feat: implementar pestaña de Gestion de Cuentas y autenticacion global RADIUS con JIT provisioning

backend/app/api/auth.py

@@ -13,27 +13,62 @@ router = APIRouter(prefix="/auth", tags=["Authentication"])
 import logging
 logger = logging.getLogger("uvicorn.error")
 
+from app.core.radius import authenticate_radius
+from app.services.settings_service import get_setting
+
 @router.post("/login", response_model=TokenResponse)
 async def login(credentials: LoginRequest, db: AsyncSession = Depends(get_db)):
     email_clean = credentials.email.strip().lower()
     
-    result = await db.execute(select(User).where(User.email == email_clean))
-    user = result.scalar_one_or_none()
+    auth_mode = await get_setting(db, "auth_mode")
+    radius_host = await get_setting(db, "radius_host")
+    radius_port = await get_setting(db, "radius_port")
+    radius_secret = await get_setting(db, "radius_secret")
     
-    if not user:
-        logger.warning(f"Login failed: User not found with email '{email_clean}'")
+    is_authenticated = False
+    user = None
+    
+    # 1. RADIUS Authentication Path (except for default admin fallback)
+    if auth_mode == "radius" and email_clean != "admin@oneverdrive.local":
+        username_radius = email_clean.split("@")[0] if "@" in email_clean else email_clean
+        try:
+            port_num = int(radius_port) if radius_port else 1812
+        except ValueError:
+            port_num = 1812
+            
+        radius_ok = authenticate_radius(username_radius, credentials.password, radius_host, radius_secret, port=port_num)
+        if radius_ok:
+            result = await db.execute(select(User).where(User.email == email_clean))
+            user = result.scalar_one_or_none()
+            if not user:
+                # Auto-provision (JIT) RADIUS User
+                user = User(
+                    email=email_clean,
+                    hashed_password=get_password_hash(credentials.password),
+                    full_name=username_radius.capitalize(),
+                    role="OPERATOR",
+                    auth_source="radius",
+                    is_active=True
+                )
+                db.add(user)
+                await db.commit()
+                await db.refresh(user)
+            is_authenticated = True
+    else:
+        # 2. Local Authentication Path (or Admin local login fallback)
+        result = await db.execute(select(User).where(User.email == email_clean))
+        user = result.scalar_one_or_none()
+        if user:
+            if verify_password(credentials.password, user.hashed_password):
+                is_authenticated = True
+                
+    if not is_authenticated:
+        logger.warning(f"Login failed: Invalid credentials for '{email_clean}'")
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="Incorrect email or password"
         )
         
-    if not verify_password(credentials.password, user.hashed_password):
-        logger.warning(f"Login failed: Password mismatch for email '{email_clean}' (sent password length: {len(credentials.password)})")
-        raise HTTPException(
-            status_code=status.HTTP_401_UNAUTHORIZED,
-            detail="Incorrect email or password"
-        )
-    
     if not user.is_active:
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
@@ -57,7 +92,8 @@ async def login(credentials: LoginRequest, db: AsyncSession = Depends(get_db)):
             "id": user.id,
             "email": user.email,
             "full_name": user.full_name,
-            "role": user.role
+            "role": user.role,
+            "auth_source": user.auth_source
         }
     }