Ë
    å°ùic  ã                   óæ   — d dl mZ d dlmZ d dlmZmZ d dlmZ d dl	m
Z
 d dlmZ dedee   fd	„Zd
ededee   fd„Zdededefd„Zdefd„Zdefd„Zd„ Zdefd„Zdee   fd„Zdedee   fd„Zy)é    )ÚOptional)ÚObjectId)ÚHTTPExceptionÚRequest)Úusers_collection)ÚAccessTokenModel)Ú
StaffModelÚrequestÚreturnc                 óÌ   — | j                   j                  dd«      }|j                  «       j                  d«      sy |j	                  dd«      d   j                  «       }|xs d S )NÚAuthorizationÚ zbearer Ú é   )ÚheadersÚgetÚlowerÚ
startswithÚsplitÚstrip)r
   Úauth_headerÚ	raw_tokens      ú8/var/www/pod-logistic/pod-api-clone/utils/auth_helper.pyÚget_bearer_token_from_requestr      s]   € Ø—/‘/×%Ñ% o°rÓ:€KØ×ÑÓ×)Ñ)¨)Ô4Øà×!Ñ! # qÓ)¨!Ñ,×2Ñ2Ó4€IØÒ˜Ðó    Úactor_idÚrolec                 ó  — t        | xs d«      j                  «       } | sy 	 t        j                  t	        | «      |dœ«      }|r|S 	 t        j                  | |dœ«      }|r|S t        j                  | |dœ«      S # t
        $ r Y Œ?w xY w)Nr   )Ú_idr   )Úidr   )ÚuserIdr   )Ústrr   r   Úfind_oner   Ú	Exception)r   r   Úusers      r   Ú_find_user_by_idr&      s”   € Ü�8’>˜rÓ"×(Ñ(Ó*€HÙØðÜ×(Ñ(´¸(Ó1CÈTÑ)RÓSˆÙØˆKð ô
 ×$Ñ$¨H¸dÑ%CÓD€DÙØˆä×$Ñ$°À$Ñ%GÓHÐHøô ò Ùðús   ¢$A< Á<	BÂBr%   c           
      ó¼  — t        | j                  d«      xs( | j                  d«      xs | j                  d«      xs d«      }| j                  d«      xs5 | j                  dd«      › d| j                  dd«      › �j                  «       }|||d	k(  r| j                  d
g «      ng |xs || j                  dd«      | j                  d|dk(  rd«      dœS d«      dœS )Nr   r    r!   r   ÚnameÚ	firstNamer   ÚlastNameÚstaffÚpermissionsÚemailÚstatusr%   ÚactiveÚinactive©r    r   r,   r(   r-   r.   )r"   r   r   )r%   r   Úuser_idr(   s       r   Ú_build_actor_from_userr3   '   sÙ   € Ü�$—(‘(˜5“/ÒO T§X¡X¨d£^ÒO°t·x±xÀÓ7IÒOÈRÓP€GØ�8‰8�FÓÒ` $§(¡(¨;¸Ó";Ð!<¸A¸d¿h¹hÀzÐSUÓ>VÐ=WÐX×^Ñ^Ó`€Dð ØØ6:¸g²o�t—x‘x ¨rÔ2È2Ø’˜Ø—‘˜' 2Ó&Ø—(‘(˜8°¸² XÓPñð ð FPÓPñð r   c              ƒ   ó¢  K  — t        | «      }|sy|dk(  r.dddgddddœ}|| j                  _        || j                  _        |S t	        j
                  |«      }|syt	        j                  |d   «       t        |j                  d	«      xs d«      j                  «       }t        |j                  d
«      xs d«      j                  «       j                  «       }|dk(  r|ddgddddœ}n!|dv rt        ||«      }|syt        ||«      }ny|| j                  _        || j                  _        |j                  d«      | j                  _        |S ­w)u†   
    Láº¥y actor hiá»‡n táº¡i tá»« opaque access token.
    KhÃ´ng raise lá»—i Ä‘á»ƒ middleware action log váº«n cháº¡y Ä‘Æ°á»£c.
    NÚ1Úadminz
Admin Testr   r/   r1   r   ÚactorIdÚ	actorRoleÚAdminzadmin@factory.com>   r%   r+   )r   ÚstateÚactorÚraw_access_tokenr   Úfind_valid_tokenÚtouch_tokenr"   r   r   r   r&   r3   Úaccess_token_id)r
   r   r;   Ú	token_docr   Ú
actor_roler%   s          r   Úget_current_actor_optionalrB   5   sQ  è ø€ ô
 .¨gÓ6€IÙØð
 �CÒàØØ#˜9Ø ØØñ
ˆð $ˆ�‰ÔØ)2ˆ�‰Ô&Øˆä ×1Ñ1°)Ó<€IÙØä× Ñ  ¨5Ñ!1Ô2ä�9—=‘= Ó+Ò1¨rÓ2×8Ñ8Ó:€HÜ�Y—]‘] ;Ó/Ò5°2Ó6×<Ñ<Ó>×DÑDÓF€Jà�WÒàØØ#˜9ØØ(Øñ
‰ð 
Ð(Ñ	(Ü ¨*Ó5ˆÙØÜ& t¨ZÓ8‰àà€G‡M�MÔØ%.€G‡M�MÔ"Ø$-§M¡M°%Ó$8€G‡M�MÔ!Ø€Lùs   ‚EEc              ƒ   óÀ   K  — t        | «      ƒ d {  –—† }|st        dd¬«      ‚|j                  d«      dk7  r!|j                  d«      dk7  rt        dd	¬«      ‚|S 7 ŒJ­w)
Né‘  ÚUnauthorized©Ústatus_codeÚdetailr   r6   r.   r/   é“  zAccount is inactive)rB   r   r   )r
   r;   s     r   Úget_current_actor_requiredrJ   n   s\   è ø€ Ü,¨WÓ5×5€EáÜ¨°NÔCÐCà‡y�y�Ó˜GÒ#¨¯	©	°(Ó(;¸xÒ(GÜ¨Ð4IÔJÐJà€Lð 6ús   ‚A‘A’AAc                  ó   — dt         fd„} | S )Nr
   c              “   óz   K  — t        | «      ƒ d {  –—† }|j                  d«      dk7  rt        dd¬«      ‚|S 7 Œ'­w)Nr   r%   rI   z Forbidden: User account requiredrF   )rJ   r   r   )r
   Úcurrent_users     r   Ú
dependencyz require_user.<locals>.dependency{   s@   è ø€ Ü7¸Ó@×@ˆØ×Ñ˜FÓ# vÒ-Ü¨CÐ8ZÔ[Ð[ØÐð Aús   ‚;‘9’(;©r   )rN   s    r   Úrequire_userrP   z   s   € ð¤'ó ð Ðr   Úpermission_namec                 ó    ‡ — dt         fˆ fd„}|S )Nr
   c              “   ó0  •K  — ‰| j                   _        t        | «      ƒ d {  –—† }|j                  d«      dk(  r|S |j                  d«      dk7  rt	        dd¬«      ‚t        j                  |j                  dg «      ‰«      r|S t	        dd¬«      ‚7 Œp­w)	Nr   r6   r+   rI   ú!Forbidden: Staff account requiredrF   r,   úForbidden: No permission)r:   Úrequired_permissionrJ   r   r   r	   Úcheck_access)r
   rM   rQ   s     €r   rN   z'requires_permission.<locals>.dependency…   s•   øè ø€ Ø,;ˆ�‰Ô)Ü7¸Ó@×@ˆð ×Ñ˜FÓ# wÒ.ØÐð ×Ñ˜FÓ# wÒ.Ü¨CÐ8[Ô\Ð\ä×"Ñ" <×#3Ñ#3°MÀ2Ó#FÈÔXØÐä¨Ð4NÔOÐOð Aús   ƒ B£B¤A1BrO   )rQ   rN   s   ` r   Úrequires_permissionrX   „   ó   ø€ ðP¤'õ Pð" Ðr   Úpermission_namesc                 ó    ‡ — dt         fˆ fd„}|S )Nr
   c              “   ód  •K  — dj                  ‰«      | j                  _        t        | «      ƒ d {  –—† }|j	                  d«      dk(  r|S |j	                  d«      dk7  rt        dd¬«      ‚|j	                  dg «      }‰D ]  }t        j                  ||«      sŒ|c S  t        dd	¬«      ‚7 Œ{­w)
NÚ,r   r6   r+   rI   rT   rF   r,   rU   )Újoinr:   rV   rJ   r   r   r	   rW   )r
   rM   Úuser_permissionsrQ   rZ   s       €r   rN   z+requires_any_permission.<locals>.dependencyš   s³   øè ø€ Ø,/¯H©HÐ5EÓ,Fˆ�‰Ô)Ü7¸Ó@×@ˆà×Ñ˜FÓ# wÒ.ØÐà×Ñ˜FÓ# wÒ.Ü¨CÐ8[Ô\Ð\à'×+Ñ+¨M¸2Ó>ÐØ/ò 	$ˆOÜ×&Ñ&Ð'7¸ÕIØ#Ò#ð	$ô ¨Ð4NÔOÐOð Aús   ƒ/B0²B.³A(B0ÂB0rO   )rZ   rN   s   ` r   Úrequires_any_permissionr`   ™   rY   r   rM   Úclient_actor_idc                 ó   — t        | xs i j                  d«      xs d«      j                  «       }t        |xs d«      j                  «       }|st        dd¬«      ‚|st        dd¬«      ‚||k7  rt        dd	¬«      ‚|S )
Nr    r   rD   rE   rF   i�  zactorId is requiredrI   zForbidden: actor mismatch)r"   r   r   r   )rM   ra   Úexpected_actor_idÚactual_actor_ids       r   Úassert_actor_matchre   ®   s�   € Ü˜\Ò/¨R×4Ñ4°TÓ:Ò@¸bÓA×GÑGÓIÐÜ˜/Ò/¨RÓ0×6Ñ6Ó8€OáÜ¨°NÔCÐCáÜ¨Ð4IÔJÐJàÐ+Ò+Ü¨Ð4OÔPÐPàÐr   N)Útypingr   Úbson.objectidr   Úfastapir   r   ÚMongoDBConnectionr   Úmodel.access_token_modelr   Úmodel.staff_modelr	   r"   r   Údictr&   r3   rB   rJ   rP   rX   Úlistr`   re   © r   r   ú<module>ro      s»   ðÝ å "ß *å .Ý 5Ý (ð¨7ð °xÀ±}ó ðI˜sð I¨#ð I°(¸4±.ó Ið& ð ¨Sð °Tó ð6¨gó 6ðr	¨gó 	òð¨ó ð*¨d°3©ió ð* Tð ¸HÀS¹Mô r   