+
    PB.j	                        R t ^ RIHtHt ^ RIHt ^ RIHtHtH	t	H
t
 ^ RIHtHt ^ RIHt ^ RIHt ^ RIHt ^ RIHt ^ R	IHt ^ R
IHtHt ]! 4       tR R ltR R ltRR R llt]]]! ]! ]P>                  4      4      3,          t ]]]! ]4      3,          t!]]]! ]! ]P>                  ]PD                  4      4      3,          t#]]]! ]4      3,          t$R# )z.FastAPI dependencies for auth and permissions.)	AnnotatedOptional)UUID)DependsHeaderHTTPExceptionstatus)HTTPAuthorizationCredentials
HTTPBearer)select)AsyncSession)get_db)decode_token)verify_totp)UserUserRolec                    V ^8  d   QhR\         \        \        \        4      3,          R\         \        \        \
        4      3,          R\        /# )   credentialsdbreturn)r   r	   r   securityr   r   r   )formats   "app\api\deps.py__annotate__r      sD      79JJK,/0 
    c                   "    \        V P                  4      pVP                  R 4      R8w  d   \        RRR7      hVP                  R4      pTP                  \        \        4      P                  \        P                  \        T4      8H  4      4      G Rj  xL
 pTP                  4       pT'       d   TP                  '       g   \        RRR7      hT#   \         d    \        RRR7      hi ; i LY5i)	typeaccessi  zInvalid token typestatus_codedetailsubzInvalid credentialsNzUser not found or inactive)r   r   getr   
ValueErrorexecuter   r   whereidr   scalar_one_or_none	is_active)r   r   payloaduser_idresultusers   &&    r   get_current_userr.      s     K{667;;v(*C8LMM++e$ ::fTl00DM1IJKKF$$&Dt~~~4PQQK  K4IJJK Ls6   C3A	C A
C3C1C34C3C3C..C3c                $    V ^8  d   QhR\         /# )r   roles)r   )r   s   "r   r   r   &   s       r   c                     a  R  V 3R llpV# )c                d    V ^8  d   QhR\         \        \        \        4      3,          R\        /# )r   r-   r   )r   r   r   r.   )r   s   "r   r   "require_role.<locals>.__annotate__'   s*      IdG4D,E&EF 4 r   c                 L   <"   V P                   S9  d   \        R RR7      hV # 5i)i  zInsufficient permissionsr   )roler   )r-   r0   s   &r   checkerrequire_role.<locals>.checker'   s%     99E!C8RSSs   !$ )r0   r6   s   j r   require_roler9   &   s     
 Nr   Nc          	          V ^8  d   QhR\         \        \        \        \        P
                  4      4      3,          R\         \        R,          \        RR7      3,          R\        /# )r   r-   	totp_codeNzX-TOTP-Code)aliasr   )r   r   r   r9   r   ADMINstrr   )r   s   "r   r   r   /   sQ      
D',x~~">??
@tV-%@@A 
r   c                
  "   V P                   '       d   V P                  '       g   \        \        P                  RR7      hV'       d   \        V P                  V4      '       g   \        \        P                  RR7      hV # 5i)zBRequire admin role plus a valid TOTP code for critical operations.z2FA is required for this actionr   zInvalid 2FA code)totp_enabledtotp_secretr   r   HTTP_403_FORBIDDENr   )r-   r;   s   &&r   require_admin_2farC   /   sn     
 D$4$4$4114
 	
 K(8(8)DD11%
 	
 Ks   $B"B
9B)N)%__doc__typingr   r   uuidr   fastapir   r   r   r   fastapi.securityr	   r
   
sqlalchemyr   sqlalchemy.ext.asyncior   app.core.databaser   app.core.securityr   app.core.totpr   
app.modelsr   r   r   r.   r9   rC   r=   RequireAdminRequireAdmin2FAANALYSTRequireAnalystRequireViewerr8   r   r   <module>rT      s    4 &  : : E  / $ * % %<&$ w|HNN'CDDED'*;"<<=4hnnhFVFV)W!XXY$(8 99:r   