Jeroen SchweitzerandClaude Opus 4.5
7752cd9d23
Architecture changes: - Permission format: domain.category:action (e.g., control-room.general:admin) - Decoupled groups from roles via group_roles mapping table - Groups are organizational (synced from Authentik) - Roles are permissions (admin-managed via API) New features: - require_permission() and require_any_permission() dependency factories - Action hierarchy: admin > editor > user > viewer - Global admin override (admin.general:admin grants all) - Group-role management endpoints (assign/remove roles) - GET /auth/roles endpoint to list all roles Database changes: - Added category column to roles table (default: general) - Removed authentik_group column (decoupled) - Added group_roles association table - Added user_groups association table - Migration updates role names to domain.general:action format Tests: - 67 new tests for auth service and controller - Covers token validation, user sync, role sync - Covers group-role assignment/removal - Covers schema conversions and permission system 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
63 lines
1.3 KiB
Python
63 lines
1.3 KiB
Python
"""
|
|
Authentication Domain
|
|
|
|
Provides OIDC/OAuth2 authentication via Authentik, user management,
|
|
roles, groups, and API key authentication.
|
|
"""
|
|
from src.domains.auth.oidc import (
|
|
get_current_user,
|
|
get_admin_user,
|
|
get_optional_user,
|
|
get_forward_auth_user,
|
|
get_forward_auth_admin,
|
|
oidc_config,
|
|
# Permission system
|
|
require_permission,
|
|
require_any_permission,
|
|
ACTION_HIERARCHY,
|
|
VALID_DOMAINS,
|
|
DEFAULT_CATEGORY,
|
|
)
|
|
from src.domains.auth.service import AuthService, get_auth_service
|
|
from src.domains.auth.controller import auth_controller
|
|
from src.domains.auth.models import (
|
|
User,
|
|
Role,
|
|
UserRole,
|
|
Group,
|
|
UserPreferences,
|
|
ApiKey,
|
|
user_groups,
|
|
group_roles,
|
|
)
|
|
|
|
__all__ = [
|
|
# OIDC dependencies
|
|
"get_current_user",
|
|
"get_admin_user",
|
|
"get_optional_user",
|
|
"get_forward_auth_user",
|
|
"get_forward_auth_admin",
|
|
"oidc_config",
|
|
# Permission system
|
|
"require_permission",
|
|
"require_any_permission",
|
|
"ACTION_HIERARCHY",
|
|
"VALID_DOMAINS",
|
|
"DEFAULT_CATEGORY",
|
|
# Service
|
|
"AuthService",
|
|
"get_auth_service",
|
|
# Controller
|
|
"auth_controller",
|
|
# Models
|
|
"User",
|
|
"Role",
|
|
"UserRole",
|
|
"Group",
|
|
"UserPreferences",
|
|
"ApiKey",
|
|
"user_groups",
|
|
"group_roles",
|
|
]
|