59 lines
2.1 KiB
Python
59 lines
2.1 KiB
Python
# ruff: noqa: F401,F403,F405,I001
|
|
from ._runtime import * # noqa: F403,F405
|
|
|
|
|
|
def _require_admin_user_id(request: web.Request) -> int:
|
|
"""Return the authenticated user id, or raise 401/403 for non-admins."""
|
|
|
|
from bot.app.web.session import extract_authenticated_user_id
|
|
|
|
settings: Settings = request.app["settings"]
|
|
user_id = extract_authenticated_user_id(request)
|
|
if not user_id:
|
|
raise web.HTTPUnauthorized(
|
|
text=json.dumps({"ok": False, "error": "unauthorized"}),
|
|
content_type="application/json",
|
|
)
|
|
|
|
admin_ids = settings.ADMIN_IDS or []
|
|
db_user_telegram_id = request.get("admin_telegram_id")
|
|
if db_user_telegram_id is None:
|
|
raise web.HTTPForbidden(
|
|
text=json.dumps({"ok": False, "error": "forbidden"}),
|
|
content_type="application/json",
|
|
)
|
|
|
|
if int(db_user_telegram_id) not in {int(x) for x in admin_ids}:
|
|
raise web.HTTPForbidden(
|
|
text=json.dumps({"ok": False, "error": "forbidden"}),
|
|
content_type="application/json",
|
|
)
|
|
return int(user_id)
|
|
|
|
|
|
@web.middleware
|
|
async def admin_auth_middleware(request: web.Request, handler):
|
|
"""Resolve the Telegram id of the current user and stash it on the request.
|
|
|
|
Doing this once per request lets every admin route call
|
|
``_require_admin_user_id`` without re-querying the DB.
|
|
"""
|
|
|
|
if not request.path.startswith("/api/admin"):
|
|
return await handler(request)
|
|
|
|
from bot.app.web.session import extract_authenticated_user_id
|
|
|
|
user_id = extract_authenticated_user_id(request)
|
|
if user_id:
|
|
async_session_factory: sessionmaker = request.app["async_session_factory"]
|
|
async with async_session_factory() as session:
|
|
db_user = await user_dal.get_user_by_id(session, user_id)
|
|
if db_user and db_user.telegram_id:
|
|
request["admin_telegram_id"] = int(db_user.telegram_id)
|
|
elif db_user:
|
|
# No telegram_id yet (email-only user) — can't be an admin
|
|
request["admin_telegram_id"] = None
|
|
|
|
return await handler(request)
|