Decouple API auth method #298
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
florimondmanca
added
refactor
florimondmanca
force-pushed
the
fm/refactor-auth-backend
branch
4 times, most recently
from
4694d64 to
9444431
Compare
florimondmanca
force-pushed
the
fm/refactor-auth-backend
branch
7 times, most recently
from
4b19b8b to
df7d964
Compare
florimondmanca
force-pushed
the
fm/refactor-auth-backend
branch
from
df7d964 to
1ec3d80
Compare
This was referenced Nov 9, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Actuellement, la vérification des permissions et la méthode d'authentification sont couplés. En effet,
current_user()authentifie l'utilisateur à partir duBearertoken dans la requête, mais on l'utilise aussi pour les permissions :IsAuthenticated,HasRole.Il faut découpler ces deux aspects. Je m'en suis rendu compte en regardant à #294 : si on implémentait une authentification "DataPass" (via auth.api.gouv), on emploierait une autre méthode (passage par le serveur OpenID Connect) mais il faut que la logique des permissions ne change pas.
Cette PR refactor le code pour utiliser le mécanisme de
AuthenticationBackendde Starlette. Ainsi, la logique decurrent_user()migre vers unTokenAuthBackend, et celui-ci est branché à unAuthMiddleware. On a alors accès àrequest.userdans les routes avec une interface unique indépendante du backend, ce qui n'était pas le cas avant, et c'est là-dessus que se basent les utilitaires de permissions.