
    E|j
                         d dl mZmZmZ d dlmZmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZmZ d dlmZ d dlmZ  ed	
      Zd ZdededefdZ ee       ee      fdedz  defdZy)    )DependsHTTPExceptionstatus)
HTTPBearerHTTPAuthorizationCredentials)AsyncSession)selectAsyncSessionLocal)jwtJWTError)settings)error_codesF)
auto_errorc                    K   t               4 d {   } |  d d d       d {    y 7 7 # 1 d {  7  sw Y   y xY ww)Nr
   )sessions    2/var/www/html/ai-nims-dev/backend/app/core/deps.pyget_dbr      sB      "  g      s8   A,A0A.AAA9AAtokendbreturnc                   K   	 t        j                  | t        j                  dgddi      }dd	l
m} |j                  t        |      j                  |j                  |d
   k(               d{   }|j!                         }|s,t        t        j                  t        j                  dd      |j"                  s,t        t        j$                  t        j&                  dd      |j(                  ,t        t        j$                  t        j*                  dd      |S # t        $ r- t        t        j                  t        j                  dd      w xY w7 w)u#  Shared identity check behind get_current_staff below — factored out so the
    WebSocket route in sessions.py can run the same checks on a token it receives as its
    first message, since a browser WebSocket handshake can't carry an Authorization
    header the way a normal request does.HS256
verify_expF)
algorithmsoptionszInvalid or expired tokenerrormessagestatus_codedetailr   )UsersubNzAccount is deactivatedzAccount locked. Contact admin.)r   decoder   
JWT_SECRETr   r   r   HTTP_401_UNAUTHORIZEDr   INVALID_TOKENapp.models.userr#   executer	   whereidscalar_one_or_none	is_activeHTTP_403_FORBIDDENACCOUNT_INACTIVE	locked_atACCOUNT_LOCKED)r   r   payloadr#   resultusers         r   decode_staff_tokenr6      s<    

**y!5)	
 %::fTl00GEN1JKLLF$$&D44(66C]^
 	

 >>11(99F^_
 	

 ~~!11(77Dde
 	

 N;  
44(66C]^
 	

 Ms)   E *D% AE 0E1B4E %6EE credentialsNc                    K   | s,t        t        j                  t        j                  dd      t        | j                  |       d {   S 7 w)NzAuthentication requiredr   r    )r   r   r'   r   UNAUTHORIZEDr6   r7   )r7   r   s     r   get_current_staffr:   >   sK      44(55B[\
 	
 $K$;$;R@@@@s   AA
AA)fastapir   r   r   fastapi.securityr   r   sqlalchemy.ext.asyncior   
sqlalchemyr	   app.db.enginer   joser   r   app.core.configr   app.constantsr   securityr   strdictr6   r:        r   <module>rH      sx    2 2 E /  +  $ %'
)C )\ )d )Z 8?x7Hv	A-4	A	ArG   