feat: implementar pestaña de Gestion de Cuentas y autenticacion global RADIUS con JIT provisioning

2026-08-15 10:04:43 -03:00
parent d010abe05c
commit bdce625767
15 changed files with 941 additions and 19 deletions
@@ -13,27 +13,62 @@ router = APIRouter(prefix="/auth", tags=["Authentication"])
 import logging
 logger = logging.getLogger("uvicorn.error")

+from app.core.radius import authenticate_radius
+from app.services.settings_service import get_setting
+
@router.post("/login", response_model=TokenResponse)
 async def login(credentials: LoginRequest, db: AsyncSession = Depends(get_db)):
    email_clean = credentials.email.strip().lower()
    
-    result = await db.execute(select(User).where(User.email == email_clean))
-    user = result.scalar_one_or_none()
+    auth_mode = await get_setting(db, "auth_mode")
+    radius_host = await get_setting(db, "radius_host")
+    radius_port = await get_setting(db, "radius_port")
+    radius_secret = await get_setting(db, "radius_secret")
    
-    if not user:
-        logger.warning(f"Login failed: User not found with email '{email_clean}'")
+    is_authenticated = False
+    user = None
+    
+    # 1. RADIUS Authentication Path (except for default admin fallback)
+    if auth_mode == "radius" and email_clean != "admin@oneverdrive.local":
+        username_radius = email_clean.split("@")[0] if "@" in email_clean else email_clean
+        try:
+            port_num = int(radius_port) if radius_port else 1812
+        except ValueError:
+            port_num = 1812
+            
+        radius_ok = authenticate_radius(username_radius, credentials.password, radius_host, radius_secret, port=port_num)
+        if radius_ok:
+            result = await db.execute(select(User).where(User.email == email_clean))
+            user = result.scalar_one_or_none()
+            if not user:
+                # Auto-provision (JIT) RADIUS User
+                user = User(
+                    email=email_clean,
+                    hashed_password=get_password_hash(credentials.password),
+                    full_name=username_radius.capitalize(),
+                    role="OPERATOR",
+                    auth_source="radius",
+                    is_active=True
+                )
+                db.add(user)
+                await db.commit()
+                await db.refresh(user)
+            is_authenticated = True
+    else:
+        # 2. Local Authentication Path (or Admin local login fallback)
+        result = await db.execute(select(User).where(User.email == email_clean))
+        user = result.scalar_one_or_none()
+        if user:
+            if verify_password(credentials.password, user.hashed_password):
+                is_authenticated = True
+                
+    if not is_authenticated:
+        logger.warning(f"Login failed: Invalid credentials for '{email_clean}'")
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Incorrect email or password"
        )
        
-    if not verify_password(credentials.password, user.hashed_password):
-        logger.warning(f"Login failed: Password mismatch for email '{email_clean}' (sent password length: {len(credentials.password)})")
-        raise HTTPException(
-            status_code=status.HTTP_401_UNAUTHORIZED,
-            detail="Incorrect email or password"
-        )
-    
    if not user.is_active:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
@@ -57,7 +92,8 @@ async def login(credentials: LoginRequest, db: AsyncSession = Depends(get_db)):
            "id": user.id,
            "email": user.email,
            "full_name": user.full_name,
-            "role": user.role
+            "role": user.role,
+            "auth_source": user.auth_source
        }
    }

@@ -0,0 +1,130 @@
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy import select
+from typing import List
+
+from app.core.database import get_db
+from app.core.security import get_password_hash
+from app.models.models import User
+from app.schemas.schemas import UserResponse, UserCreate, UserUpdate
+from app.api.deps import get_current_user, require_admin
+
+router = APIRouter(prefix="/users", tags=["Users Management"], dependencies=[Depends(require_admin)])
+
+@router.get("", response_model=List[UserResponse])
+async def list_users(db: AsyncSession = Depends(get_db)):
+    """Lists all user accounts in the database."""
+    result = await db.execute(select(User).order_by(User.id.asc()))
+    users = result.scalars().all()
+    return users
+
+@router.post("", response_model=UserResponse)
+async def create_user(payload: UserCreate, db: AsyncSession = Depends(get_db)):
+    """Creates a new user account (Local or RADIUS)."""
+    # Check if email already registered
+    email_clean = payload.email.strip().lower()
+    result = await db.execute(select(User).where(User.email == email_clean))
+    existing = result.scalar_one_or_none()
+    if existing:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Email address is already registered."
+        )
+
+    user = User(
+        email=email_clean,
+        hashed_password=get_password_hash(payload.password),
+        full_name=payload.full_name,
+        role=payload.role,
+        auth_source=payload.auth_source,
+        is_active=payload.is_active
+    )
+    db.add(user)
+    await db.commit()
+    await db.refresh(user)
+    return user
+
+@router.put("/{user_id}", response_model=UserResponse)
+async def update_user(user_id: int, payload: UserUpdate, db: AsyncSession = Depends(get_db)):
+    """Updates an existing user account."""
+    result = await db.execute(select(User).where(User.id == user_id))
+    user = result.scalar_one_or_none()
+    if not user:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="User not found."
+        )
+
+    # Prevent changing email of default admin
+    if user.email == "admin@oneverdrive.local" and payload.email and payload.email.strip().lower() != user.email:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Email address of the default system administrator cannot be changed."
+        )
+
+    if payload.email is not None:
+        email_clean = payload.email.strip().lower()
+        if email_clean != user.email:
+            existing_res = await db.execute(select(User).where(User.email == email_clean))
+            if existing_res.scalar_one_or_none():
+                raise HTTPException(
+                    status_code=status.HTTP_400_BAD_REQUEST,
+                    detail="Target email address is already in use."
+                )
+            user.email = email_clean
+
+    if payload.password is not None and payload.password != "":
+        user.hashed_password = get_password_hash(payload.password)
+
+    if payload.full_name is not None:
+        user.full_name = payload.full_name
+
+    if payload.role is not None:
+        # Prevent demoting the main admin
+        if user.email == "admin@oneverdrive.local" and payload.role != "ADMIN":
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="Default system administrator role cannot be demoted."
+            )
+        user.role = payload.role
+
+    if payload.is_active is not None:
+        # Prevent deactivating the main admin
+        if user.email == "admin@oneverdrive.local" and not payload.is_active:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="Default system administrator account cannot be deactivated."
+            )
+        user.is_active = payload.is_active
+
+    db.add(user)
+    await db.commit()
+    await db.refresh(user)
+    return user
+
+@router.delete("/{user_id}")
+async def delete_user(user_id: int, db: AsyncSession = Depends(get_db), current_user: User = Depends(get_current_user)):
+    """Deletes a user account from the system."""
+    if user_id == current_user.id:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="You cannot delete your own account."
+        )
+
+    result = await db.execute(select(User).where(User.id == user_id))
+    user = result.scalar_one_or_none()
+    if not user:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="User not found."
+        )
+
+    if user.email == "admin@oneverdrive.local":
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="The default system administrator account cannot be deleted."
+        )
+
+    await db.delete(user)
+    await db.commit()
+    return {"message": f"User account '{user.email}' deleted successfully."}