Initial commit

Backend/Auth.py

@@ -0,0 +1,53 @@
+from __future__ import annotations
+
+import secrets
+
+from typing import Any
+
+from fastapi import Depends, HTTPException, Request
+
+from Users import GetUser
+
+
+# In-memory only for now: sessions don't survive a container restart, so
+# everyone just logs in again. Fine for a handful of trusted tailnet users;
+# worth revisiting if that stops being true.
+ActiveSessions: dict[str, str] = {}
+
+SessionCookieName = "SaraViewSession"
+
+
+def CreateSession(Username: str) -> str:
+    Token = secrets.token_urlsafe(32)
+    ActiveSessions[Token] = Username
+    return Token
+
+
+def DeleteSession(Token: str) -> None:
+    ActiveSessions.pop(Token, None)
+
+
+def GetCurrentUser(request: Request) -> dict[str, Any]:
+    Token = request.cookies.get(SessionCookieName)
+    Username = ActiveSessions.get(Token) if Token else None
+
+    if Username is None:
+        raise HTTPException(status_code=401, detail="Not logged in.")
+
+    User = GetUser(Username)
+
+    if User is None:
+        raise HTTPException(status_code=401, detail="Session user no longer exists.")
+
+    return {
+        "Username": Username,
+        "IsAdmin": User.get("IsAdmin", False),
+        "Colour": User.get("Colour", "Purple"),
+    }
+
+
+def RequireAdmin(CurrentUser: dict = Depends(GetCurrentUser)) -> dict:
+    if not CurrentUser.get("IsAdmin"):
+        raise HTTPException(status_code=403, detail="Admin access required.")
+
+    return CurrentUser