From ef36fba1c1ab2deee2531ed24985907411fb229c Mon Sep 17 00:00:00 2001 From: root Date: Fri, 28 Nov 2025 10:42:33 +0100 Subject: [PATCH] Authentication variables are now in the env file --- __pycache__/app.cpython-310.pyc | Bin 9908 -> 9812 bytes __pycache__/security.cpython-310.pyc | Bin 3098 -> 2954 bytes app.old | 4 +- app.py | 13 ++++++- config_env.py | 15 ++++++++ routes/__pycache__/reslevis.cpython-310.pyc | Bin 4383 -> 4281 bytes routes/reslevis.py | 39 ++++++-------------- security.py | 23 ++++++++---- 8 files changed, 55 insertions(+), 39 deletions(-) create mode 100644 config_env.py diff --git a/__pycache__/app.cpython-310.pyc b/__pycache__/app.cpython-310.pyc index e03e6507dc9b92dc08369eed6904c34b15a92cc1..73e74877b5bd29288f8b20ad7e3dd2faa1d557f3 100644 GIT binary patch delta 1389 zcmZXUOHi9t6vuPFFVF}C2yeR0^eVOXFgig&|>N<5nm)1q< z26aQX*2V1YfgY_()J^JzUh0E*AN4~&4Zr{m!k|u;sv#PNVXe#5EgFFlt;^MI8ii3B zgE1XfC?Ac(xYm_wf+k^-{NSf4n9}U3xT7a;y$uN^eCbdkKV42A>lNBa)Ozy!dlT{{bOzN2ctTS0>vcbg7HZ{ zvJSl{^wXNOgTfZ6A|#F2KDJ>yc3@}HPbc2f3122LjuX1zedfnFiT=w1St|o4 z`utH7r|?cfaP0@$GySFq1s~`x2DIx#Js~JZv@eu2aRz78Gve@6r{?6aPR-+joZJ(8 z0>erB<-n-GMfp+Gz$IKxWbw$4b;XJtf88wOyN9cKTwFWWAL*CRtXEvv{rgAcwO^RN{o@PkZ~OO#6?Rk_f>J8yTs%$X=l&v|r~b_SLVRj{ zo;Ph|pK{@$C-qffjb$%*Da1?bRpD=@_|E#QRWet^w4UualD}NNC(OR!E?4sA& ztovPv)zp;RBNC~H?m!;o>>TVz_jV(4|B3aD+hw-9g8sFM(3~$A@hvY+N0!4OaAZ_b sCb={h^v_y9cwD05XWqnNbBOelXI2P@!OF-pQvWoC%xp(?%GZ4OAJDCcKk9RjK_8Ds|bzp|FWmsqg98-~FBMp6|T7c&{g3 zO*#{Wg?To*e#&>nzwCYCtP)?mXo0jt6>29qg$-?(qb}+^ITP~%b{Gmz{TrJ>WZ#_3f6h*s&<20S3)JP^Hr6uhH6~{HM$mRwFf-f z3*Iyr3)D4T2X(9qRlRP22G&k>T{l7_>&xnfZh|J(MXFi1K#OjLR^0||%!-vyn_#jo zQSI6fe%7Vr?SKx}WvWwmL6`1^ZruYtx);*Dx)1ueSg!hY00OLC>ZTrm0oGU4Ej zdI*MiU7>F4AOu-oRd@6-4C@gX(W5ZR%&qR~F&JZAsm65(LOKj#URSAmdIBbeO-^o4 z!8F>^SWRdKW(my_nxkW`Au7oF5~(F}AC`zL5m_eUA@Tr#2oPBz;wADBR*9?< zStD|dj{M}f*I}K*>(nD1fe7h(*uVye%7{#F$S7XNM!fOTz^05HP#Q;4#*PJSVl!;X z8f-zqcWcH0acq|H^=)ZvKgKrnp^5DoJ4G5t3jN1|T6b&;&@#TgBmGii^U0c@&P)#Z z;ztP?J{H&|P3)H8m?Mon*n8-BE?}36PvrDT6IOHQYWZ9(o~xBpwf#h{VITHWNPq{4 zA0_c71q|S=LmPG7qfwGLh(qMKoiQ+ocbKP`4`ceQFoL68cuIwRyo+O}8)UT%J?Hn2 z*>N00hk}~E!=CWl9uzSL-opuYy~`1ka)5nP89Pqn3}+m0WmX1oEKM0=D>Aa zeS{I|L3*oy8|L7K^ipsXk%K>^O=(=_E%S1OhU8)Cca*ezX~$T`em=}5ZgJE{DCTWV zaqADq8zVinl}hdI1x(Z5-{JH3^!fb0&VawYy}iRs%81f?W^g9to0rLbne?edG@{Ji zWFnP_CX|`jl{;~4izaqow_=qIJ1ciS-h);+R3*r=c*Pr;#4tsV` zpa>GFkWxh3Q3X0GiZs+Tlr&UVAWB3@0UcuY5CJ0YbWgMMX6Eh8&GYQDjMa+A4F#Sr zl|p?pzHRlROWUK98`#l_P8Aw*qOL&<*CZxV;H)|^H%{WNMJzW#5`i!5B;6EAxm~0S zDNNhxrrHZcdYHbFCTYN4(#yg-85*Jb3rw?igvJG;2JbnzyS$TGTwsDx1&6!O}tp;mefLQMk0Dgjz1)br&S4ZM(B#usttC6|OB?#fC z0ScH0cA&Jcp``4m+~J%x+jhre{1zm5T2NgJS%{wzA0zj*DOoEg&gr{oT71*zkL{Hy zU>_I9eZ*fOU#%^}MgL68C^>bnU2eIn(^T;2(yvLWd_cU9X3>=R939I}%gQqnf&oX$ zHCApgeou@U7jB%9ek@^9LI?nw2~uXIBapfxtspth*@I4>x;cIQulLChI%y;(l*)L||>FL}9>d{R6% zhi(VkQS`GF(l~O>4h@?>krb-%@Mp>z~tet1Yva{uT|eHQfN^R-PL~k&HLuPH}l^6cJjM& zA;{-V1)s^^{uq9pJ1tbn*6Dl8$Es_189U>dwn-GGFwM<+IXma&?Yvj83yCe|j(J79 z=#}geQ9yrnh3T(}Jr1c?6D-Y)*VMk6@C-ANUrTtF<&aPADlGpavCEKtR$&D;#)>D@ zo?^5=4H^)r9s?cFic(QvhLze16xkIvenRY7HX-G6bwJrwcI~BR&#_6U{!7tVnN?7^ z{vXN|n?~gZ6kzrnG9au9rAxjutTOvDW!KmoR58hQb^{&e8SN_dnm8mU$77ubPw#I( z-01W+yWO1!kDs@OQM4bfHk+-L+l|(p>{UEqhn8*bqA z-MI8N#@3Tgx3}|n`}xEF8RgxJFwK1)M1d2y&0rt=5nFNs-v=jZI>4jwj8aM#D%jpw zcZ1zs;ITIH2LT_Grc_Vni`89-VsS^Uk$Le{y;Z5978Vfb3xgI(kr?=Dgx@^-K^-UA zIaK&f2^H~+w)nw2NaOSn`V4r;7jb24&%W9VV|5RX_`KYhz=GUo^e|Zuge1k+ z7X^FZuZdH=PTJy)zV*?XbZ#TmDNlG3?b1Pu@|?~A=io=ZgAn+~=n(1%^o6b#2wxZ5 z=`ZwE8EabnoIWFW1v5IWw_)lurVT45{3jA?!#*D7q6%i)9fgq-c>C+0i{Fi%^9pEu zPON3hWL12YSt{R^k?%=J3YT_<;Oqh45#MJ%{A69)se}~?Dgs_6aoLiFB-N&5iF2OA zmj@#bJs!9aev0-`Lue2!$2&;s3&Juj;hK+Ds<@1Gygc}a=WURq!jrBnBeSy`;gRp$ zcSl$lJ}WgjUVKITY1aD5SXgo`>&ug4$^`%D%|#WAwimDi7uE^x2<6_XWYi2Cxe5GC Ts;QJvqWz_5=l`50{A~4aaw8R= diff --git a/app.old b/app.old index 466a9f4..1fc28eb 100644 --- a/app.old +++ b/app.old @@ -64,8 +64,8 @@ reslevis_router = _reslevis.router from fastapi import FastAPI, Security from fastapi.security import OAuth2AuthorizationCodeBearer -AUTH_URL = "https://192.168.1.3:10002/realms/API.Server.local/protocol/openid-connect/auth" -TOKEN_URL = "https://192.168.1.3:10002/realms/API.Server.local/protocol/openid-connect/token" +#AUTH_URL = "https://192.168.1.3:10002/realms/API.Server.local/protocol/openid-connect/auth" +#TOKEN_URL = "https://192.168.1.3:10002/realms/API.Server.local/protocol/openid-connect/token" oauth2 = OAuth2AuthorizationCodeBearer( authorizationUrl=AUTH_URL, diff --git a/app.py b/app.py index 7b2c16e..7cc6244 100644 --- a/app.py +++ b/app.py @@ -9,6 +9,9 @@ from typing import Any, Dict, List, Optional # import wave import os import shutil +# import enviroment variables +import config_env +#other from pathlib import Path from tempfile import NamedTemporaryFile from typing import Callable @@ -63,8 +66,14 @@ reslevis_router = _reslevis.router from fastapi import FastAPI, Security from fastapi.security import OAuth2AuthorizationCodeBearer -AUTH_URL = "https://192.168.1.3:10002/realms/API.Server.local/protocol/openid-connect/auth" -TOKEN_URL = "https://192.168.1.3:10002/realms/API.Server.local/protocol/openid-connect/token" +#AUTH_URL = "https://10.251.0.30:10002/realms/API.Server.local/protocol/openid-connect/auth" +#AUTH_URL = "https://192.168.1.3:10002/realms/API.Server.local/protocol/openid-connect/auth" +#TOKEN_URL = "https://10.251.0.30:10002/realms/API.Server.local/protocol/openid-connect/token" +#TOKEN_URL = "https://192.168.1.3:10002/realms/API.Server.local/protocol/openid-connect/token" + + +AUTH_URL = config_env.KEYCLOAK_AUTH_URL +TOKEN_URL = config_env.KEYCLOAK_TOKEN_URL oauth2 = OAuth2AuthorizationCodeBearer( authorizationUrl=AUTH_URL, diff --git a/config_env.py b/config_env.py new file mode 100644 index 0000000..3699f09 --- /dev/null +++ b/config_env.py @@ -0,0 +1,15 @@ +#This file reads the .env where the variables should be stored +import os +from dotenv import load_dotenv + +load_dotenv() + +SECRET = os.getenv("SECRET") +KEYCLOAK_AUDIENCE = os.getenv("KEYCLOAK_AUDIENCE") +KEYCLOAK_SERVER = os.getenv("KEYCLOAK_SERVER") +KEYCLOAK_ISSUER = os.getenv("KEYCLOAK_ISSUER") +KEYCLOAK_PROTOCOL_ENDPOINT = os.getenv("KEYCLOAK_PROTOCOL_ENDPOINT") +KEYCLOAK_JWKS_URL = os.getenv("KEYCLOAK_JWKS_URL") +KEYCLOAK_AUTH_URL = os.getenv("KEYCLOAK_AUTH_URL") +KEYCLOAK_TOKEN_URL = os.getenv("KEYCLOAK_TOKEN_URL") + diff --git a/routes/__pycache__/reslevis.cpython-310.pyc b/routes/__pycache__/reslevis.cpython-310.pyc index 291c2b79a03732f93077d54ec79acc03fd44c99a..220bbc37fb753969c960c7d009477db4aab41c0e 100644 GIT binary patch literal 4281 zcmbtX-E-4M5Z6hHV%f4|g7ZZJI0=L}K+HESp9v5?+D@Rrv>m-Dk?$AHNKJpK=wqHu+?y5cgMxvH(YnytCItuuVD*85z;HfXHX``whCa!uQG({|d; z*csQdEjMdt-JG3s2kZeiZ|4cC*AKaa_8^V>>WAHeU0{kB+*0fz!9Wg+;g=)a5Qa#N zDZIbRcDKv9a@WLNjpZ`9B9)W+5w&??Ge%*0&OPJ3RM)g7138;J*)D)j4R1r{<`~>orM0XPSn-Q58DnG?%-|4{O6riSg=>XImKTW6;fI7*~ z>_eRuGhl0;mkD)>Jf7Q!nh_~Lo#z(_HA|?AT~H>VF7eBRDiP{R7gQQhSNRu&nj_Sg zT~HRFuJP-HI!&k>T~Jv--Q>3jb%s#4yP$G_THuR>I!mZKT~Gsny36koYMxL_T~K*I z-RBPoRpt+$DWyj{c;-raXf8f^^wetwLWceKL{l`lA7&pufBt0Y=Za_sHLnpGe&7Tx zzr;fQo0=b#%+R{is?~X|QGFB$H%vXLJB?^$dksOO%mXJ7YtDK!c`lvGD!Ai>) zawA)YSMln6JM~ofb+KCWOKO;t!f$#FU#z$u7xhpNoT^_z8ah7=CU@casDr2~&y;Pp zysgM#nC*&B)8$o1mc3?BzVG+}P*|48pI)q}c|7bb_iZB&h8AR9^iX$K*^SB+onyT`p2Tn0(I(%cW#A`~G$6*|; ztetSZ#g1-bL&v~$#O@?Ip)`vVxi>GEC5fe}#0`$3SlTC~H!m1VY-lENGL25sxRrGB zdUIhWX66zHClUulWbY0lGxLdqljy)ILrsXYv7}1OLpcE=)N4>dDtM;j4<;a9KnJKf6LYwp!(J? zv{5FY`na*l{!so@_u|%+QvY(;?+V{{sv=Y$f4%cNENWW~Gf{0_sX$2z4K4zwR^Ryt zbf5A|QhHJpYYnK)4ewg9WXPki-cWNm57XZ{^_C!r#7Y%va8^PyDcZmSZga>)#|erK zPX|{Q0P+!wjB2D=n&nuYrGCk=L6GWy@-iqka^+T&!?A3i^*vl_0EoHt-y-^8F6Y`T z6#@-;e4}!0Q(aYLG0?fbsq#ML6~;z9-ox>&gkzoe^HiH-`b~@jj?HB`3#*VNTuP?l zHHv}sR-xDI{05B5)2O4|r2HwvH0IQZf|TbGf~*j!@*+YsVp3j$aj3a|^>aeAdk9(p zn2$v%rZmM;%!0oTVy}UEV;p*g>#fGbmS4xkug2em>D|d5#yhiDo&qzFSGzIGtMDcY zbAN=9w1da$c4z6yLk0tA8+w&Exra`oy@?x3PhMyzVoP4)W@$H;c4z6y z3&j$*sKm*Abdsj+rWVzc3lr%gGi!;12fGf4$le{0nb(PfhcH?$oeTS4z)jI<)+8Pa ziKR2DF?}!!jbObA*J)|M#LoMbpM>l9^YLX;_9Gfkku*_Y&6ODx7K$tiykE)z5cWvj ztJW$GT%y`n(RMA7@ZUDv7kvR2=31~W58*GUqZo8~m7xY5oGzzyg_L;FqdS$H#L*Or zX%yJiC3fCWM@Fepgj%x|NUUtw#_9r^7S&NK6m)3mXh}Q(5))Kn`bgYfiCZ9%rjFv% zaY%2#b-h&=&;p>cu7VgvRADM$V#U3=n8Pt0`M_ns`rN#kDZj9zy2etK{Bx9?-aLLsNX@AdF@?~84U z@+VHZe+Eo0!xR0iDGFCO^Ob-(EKnUa&>St$9i8EO)gK59$Dpz14+f@V29{$5IVTt7 zoqS+Bc2IB%LD4A&L(Wi8a!Q2N{o!E58KLojzbz;``8$2cQaDpmy?cLhT{cE&m^w`(Y~si?Ik2^PcZE(vcH31dZ}H-B>(v zSJKHt>DImzk|y@urjTwNrnCHm);EtuEhd$9#dl?p4(Ssdg4@xyvD;DDxG$Pvz5LtjLzg(@Jj#YT>KUqrrG_9FPUC`Hr^8wp(M@J(ADEW3{b_VUVV1>pe_k+3 zI+iLOH#42Rv=gR3FSwV?(BY1gS#*-aqohRa&xO@7bFAY4X-gdtk^MVJ&7A5u*pCh{ zvnlJ&J&|54AOxUfWYJksDK6!1Kqfk|_QQb0I}PRhBN(jaFf7-Uw+wC>jH@2| z3PMy@Vs&K?Q=Y-wRWsJO7VB%!6}kRKeZe@qf6ksTKn<)MZ=)13`BI7GdGYC^ebMZ20RU_B^Op zcR}w6!sU$E>JM2l^!T$Rw?5gxcz5*517HT?YJJc0EWAm#`QII;-qIb?=4hL=LseeD z4=Kym8xKVbwA-#levPm*C@zA4s)(_ab>9sO1-_N6_J6?IpQaYHSFL-&=B~bNH_$e;+HtagPSUf<8cknb=p-^rnC2-}H`e#k?lgUQp}n*Xz34c(iB58K z+|;uAa$zA|Waf3p!L4-%L}dRC$jnb22a7PeQ#qatK7yO0+w>%+g~ZaC)|depB}Tl` zgxj_>VB(ab+P5Nbqa#_HlY@xHERq%qthq9e!bVX*QA9BW!Wr|!x>s}IQq{hiwrhzj zfi^KC0rzPyUXjE21zuCrwqnqYRwf#>b-JoIW>L@$X+Mmd9Ccy3 zkS97)Or0aqnypx3sl&eJ3+Q50aj+yk-O^Q+=}?ySze@wU)it)) O$KzIsjcdK0GW!>}%aSwz diff --git a/routes/reslevis.py b/routes/reslevis.py index cbccc61..9362770 100644 --- a/routes/reslevis.py +++ b/routes/reslevis.py @@ -6,15 +6,11 @@ from schemas.reslevis import ( ) from logica_reslevis.gateway import GatewayJsonRepository -# importa le dipendenze di sicurezza -from security import get_current_user, require_roles +from security import get_current_user gateway_repo = GatewayJsonRepository() router = APIRouter() -# ----------------------- -# Endpoints pubblici (se vuoi che restino pubblici, niente Depends) -# ----------------------- @router.get("/getBuildings", response_model=List[BuildingItem], tags=["Reslevis"]) def getBuildings(): return [] @@ -27,9 +23,6 @@ def getPlans(): def getZones(): return [] -# ----------------------- -# Endpoints protetti: richiedono almeno un Bearer token valido -# ----------------------- @router.get("/getGateways", response_model=List[GatewayItem], tags=["Reslevis"], dependencies=[Depends(get_current_user)]) def getGateways(): return gateway_repo.list() @@ -54,18 +47,10 @@ def getAlarms(): def getTracks(): return [] -# ----------------------- -# Operazioni di scrittura su Gateway: -# - Token valido -# - Ruolo richiesto (esempio: "reslevis:write") -# Cambia il nome ruolo per allinearlo a come lo hai definito in Keycloak -# ----------------------- -write_role = "reslevis:write" # esempio; usa il tuo realm/client role - @router.post( "/postGateway", tags=["Reslevis"], - dependencies=[Depends(require_roles(write_role))] + dependencies=[Depends(get_current_user)] ) def postGateway(item: GatewayItem): try: @@ -79,7 +64,7 @@ def postGateway(item: GatewayItem): @router.put( "/updateGateway", tags=["Reslevis"], - dependencies=[Depends(require_roles(write_role))] + dependencies=[Depends(get_current_user)] ) def updateGateway(item: GatewayItem): try: @@ -96,7 +81,7 @@ def updateGateway(item: GatewayItem): @router.delete( "/removeGateway/{gateway_id}", tags=["Reslevis"], - dependencies=[Depends(require_roles(write_role))] + dependencies=[Depends(get_current_user)] ) def removeGateway(gateway_id: str): try: @@ -107,35 +92,35 @@ def removeGateway(gateway_id: str): except Exception as e: raise HTTPException(status_code=500, detail=f"Errore interno: {e}") -@router.post("/postBuilding", tags=["Reslevis"], dependencies=[Depends(require_roles(write_role))]) +@router.post("/postBuilding", tags=["Reslevis"], dependencies=[Depends(get_current_user)]) def postBuilding(item: BuildingItem): return {"message": "OK"} -@router.post("/postPlan", tags=["Reslevis"], dependencies=[Depends(require_roles(write_role))]) +@router.post("/postPlan", tags=["Reslevis"], dependencies=[Depends(get_current_user)]) def postPlan(item: PlanItem): return {"message": "OK"} -@router.post("/postZone", tags=["Reslevis"], dependencies=[Depends(require_roles(write_role))]) +@router.post("/postZone", tags=["Reslevis"], dependencies=[Depends(get_current_user)]) def postZone(item: ZoneItem): return {"message": "OK"} -@router.post("/postTracker", tags=["Reslevis"], dependencies=[Depends(require_roles(write_role))]) +@router.post("/postTracker", tags=["Reslevis"], dependencies=[Depends(get_current_user)]) def postTracker(item: TrackerItem): return {"message": "OK"} -@router.post("/postOperator", tags=["Reslevis"], dependencies=[Depends(require_roles(write_role))]) +@router.post("/postOperator", tags=["Reslevis"], dependencies=[Depends(get_current_user)]) def postOperator(item: OperatorItem): return {"message": "OK"} -@router.post("/postSubject", tags=["Reslevis"], dependencies=[Depends(require_roles(write_role))]) +@router.post("/postSubject", tags=["Reslevis"], dependencies=[Depends(get_current_user)]) def postSubject(item: SubjectItem): return {"message": "OK"} -@router.post("/postAlarm", tags=["Reslevis"], dependencies=[Depends(require_roles(write_role))]) +@router.post("/postAlarm", tags=["Reslevis"], dependencies=[Depends(get_current_user)]) def postAlarm(item: AlarmItem): return {"message": "OK"} -@router.post("/postTrack", tags=["Reslevis"], dependencies=[Depends(require_roles(write_role))]) +@router.post("/postTrack", tags=["Reslevis"], dependencies=[Depends(get_current_user)]) def postTrack(item: TrackItem): return {"message": "OK"} diff --git a/security.py b/security.py index cbed1a6..04e4543 100644 --- a/security.py +++ b/security.py @@ -3,6 +3,7 @@ from typing import Dict, Any, List, Optional import os import logging import httpx +import config_env from jose import jwt, JWTError from fastapi import HTTPException, status, Depends from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials @@ -10,14 +11,20 @@ from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials logger = logging.getLogger("security") # === CONFIG === -KEYCLOAK_ISSUER = os.getenv( - "KEYCLOAK_ISSUER", - "https://192.168.1.3:10002/realms/API.Server.local", -) -KEYCLOAK_JWKS_URL = os.getenv( - "KEYCLOAK_JWKS_URL", - "https://192.168.1.3:10002/realms/API.Server.local/protocol/openid-connect/certs", -) +#KEYCLOAK_ISSUER = os.getenv( +# "KEYCLOAK_ISSUER", +# "https://10.251.0.30:10002/realms/API.Server.local", + #"https://192.168.1.3:10002/realms/API.Server.local", +#) +#KEYCLOAK_JWKS_URL = os.getenv( +# "KEYCLOAK_JWKS_URL", +# "https://10.251.0.30:10002/realms/API.Server.local/protocol/openid-connect/certs", + #"https://192.168.1.3:10002/realms/API.Server.local/protocol/openid-connect/certs", +#) + +KEYCLOAK_ISSUER = config_env.KEYCLOAK_ISSUER +KEYCLOAK_JWKS_URL = config_env.KEYCLOAK_JWKS_URL + KEYCLOAK_AUDIENCE = os.getenv("KEYCLOAK_AUDIENCE", "Fastapi") ALGORITHMS = ["RS256", "RS384", "RS512", "PS256", "PS384", "PS512"]