o uhj @sddlmZmZmZddlmZmZddlmZddl m Z ddl m Z eddZ ee fded Bd efd d Zee fded Bd ed Bfd dZeefded efddZeefded efddZd S))Depends HTTPExceptionstatus) HTTPBearerHTTPAuthorizationCredentials) get_database)get_agent_by_id)decode_access_tokenF) auto_error credentialsNreturncs|r|jsttjdddidt|j}|r|ds&ttjdddid|d}t}t||IdH}|r?|dd krIttjd ddidt|}| d d|S) z FastAPI dependency that validates Bearer JWT access token and resolves authenticated agent. Raises HTTP 401 Unauthorized if missing, invalid, or expired. z,Authentication credentials were not providedzWWW-AuthenticateBearer) status_codedetailheaderssubzInvalid or expired access tokenNrACTIVEz&Agent account is inactive or not found passwordHash) r rrHTTP_401_UNAUTHORIZEDr getrrdictpopr payloadagent_iddbagent safe_agentr6/web/html/dev/chatbot/backend/app/dependencies/auth.pyget_current_agent s4    r csz|r|jsdSt|j}|r|dsdS|d}t}t||IdH}|r/|ddkr1dSt|}|dd|S)z Optional authentication dependency. Returns safe agent dict if valid Bearer token is provided; returns None otherwise. Nrrrr)r r rrrrrrrrrget_current_agent_optional-s    r! current_agentcs"|ddvrttjdd|S)zS Authorization dependency ensuring the caller is an active AGENT or ADMIN. role)AGENTADMINz,Agent authorization required for this actionrrrrrHTTP_403_FORBIDDENr"rrr require_agentDsr*cs"|ddkrttjdd|S)z} Authorization dependency ensuring the caller has ADMIN role. Raises HTTP 403 Forbidden if user is not an ADMIN. r#r%z#Admin role required for this actionr&r'r)rrr require_adminOsr+)fastapirrrfastapi.securityrr app.databaser!app.repositories.agent_repositoryrapp.utils.securityr securityrr r!r*r+rrrrs    "$