74 lines
2.8 KiB
Python
74 lines
2.8 KiB
Python
from fastapi import APIRouter, Depends, HTTPException
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
from app.database import get_db
|
|
from app.schemas.user import TokenResponse, WecomLoginRequest, CasdoorLoginRequest, WecomBindRequest
|
|
from app.services.auth import (
|
|
exchange_casdoor_code, get_or_create_user_from_casdoor,
|
|
get_user_by_wecom_id, bind_wecom_user, build_token_for_user,
|
|
)
|
|
from app.services.wecom import wecom_client
|
|
from app.config import settings
|
|
|
|
router = APIRouter(prefix="/auth", tags=["Authentication"])
|
|
|
|
|
|
@router.post("/casdoor-login", response_model=TokenResponse)
|
|
async def casdoor_login(req: CasdoorLoginRequest, db: AsyncSession = Depends(get_db)):
|
|
"""Standard Casdoor OIDC login — exchange code for userinfo, get or create user, return JWT."""
|
|
userinfo = await exchange_casdoor_code(req.code)
|
|
if not userinfo:
|
|
raise HTTPException(status_code=400, detail="Failed to exchange code with Casdoor")
|
|
|
|
casdoor_id = userinfo.get("sub") or userinfo.get("id")
|
|
if not casdoor_id:
|
|
raise HTTPException(status_code=400, detail="Invalid userinfo from Casdoor")
|
|
|
|
name = userinfo.get("name") or userinfo.get("preferred_username") or casdoor_id
|
|
role = userinfo.get("role", "manager")
|
|
|
|
user = await get_or_create_user_from_casdoor(db, casdoor_id, name, role)
|
|
token = build_token_for_user(user)
|
|
|
|
return TokenResponse(
|
|
access_token=token,
|
|
user_id=str(user.id),
|
|
name=user.name,
|
|
role=user.role,
|
|
)
|
|
|
|
|
|
@router.post("/wecom-login")
|
|
async def wecom_login(req: WecomLoginRequest, db: AsyncSession = Depends(get_db)):
|
|
"""WeChat Work silent login — exchange wecom code for userid, find bound user, return JWT."""
|
|
userinfo = await wecom_client.get_userinfo_by_code(req.code)
|
|
if not userinfo:
|
|
raise HTTPException(status_code=400, detail="Failed to exchange wecom code")
|
|
|
|
wecom_userid = userinfo.get("UserId") or userinfo.get("userid")
|
|
if not wecom_userid:
|
|
raise HTTPException(status_code=400, detail="Could not get userid from wecom")
|
|
|
|
user = await get_user_by_wecom_id(db, wecom_userid)
|
|
if user:
|
|
token = build_token_for_user(user)
|
|
return TokenResponse(
|
|
access_token=token,
|
|
user_id=str(user.id),
|
|
name=user.name,
|
|
role=user.role,
|
|
)
|
|
|
|
raise HTTPException(
|
|
status_code=403,
|
|
detail="企业微信账号尚未绑定。请在企业微信内使用一次性绑定链接完成绑定。",
|
|
)
|
|
|
|
|
|
@router.post("/bind-wecom")
|
|
async def bind_wecom(req: WecomBindRequest, db: AsyncSession = Depends(get_db)):
|
|
"""Deprecated unsafe binding flow. Use /wecom/bind-confirm with a one-time token."""
|
|
raise HTTPException(
|
|
status_code=410,
|
|
detail="该绑定接口已停用，请使用企业微信一次性绑定链接。",
|
|
)
|