Spaces:
Sleeping
Sleeping
| """ | |
| Real Firebase ID token verification — decoupled from LOCAL_MODE (which only governs | |
| storage) and from REAL_SEND_ENABLED (mail transport), same independent-flag pattern as | |
| backend/mailer_client.py. A request either carries a real Firebase ID token | |
| (REAL_AUTH_ENABLED=true) or, for local/dev/test convenience, an X-Dev-Uid header | |
| (REAL_AUTH_ENABLED=false — the default in tests, see tests/conftest.py). | |
| """ | |
| from __future__ import annotations | |
| import os | |
| import firebase_admin | |
| from fastapi import Header, HTTPException | |
| from firebase_admin import auth as firebase_auth | |
| from backend.firebase_app import get_app | |
| def real_auth_enabled() -> bool: | |
| return os.getenv("REAL_AUTH_ENABLED", "false").lower() == "true" | |
| class AuthError(Exception): | |
| pass | |
| def verify_id_token(token: str) -> dict: | |
| get_app() | |
| try: | |
| return firebase_auth.verify_id_token(token) | |
| except firebase_admin.exceptions.FirebaseError as exc: | |
| raise AuthError(str(exc)) from exc | |
| def current_uid( | |
| authorization: str | None = Header(default=None), | |
| x_dev_uid: str = Header(default="dev-user-1", alias="X-Dev-Uid"), | |
| ) -> str: | |
| """FastAPI dependency — every route that needs "who is calling" uses this instead of | |
| reading X-Dev-Uid directly, so the real/local branch lives in exactly one place.""" | |
| if not real_auth_enabled(): | |
| return x_dev_uid | |
| if not authorization or not authorization.startswith("Bearer "): | |
| raise HTTPException(status_code=401, detail="Missing bearer token") | |
| token = authorization[len("Bearer "):] | |
| try: | |
| claims = verify_id_token(token) | |
| except AuthError as exc: | |
| raise HTTPException(status_code=401, detail=f"Invalid token: {exc}") from exc | |
| # Password sign-ups must prove they own the address before touching anything real. | |
| if not claims.get("email_verified", False): | |
| raise HTTPException(status_code=403, detail="Email not verified") | |
| return claims["uid"] | |
| def current_email( | |
| authorization: str | None = Header(default=None), | |
| x_dev_email: str = Header(default="", alias="X-Dev-Email"), | |
| ) -> str: | |
| """The signed-in address (checked to be verified by current_uid). Used where an | |
| action depends on who the person is, such as accepting an invite.""" | |
| if not real_auth_enabled(): | |
| return x_dev_email | |
| if not authorization or not authorization.startswith("Bearer "): | |
| raise HTTPException(status_code=401, detail="Missing bearer token") | |
| try: | |
| claims = verify_id_token(authorization[len("Bearer "):]) | |
| except AuthError as exc: | |
| raise HTTPException(status_code=401, detail=f"Invalid token: {exc}") from exc | |
| return claims.get("email", "") | |
| def lookup_user(uid: str) -> dict: | |
| """{email, name} for a uid, best effort; empty when unknown or running locally.""" | |
| if not real_auth_enabled(): | |
| return {} | |
| try: | |
| get_app() | |
| record = firebase_auth.get_user(uid) | |
| except Exception: # noqa: BLE001 — a missing name must not break the team list | |
| return {} | |
| return {"email": record.email or "", "name": record.display_name or ""} | |