib.contextr   loggingr   r   r   typingr   r   r	   fastapir
   r   r   fastapi.securityr   r   sqlalchemy.ormr   	starletter   #src.apps.auth.models.sessions_modelr[   %src.apps.auth.schemas.session_schemasr   0src.apps.role_permission.models.permission_modelr   4src.apps.role_permission.services.permission_servicer   rn   r   src.apps.user.models.user_modelr   "src.apps.user.schemas.user_schemasr   src.core.configr   src.core.dependenciesr   src.utils.enumsr   src.utils.helpers.authr   	getLoggerrJ   r   r%   rN   rM   r(   r-   r/   rR   r_   r   r   r   r   rk   r)   r'   <module>r      s   (  2 2 & & 3 3 E "  G ? G U N 1 ? $ ( + 6			8	$H:&A?C ?# ?$ ?& & &
 >
 0 %WV_		+2	m	 %WV_FF+2FFR
 
B ""23&/  *,-WV_FF3:FFr)   