member/member-backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(security): enforce admin allowlist guard on admin APIs and attach bearer for admin client

Browse Source
This commit is contained in:
Chris
2026-03-30 21:25:57 +08:00
parent 0cd863f9c2
commit 0e17997e66
8 changed files with 65 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
app/security/authentik_jwt.py
View File

@@ -63,7 +63,7 @@ class AuthentikTokenVerifier:
return None
def _enrich_from_userinfo(self, principal: AuthentikPrincipal, token: str) -> AuthentikPrincipal:
if principal.email and (principal.name or principal.preferred_username):
if principal.email and (principal.name or principal.preferred_username) and principal.groups:
return principal
if not self.userinfo_endpoint:
return principal
@@ -91,11 +91,16 @@ class AuthentikTokenVerifier:
preferred_username = principal.preferred_username or (
data.get("preferred_username") if isinstance(data.get("preferred_username"), str) else None
)
groups = principal.groups
payload_groups = data.get("groups")
if isinstance(payload_groups, list):
groups = [str(g) for g in payload_groups if str(g)]
return AuthentikPrincipal(
sub=principal.sub,
email=email,
name=name,
preferred_username=preferred_username,
groups=groups,
)
def verify_access_token(self, token: str) -> AuthentikPrincipal:
@@ -142,6 +147,7 @@ class AuthentikTokenVerifier:
email=claims.get("email"),
name=claims.get("name"),
preferred_username=claims.get("preferred_username"),
groups=[str(g) for g in claims.get("groups", []) if str(g)] if isinstance(claims.get("groups"), list) else [],
)
return self._enrich_from_userinfo(principal, token)