maskantech/docqube_backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request 'ribai' (#5) from ribai into dev

Browse Source 
Reviewed-on: https://gitea.maskantech.in/gitea_admin/docqube_backend/pulls/5
This commit is contained in:
azeem
2026-09-08 13:06:15 +00:00
parent 3f459873fc acc8c0658d
commit 4755393466
4 changed files with 111 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.test
+1
View File
@@ -47,6 +47,7 @@ MAX_CONTEXT_CHARS=4000
MIN_SIMILARITY_SCORE=0.18
LOG_LEVEL=INFO
CORS_ORIGINS=https://saas-test.maskantech.in,https://docqubeapp-test.maskantech.in,https://docqube-test.maskantech.in,http://localhost:5173,http://localhost:3000
COOKIE_DOMAIN=.maskantech.in
SMTP_HOST=smtp.gmail.com
SMTP_PORT=465
SMTP_USER=info.maskantech@gmail.com
app/middleware/csrf.py
+9 -7
View File
@@ -34,25 +34,27 @@ class CSRFMiddleware(BaseHTTPMiddleware):
content={"detail": "CSRF verification failed"}
)
if not csrf_cookie:
self._set_csrf_cookie(response)
self._set_csrf_cookie(response, request)
return response
response = await call_next(request)
if not csrf_cookie:
self._set_csrf_cookie(response)
self._set_csrf_cookie(response, request)
return response
def _set_csrf_cookie(self, response):
def _set_csrf_cookie(self, response, request: Request = None):
"""Helper to set the CSRF cookie with appropriate security flags."""
is_prod = settings.APP_ENV == "production"
is_secure = settings.APP_ENV in ["production", "test", "testing"] or (request and request.url.scheme == "https")
samesite_mode = "none" if is_secure else "lax"
cookie_domain = getattr(settings, "COOKIE_DOMAIN", None) or None
response.set_cookie(
key="csrf_token",
value=str(uuid.uuid4()),
httponly=False,
samesite="none" if is_prod else "lax",
secure=is_prod,
domain=settings.COOKIE_DOMAIN if is_prod else None,
samesite=samesite_mode,
secure=is_secure,
domain=cookie_domain,
path="/"
)
app/modules/auth/routes/auth_routes.py
+81 -39
View File
@@ -45,13 +45,17 @@ def login(
):
token_data = AuthController.login_user(form_data, db, request)
is_secure = settings.APP_ENV in ["production", "test", "testing"] or request.url.scheme == "https"
samesite_mode = "none" if is_secure else "lax"
cookie_domain = getattr(settings, "COOKIE_DOMAIN", None) or None
response.set_cookie(
key="docqube_access_token",
value=token_data["access_token"],
httponly=True,
secure=settings.APP_ENV == "production",
samesite="none" if settings.APP_ENV == "production" else "lax",
domain=settings.COOKIE_DOMAIN if settings.APP_ENV == "production" else None,
secure=is_secure,
samesite=samesite_mode,
domain=cookie_domain,
max_age=3600,
path="/",
)
@@ -60,9 +64,9 @@ def login(
key="docqube_refresh_token",
value=token_data["refresh_token"],
httponly=True,
secure=settings.APP_ENV == "production",
samesite="none" if settings.APP_ENV == "production" else "lax",
domain=settings.COOKIE_DOMAIN if settings.APP_ENV == "production" else None,
secure=is_secure,
samesite=samesite_mode,
domain=cookie_domain,
max_age=7 * 24 * 3600,
path="/api/auth/refresh",
)
@@ -71,21 +75,31 @@ def login(
key="docqube_has_session",
value="true",
httponly=False,
secure=settings.APP_ENV == "production",
samesite="none" if settings.APP_ENV == "production" else "lax",
domain=settings.COOKIE_DOMAIN if settings.APP_ENV == "production" else None,
secure=is_secure,
samesite=samesite_mode,
domain=cookie_domain,
max_age=7 * 24 * 3600,
path="/",
)
response.set_cookie(
key="csrf_token",
value=str(uuid.uuid4()),
httponly=False,
secure=is_secure,
samesite=samesite_mode,
domain=cookie_domain,
path="/"
)
if hasattr(request.state, "new_device_id"):
response.set_cookie(
key="docqube_device_id",
value=request.state.new_device_id,
httponly=True,
secure=settings.APP_ENV == "production",
samesite="none" if settings.APP_ENV == "production" else "lax",
domain=settings.COOKIE_DOMAIN if settings.APP_ENV == "production" else None,
secure=is_secure,
samesite=samesite_mode,
domain=cookie_domain,
max_age=365 * 24 * 3600,
path="/",
)
@@ -97,14 +111,17 @@ def google_login(
request: Request, response: Response, payload: GoogleLoginIn, db: Session = Depends(get_db)
):
token_data = AuthController.google_login(payload, db, request)
is_secure = settings.APP_ENV in ["production", "test", "testing"] or request.url.scheme == "https"
samesite_mode = "none" if is_secure else "lax"
cookie_domain = getattr(settings, "COOKIE_DOMAIN", None) or None
response.set_cookie(
key="docqube_access_token",
value=token_data["access_token"],
httponly=True,
secure=settings.APP_ENV == "production",
samesite="none" if settings.APP_ENV == "production" else "lax",
domain=settings.COOKIE_DOMAIN if settings.APP_ENV == "production" else None,
secure=is_secure,
samesite=samesite_mode,
domain=cookie_domain,
max_age=3600,
path="/",
)
@@ -113,9 +130,9 @@ def google_login(
key="docqube_refresh_token",
value=token_data["refresh_token"],
httponly=True,
secure=settings.APP_ENV == "production",
samesite="none" if settings.APP_ENV == "production" else "lax",
domain=settings.COOKIE_DOMAIN if settings.APP_ENV == "production" else None,
secure=is_secure,
samesite=samesite_mode,
domain=cookie_domain,
max_age=7 * 24 * 3600,
path="/api/auth/refresh",
)
@@ -124,21 +141,31 @@ def google_login(
key="docqube_has_session",
value="true",
httponly=False,
secure=settings.APP_ENV == "production",
samesite="none" if settings.APP_ENV == "production" else "lax",
domain=settings.COOKIE_DOMAIN if settings.APP_ENV == "production" else None,
secure=is_secure,
samesite=samesite_mode,
domain=cookie_domain,
max_age=7 * 24 * 3600,
path="/",
)
response.set_cookie(
key="csrf_token",
value=str(uuid.uuid4()),
httponly=False,
secure=is_secure,
samesite=samesite_mode,
domain=cookie_domain,
path="/"
)
if hasattr(request.state, "new_device_id"):
response.set_cookie(
key="docqube_device_id",
value=request.state.new_device_id,
httponly=True,
secure=settings.APP_ENV == "production",
samesite="none" if settings.APP_ENV == "production" else "lax",
domain=settings.COOKIE_DOMAIN if settings.APP_ENV == "production" else None,
secure=is_secure,
samesite=samesite_mode,
domain=cookie_domain,
max_age=365 * 24 * 3600,
path="/",
)
@@ -225,13 +252,17 @@ def refresh_token(request: Request, response: Response, db: Session = Depends(ge
new_access_token = create_access_token(payload_access)
is_secure = settings.APP_ENV in ["production", "test", "testing"] or (request and request.url.scheme == "https")
samesite_mode = "none" if is_secure else "lax"
cookie_domain = getattr(settings, "COOKIE_DOMAIN", None) or None
response.set_cookie(
key="docqube_access_token",
value=new_access_token,
httponly=True,
secure=settings.APP_ENV == "production",
samesite="none" if settings.APP_ENV == "production" else "lax",
domain=settings.COOKIE_DOMAIN if settings.APP_ENV == "production" else None,
secure=is_secure,
samesite=samesite_mode,
domain=cookie_domain,
max_age=3600,
path="/",
)
@@ -240,9 +271,9 @@ def refresh_token(request: Request, response: Response, db: Session = Depends(ge
key="docqube_has_session",
value="true",
httponly=False,
secure=settings.APP_ENV == "production",
samesite="none" if settings.APP_ENV == "production" else "lax",
domain=settings.COOKIE_DOMAIN if settings.APP_ENV == "production" else None,
secure=is_secure,
samesite=samesite_mode,
domain=cookie_domain,
max_age=7 * 24 * 3600,
path="/",
)
@@ -304,26 +335,37 @@ def logout(
except Exception:
pass
is_secure = settings.APP_ENV in ["production", "test", "testing"] or (request and request.url.scheme == "https")
samesite_mode = "none" if is_secure else "lax"
cookie_domain = getattr(settings, "COOKIE_DOMAIN", None) or None
response.delete_cookie(
"docqube_access_token",
path="/",
samesite="none" if settings.APP_ENV == "production" else "lax",
secure=settings.APP_ENV == "production",
domain=settings.COOKIE_DOMAIN if settings.APP_ENV == "production" else None,
samesite=samesite_mode,
secure=is_secure,
domain=cookie_domain,
)
response.delete_cookie(
"docqube_refresh_token",
path="/api/auth/refresh",
samesite="none" if settings.APP_ENV == "production" else "lax",
secure=settings.APP_ENV == "production",
domain=settings.COOKIE_DOMAIN if settings.APP_ENV == "production" else None,
samesite=samesite_mode,
secure=is_secure,
domain=cookie_domain,
)
response.delete_cookie(
"docqube_has_session",
path="/",
samesite="none" if settings.APP_ENV == "production" else "lax",
secure=settings.APP_ENV == "production",
domain=settings.COOKIE_DOMAIN if settings.APP_ENV == "production" else None,
samesite=samesite_mode,
secure=is_secure,
domain=cookie_domain,
)
response.delete_cookie(
"csrf_token",
path="/",
samesite=samesite_mode,
secure=is_secure,
domain=cookie_domain,
)
return {"status": "success", "message": "Logged out"}
app/modules/auth/sso_router.py
+20
View File
@@ -4,6 +4,7 @@ import time
import logging
import hmac
import hashlib
import uuid
from app.db.database import get_db
from app.core.settings import settings
@@ -74,6 +75,13 @@ async def sso_login(
"subscription": data.get("subscription"),
}
subscription = data.get("subscription")
if user.tenant and subscription:
try:
_sync_subscription(db, user.tenant, subscription.get("plan_code"), subscription)
except Exception as e:
logger.warning(f"Could not sync subscription for tenant {user.tenant_id}: {e}")
is_user_superadmin = bool(
getattr(user, "is_superadmin", False)
or data.get("is_superadmin")
@@ -126,6 +134,16 @@ async def sso_login(
max_age=7 * 24 * 3600
)
response.set_cookie(
key="csrf_token",
value=str(uuid.uuid4()),
httponly=False,
secure=is_secure,
samesite=samesite_mode,
domain=cookie_domain,
path="/"
)
return {
"status": "success",
"message": "SSO Login successful",
@@ -135,6 +153,8 @@ async def sso_login(
"id": user.id,
"email": user.email,
"name": user.name,
"is_superadmin": is_user_superadmin,
"role": "superadmin" if is_user_superadmin else (user.role.name if user.role else None),
"permissions": permissions
}
}