130 lines
3.9 KiB
Python
130 lines
3.9 KiB
Python
from sqlalchemy import func, select
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.core.security import hash_password, verify_password
|
|
from app.models.role import Role
|
|
from app.models.user import AUTH_SOURCE_LDAP, AUTH_SOURCE_LOCAL, User
|
|
|
|
|
|
async def get(db: AsyncSession, user_id: int) -> User | None:
|
|
return await db.get(User, user_id)
|
|
|
|
|
|
async def get_by_email(db: AsyncSession, email: str) -> User | None:
|
|
result = await db.execute(select(User).where(User.email == email))
|
|
return result.scalar_one_or_none()
|
|
|
|
|
|
async def get_by_username(db: AsyncSession, username: str) -> User | None:
|
|
result = await db.execute(select(User).where(User.username == username))
|
|
return result.scalar_one_or_none()
|
|
|
|
|
|
async def list_users(db: AsyncSession, skip: int = 0, limit: int = 100) -> list[User]:
|
|
result = await db.execute(select(User).order_by(User.id).offset(skip).limit(limit))
|
|
return list(result.scalars().all())
|
|
|
|
|
|
async def count(db: AsyncSession) -> int:
|
|
result = await db.execute(select(func.count()).select_from(User))
|
|
return result.scalar_one()
|
|
|
|
|
|
async def _resolve_roles(db: AsyncSession, role_ids: list[int]) -> list[Role]:
|
|
if not role_ids:
|
|
return []
|
|
result = await db.execute(select(Role).where(Role.id.in_(role_ids)))
|
|
return list(result.scalars().all())
|
|
|
|
|
|
async def create(
|
|
db: AsyncSession,
|
|
*,
|
|
email: str,
|
|
password: str | None = None,
|
|
full_name: str | None = None,
|
|
is_superuser: bool = False,
|
|
role_ids: list[int] | None = None,
|
|
username: str | None = None,
|
|
auth_source: str = AUTH_SOURCE_LOCAL,
|
|
) -> User:
|
|
user = User(
|
|
email=email,
|
|
username=username,
|
|
hashed_password=hash_password(password) if password else None,
|
|
auth_source=auth_source,
|
|
full_name=full_name,
|
|
is_superuser=is_superuser,
|
|
roles=await _resolve_roles(db, role_ids or []),
|
|
)
|
|
db.add(user)
|
|
await db.commit()
|
|
await db.refresh(user)
|
|
return user
|
|
|
|
|
|
async def get_or_create_ldap_user(
|
|
db: AsyncSession,
|
|
*,
|
|
username: str,
|
|
email: str,
|
|
full_name: str | None,
|
|
role_ids: list[int] | None = None,
|
|
) -> User:
|
|
"""Find an LDAP user by username, provisioning a local profile on first login.
|
|
|
|
The profile is keyed on the LDAP username; email is synthesized by the
|
|
caller. Newly provisioned users get ``role_ids`` (the default role).
|
|
"""
|
|
user = await get_by_username(db, username)
|
|
if user is not None:
|
|
# Keep the display name in sync with LDAP on subsequent logins.
|
|
if full_name and user.full_name != full_name:
|
|
user.full_name = full_name
|
|
await db.commit()
|
|
await db.refresh(user)
|
|
return user
|
|
return await create(
|
|
db,
|
|
email=email,
|
|
username=username,
|
|
full_name=full_name,
|
|
auth_source=AUTH_SOURCE_LDAP,
|
|
role_ids=role_ids,
|
|
)
|
|
|
|
|
|
async def update(db: AsyncSession, user: User, data: dict) -> User:
|
|
if "password" in data and data["password"]:
|
|
user.hashed_password = hash_password(data.pop("password"))
|
|
else:
|
|
data.pop("password", None)
|
|
|
|
if "role_ids" in data and data["role_ids"] is not None:
|
|
user.roles = await _resolve_roles(db, data.pop("role_ids"))
|
|
else:
|
|
data.pop("role_ids", None)
|
|
|
|
for field, value in data.items():
|
|
if value is not None:
|
|
setattr(user, field, value)
|
|
|
|
await db.commit()
|
|
await db.refresh(user)
|
|
return user
|
|
|
|
|
|
async def delete(db: AsyncSession, user: User) -> None:
|
|
await db.delete(user)
|
|
await db.commit()
|
|
|
|
|
|
async def authenticate(db: AsyncSession, email: str, password: str) -> User | None:
|
|
user = await get_by_email(db, email)
|
|
# LDAP users have no local password and must sign in via LDAP.
|
|
if not user or not user.hashed_password:
|
|
return None
|
|
if not verify_password(password, user.hashed_password):
|
|
return None
|
|
return user
|