saas_backend/app/routes/auth/sso.py

from fastapi import APIRouter, Depends, Header, Request
from sqlalchemy.orm import Session
from typing import Optional

from app.config.database import get_db
from app.middleware.auth_middleware import get_current_user, User
from app.schemas.auth.sso_schema import SSOInitiateRequest, SSOExchangeRequest
from app.controllers.auth.sso_controller import SSOController

public_router = APIRouter()
internal_router = APIRouter()

@public_router.post("/initiate")
def initiate_sso(
    request: SSOInitiateRequest,
    current_user: User = Depends(get_current_user),
    db: Session = Depends(get_db)
):
    """
    User-facing endpoint to start SSO flow.
    Returns a signed payload and target URL for the client to POST.
    """
    return SSOController.initiate_sso(db, request, current_user)

@internal_router.post("/exchange")
def exchange_grant(
    request: Request,
    payload: SSOExchangeRequest,
    db: Session = Depends(get_db),
    x_module_signature: Optional[str] = Header(None, alias="X-Module-Signature"),
    x_module_key: Optional[str] = Header(None, alias="X-Module-Key")
):
    """
    Internal server-to-server endpoint for modules to exchange grant code for token.
    Must be signed or authenticated via trust credentials.
    """
    return SSOController.exchange_grant(
        db=db,
        payload=payload,
        x_module_signature=x_module_signature,
        x_module_key=x_module_key
    )