103 lines
3.5 KiB
Python
103 lines
3.5 KiB
Python
from urllib.parse import urljoin
|
|
|
|
import httpx
|
|
from fastapi import APIRouter, HTTPException, status
|
|
|
|
from app.core.config import get_settings
|
|
from app.schemas.login import LoginRequest, LoginResponse
|
|
|
|
router = APIRouter(prefix="/auth", tags=["auth"])
|
|
|
|
|
|
def _resolve_username_by_email(settings, email: str) -> str | None:
|
|
if not settings.authentik_base_url or not settings.authentik_admin_token:
|
|
return None
|
|
|
|
url = urljoin(settings.authentik_base_url.rstrip("/") + "/", "api/v3/core/users/")
|
|
try:
|
|
resp = httpx.get(
|
|
url,
|
|
params={"email": email},
|
|
timeout=10,
|
|
verify=settings.authentik_verify_tls,
|
|
headers={
|
|
"Authorization": f"Bearer {settings.authentik_admin_token}",
|
|
"Accept": "application/json",
|
|
},
|
|
)
|
|
except Exception:
|
|
return None
|
|
|
|
if resp.status_code >= 400:
|
|
return None
|
|
|
|
data = resp.json()
|
|
results = data.get("results") if isinstance(data, dict) else None
|
|
if not isinstance(results, list) or not results:
|
|
return None
|
|
|
|
username = results[0].get("username")
|
|
return username if isinstance(username, str) and username else None
|
|
|
|
|
|
@router.post("/login", response_model=LoginResponse)
|
|
def login(payload: LoginRequest) -> LoginResponse:
|
|
settings = get_settings()
|
|
client_id = settings.authentik_client_id or settings.authentik_audience
|
|
|
|
if not settings.authentik_base_url or not client_id or not settings.authentik_client_secret:
|
|
raise HTTPException(status_code=status.HTTP_503_SERVICE_UNAVAILABLE, detail="authentik_login_not_configured")
|
|
|
|
token_endpoint = settings.authentik_token_endpoint or urljoin(
|
|
settings.authentik_base_url.rstrip("/") + "/", "application/o/token/"
|
|
)
|
|
|
|
form = {
|
|
"grant_type": "password",
|
|
"client_id": client_id,
|
|
"client_secret": settings.authentik_client_secret,
|
|
"username": payload.username,
|
|
"password": payload.password,
|
|
"scope": "openid profile email",
|
|
}
|
|
|
|
def _token_request(form_data: dict[str, str]) -> httpx.Response:
|
|
resp = httpx.post(
|
|
token_endpoint,
|
|
data=form_data,
|
|
timeout=10,
|
|
verify=settings.authentik_verify_tls,
|
|
headers={"Content-Type": "application/x-www-form-urlencoded"},
|
|
)
|
|
return resp
|
|
|
|
try:
|
|
resp = _token_request(form)
|
|
except Exception as exc:
|
|
raise HTTPException(status_code=status.HTTP_502_BAD_GATEWAY, detail="authentik_unreachable") from exc
|
|
|
|
# If user entered email, try resolving username and retry once.
|
|
if resp.status_code >= 400 and "@" in payload.username:
|
|
resolved = _resolve_username_by_email(settings, payload.username)
|
|
if resolved and resolved != payload.username:
|
|
form["username"] = resolved
|
|
try:
|
|
resp = _token_request(form)
|
|
except Exception as exc:
|
|
raise HTTPException(status_code=status.HTTP_502_BAD_GATEWAY, detail="authentik_unreachable") from exc
|
|
|
|
if resp.status_code >= 400:
|
|
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="invalid_username_or_password")
|
|
|
|
data = resp.json()
|
|
token = data.get("access_token")
|
|
if not token:
|
|
raise HTTPException(status_code=status.HTTP_502_BAD_GATEWAY, detail="authentik_missing_access_token")
|
|
|
|
return LoginResponse(
|
|
access_token=token,
|
|
token_type=data.get("token_type", "Bearer"),
|
|
expires_in=data.get("expires_in"),
|
|
scope=data.get("scope"),
|
|
)
|