
    9j	              	          d Z ddlmZmZ ddlmZ ddlmZmZm	Z	m
Z
 ddlmZmZ ddlmZ ddlmZ ddlmZ dd	lmZ dd
lmZ ddlmZmZ  e       Zdee ee      f   dee ee      f   defdZdefdZ	 ddee e eej<                              f   deedz   ed      f   defdZ ee e eej<                              f   Z!ee ee       f   Z"ee e eej<                  ejF                              f   Z$ee ee      f   Z%y)z.FastAPI dependencies for auth and permissions.    )	AnnotatedOptional)UUID)DependsHeaderHTTPExceptionstatus)HTTPAuthorizationCredentials
HTTPBearer)select)AsyncSession)get_db)decode_token)verify_totp)UserUserRolecredentialsdbreturnc                   K   	 t        | j                        }|j                  d      dk7  rt        dd      |j                  d      }|j                  t        t              j                  t        j                  t        |      k(               d {   }|j                         }|r|j                  st        dd      |S # t        $ r t        dd      w xY w7 Kw)	Ntypeaccessi  zInvalid token typestatus_codedetailsubzInvalid credentialszUser not found or inactive)r   r   getr   
ValueErrorexecuter   r   whereidr   scalar_one_or_none	is_active)r   r   payloaduser_idresultusers         6C:\xampp\htdocs\tradingbinance\backend\app\api\deps.pyget_current_userr)      s     K{667;;v(*C8LMM++e$ ::fTl00DM1IJKKF$$&Dt~~4PQQK  K4IJJK Ls*   C#AC A
C#C!1C#CC#rolesc                  X     dt         t        t        t              f   dt        f fd}|S )Nr'   r   c                 F   K   | j                   vrt        dd      | S w)Ni  zInsufficient permissionsr   )roler   )r'   r*   s    r(   checkerzrequire_role.<locals>.checker'   s&     99E!C8RSSs   !)r   r   r   r)   )r*   r.   s   ` r(   require_roler/   &   s-    IdG4D,E&EF 4 
 N    Nr'   	totp_codezX-TOTP-Code)aliasc                    K   | j                   r| j                  st        t        j                  d      |rt        | j                  |      st        t        j                  d      | S w)zBRequire admin role plus a valid TOTP code for critical operations.z2FA is required for this actionr   zInvalid 2FA code)totp_enabledtotp_secretr   r	   HTTP_403_FORBIDDENr   )r'   r1   s     r(   require_admin_2far7   /   sf     
 D$4$4114
 	
 K(8(8)D11%
 	
 Ks   A)A+)N)&__doc__typingr   r   uuidr   fastapir   r   r   r	   fastapi.securityr
   r   
sqlalchemyr   sqlalchemy.ext.asyncior   app.core.databaser   app.core.securityr   app.core.totpr   
app.modelsr   r   securityr)   r/   ADMINstrr7   RequireAdminRequireAdmin2FAANALYSTRequireAnalystRequireViewer r0   r(   <module>rL      s8   4 &  : : E  / $ * % %<79JJK,/0 
&  EI
D',x~~">??
@tV-%@@A 
$ w|HNN'CDDED'*;"<<=4hnnhFVFV)W!XXY$(8 99:r0   