dev(auth): use EcoTaxa as auth source.

Author: grololo06

src/Models.py

@@ -351,13 +351,6 @@ class MarkSubsampleReq(BaseModel):
     validation_date: Optional[datetime] = None
 
 
-class ExportSubsampleReq(BaseModel):
-    """Request model for exporting a subsample"""
-
-    token: str
-    projid: int
-
-
 class ExportSubsampleRsp(BaseModel):
     """Response model for exporting a subsample, a task and the subsample"""
 

src/helpers/auth.py

@@ -1,15 +1,19 @@
 import datetime
+import uuid
 from typing import Dict, Optional
 
 import jwt
 from fastapi import HTTPException, status, Depends
 from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+from sqlalchemy.exc import IntegrityError
 from sqlalchemy.orm import Session
 from starlette.requests import Request
 
 from config_rdr import config
+from helpers.logger import logger
 from local_DB.db_dependencies import get_db
 from local_DB.models import User, BlacklistedToken
+from providers.ecotaxa_client import EcoTaxaApiClient
 
 
 class CustomHTTPBearer(HTTPBearer):
@@ -73,7 +77,7 @@ def get_authorization_scheme_param(authorization_header: Optional[str]):
 SESSION_COOKIE_NAME = "zoopp_session"
 
 
-def decode_jwt_token(token: str, db: Optional[Session] = None) -> Dict:
+def decode_jwt_token(token: str, db: Optional[Session] = None) -> Dict[str, str]:
     """
     Decode and validate a JWT token.
 
@@ -143,7 +147,7 @@ def create_jwt_token(data: Dict, expires_delta: Optional[int] = None) -> str:
     return encoded_jwt
 
 
-def get_user_from_token(token: str, db: Optional[Session] = None) -> Dict:
+def get_user_from_token(token: str, db: Optional[Session] = None) -> str:
     """
     Extract user information from a JWT token.
 
@@ -152,21 +156,28 @@ def get_user_from_token(token: str, db: Optional[Session] = None) -> Dict:
         db: Optional database session for checking token blacklist
 
     Returns:
-        User information extracted from the token
+        User email extracted from the token
     """
     payload = decode_jwt_token(token, db)
+    return payload.get("email", "")
 
-    # In a real application, you might want to validate the user exists in your database
-    # or fetch additional user information
 
-    return {
-        "id": payload.get("sub", ""),
-        "name": payload.get("name", ""),
-        "email": payload.get("email", ""),
-    }
+def get_ecotaxa_token_from_token(token: str, db: Optional[Session] = None) -> str:
+    """
+    Extract EcoTaxa token in our token
 
+    Args:
+        token: The JWT token
+        db: Optional database session for checking token blacklist
 
-def get_user_from_db(email: str, db):
+    Returns:
+        EcoTaxa token.
+    """
+    payload = decode_jwt_token(token, db)
+    return payload["token"]
+
+
+def get_user_from_db(email: str, db) -> User:
     """
     Get a user from the database by email.
 
@@ -178,7 +189,46 @@ def get_user_from_db(email: str, db):
         The user if found, None otherwise
     """
 
-    return db.query(User).filter(User.email == email).first()
+    return db.query(User).filter(User.email == email).first()  # type:ignore
+
+
+def user_from_db(name: str, email: str, db) -> User:
+    """
+    Ensure a user with the given email exists; create it if missing, and return its id.
+    Lookup is performed by email.
+
+    Args:
+        name: The user's name (EcoTaxa conventions)
+        email: The user's email address used for lookup and creation.
+        db: The database session.
+
+    Returns:
+        str: The user's id (existing or newly created).
+    """
+    # Try to find existing user by email
+    user = db.query(User).filter(User.email == email).first()
+    if user:
+        return user  # type:ignore
+
+    # Create a minimal user record if not found
+    new_user = User(
+        id=str(uuid.uuid4()),
+        name=name,
+        email=email,
+        password="",  # No password stored here (auth handled externally)
+    )
+    try:
+        db.add(new_user)
+        db.commit()
+        db.refresh(new_user)
+        return new_user  # type:ignore
+    except IntegrityError:
+        # In case of a race condition where the user was created concurrently
+        db.rollback()
+        user = db.query(User).filter(User.email == email).first()
+        if user:
+            return user.id  # type:ignore
+        raise
 
 
 def blacklist_token(token: str, db: Session):
@@ -257,23 +307,26 @@ def authenticate_user(email: str, password: str, db) -> str:
     Raises:
         HTTPException: If authentication fails
     """
-    # Validate the credentials against the database
-    user = get_user_from_db(email, db)
-
-    if (
-        not user or user.password != password
-    ):  # In a real app, use proper password hashing
+    # Validate the credentials against EcoTaxa server
+    client = EcoTaxaApiClient(logger, config.ECOTAXA_SERVER, email, password)
+    client.token = client.login()
+    if client.token is None:
         raise HTTPException(
             status_code=401,
             detail="Incorrect email or password",
             headers={"WWW-Authenticate": "Bearer"},
         )
+    else:
+        who = client.whoami()
+
+    user = user_from_db(who.name, who.email, db)
 
     # Create user data for the token
     user_data = {
         "sub": user.id,
         "name": user.name,
         "email": user.email,
+        "token": client.token,
     }
 
     # Create a JWT token with 30-day expiration
@@ -301,6 +354,51 @@ async def get_current_user_from_credentials(
     Raises:
         HTTPException: If authentication fails
     """
+    token = await get_token_from_credentials(request, credentials)
+
+    # Validate the JWT token and extract user information
+    user_mail = get_user_from_token(token, db)
+
+    # Get the user from the database to ensure they exist
+    user = get_user_from_db(user_mail, db)
+
+    if not user:
+        raise HTTPException(
+            status_code=401,
+            detail="User not found",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+
+    return user
+
+
+async def get_ecotaxa_token_from_credentials(
+    request: Request,
+    credentials: HTTPAuthorizationCredentials = Depends(security),
+    db: Session = Depends(get_db),
+) -> str:
+    """
+    FastAPI dependency that extracts EcoTaxa token from request.
+
+    Args:
+        request: The request object to access cookies
+        credentials: The HTTP authorization credentials
+        db: The database session
+
+    Returns:
+        The EcoTaxa token.
+
+    Raises:
+        HTTPException: If authentication problem
+    """
+    token = await get_token_from_credentials(request, credentials)
+
+    return get_ecotaxa_token_from_token(token, db)
+
+
+async def get_token_from_credentials(
+    request: Request, credentials: HTTPAuthorizationCredentials
+) -> str:
     token = None
 
     # Try to extract token from the authorization header
@@ -318,18 +416,4 @@ async def get_current_user_from_credentials(
             detail="Not authenticated",
             headers={"WWW-Authenticate": "Bearer"},
         )
-
-    # Validate the JWT token and extract user information
-    user_data = get_user_from_token(token, db)
-
-    # Get the user from the database to ensure they exist
-    user = get_user_from_db(user_data["email"], db)
-
-    if not user:
-        raise HTTPException(
-            status_code=401,
-            detail="User not found",
-            headers={"WWW-Authenticate": "Bearer"},
-        )
-
-    return user
+    return token

src/routers/ecotaxa.py

@@ -1,16 +1,19 @@
-from typing import List, Dict, Optional
+from typing import List
 
 from fastapi import APIRouter, Depends
+from fastapi.security import HTTPAuthorizationCredentials
 from sqlalchemy.orm import Session
 
 from Models import Project
 from config_rdr import config
-from helpers.auth import get_current_user_from_credentials, create_jwt_token
+from helpers.auth import (
+    get_current_user_from_credentials,
+    get_ecotaxa_token_from_credentials,
+)
 from helpers.logger import logger
 from local_DB.db_dependencies import get_db
-from providers.EcoTaxa.ecotaxa_model import ProjectModel, LoginReq
+from providers.EcoTaxa.ecotaxa_model import ProjectModel
 from providers.ecotaxa_client import EcoTaxaApiClient
-from helpers.auth import decode_jwt_token
 
 # Create a routers instance
 router = APIRouter(
@@ -21,63 +24,24 @@
 
 @router.get("/projects", response_model=List[ProjectModel])
 def get_projects(
-    token: str,
     _user=Depends(get_current_user_from_credentials),
+    ecotaxa_token: HTTPAuthorizationCredentials = Depends(
+        get_ecotaxa_token_from_credentials
+    ),
     db: Session = Depends(get_db),
 ) -> List[ProjectModel]:
     """
     Get a list of ZooScan projects from EcoTaxa.
 
     Args:
-        token: EcoTaxa API token (JWT-encoded).
         _user: The authenticated user
+        ecotaxa_token: embedded EcoTaxa token
         db: The database session
 
     Returns:
         List[Project]: A list of ZooScan projects
     """
-    # Decode the JWT token to get the actual EcoTaxa token
-    decoded_token = decode_jwt_token(token, db)
-    ecotaxa_token = decoded_token.get("ecotaxa_token")
     assert isinstance(ecotaxa_token, str), "Failed to decode JWT-encoded EcoTaxa token"
 
     client = EcoTaxaApiClient.from_token(logger, config.ECOTAXA_SERVER, ecotaxa_token)
     return client.list_zooscan_projects()
-
-
-@router.post("/login")
-def ecotaxa_login(
-    login_req: LoginReq,
-    _user=Depends(get_current_user_from_credentials),
-    _db: Session = Depends(get_db),
-):
-    """
-    Authenticates with EcoTaxa using the provided credentials.
-
-    Args:
-        login_req (LoginReq): The login request containing username (email) and password.
-        _user: The authenticated user
-        _db: The database session
-
-    Returns:
-        Dict: A dictionary containing the JWT-encrypted EcoTaxa token.
-    """
-    client = EcoTaxaApiClient(
-        logger, config.ECOTAXA_SERVER, login_req.username, login_req.password
-    )
-    ecotaxa_token: Optional[str] = None
-    try:
-        ecotaxa_token = client.login()
-    except Exception as err:
-        pass
-    if ecotaxa_token is None:
-        return {"token": None}
-
-    # Create a data dictionary for the JWT token
-    token_data = {
-        "ecotaxa_token": ecotaxa_token,
-    }
-    # Create a JWT token with 30-day expiration (similar to user sessions)
-    jwt_token = create_jwt_token(token_data, expires_delta=30 * 24 * 60 * 60)
-
-    return {"token": jwt_token}