optimize auth

auth.py

@@ -19,12 +19,7 @@ def get_current_user(credentials: HTTPAuthorizationCredentials = Depends(securit
             detail="Invalid authentication credentials",
             headers={"WWW-Authenticate": "Bearer"},
         )
-    if user.is_admin == 0:
-        raise HTTPException(
-            status_code=status.HTTP_403_FORBIDDEN,
-            detail="Have no permission",
-            headers={"WWW-Authenticate": "Bearer"},
-        )
+    
     return user
 
 def validate_token(token: str):

routers/users_v1.py

@@ -1,4 +1,4 @@
-from fastapi import APIRouter, Depends
+from fastapi import APIRouter, Depends, HTTPException, status
 from pydantic import BaseModel
 import uuid
 
@@ -25,6 +25,13 @@ class User(BaseModel):
 #     response = TbsDb(db_module_filename, "Cloudflare").get_list(query)
 #     return response
 async def read_user(current_user: UserModel = Depends(get_current_user)):
+    if current_user.is_admin == 0:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Have no permission",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+
     query = "SELECT * FROM users"
     response = TbsDb(db_module_filename, "Cloudflare").get_list(query)
     return response
@@ -47,6 +54,12 @@ async def create_user(user: UserModel):
 
 @router.get("/users/{id}")
 async def read_user(id:int, current_user: UserModel = Depends(get_current_user)):
+    if (current_user.is_admin == 0) and (current_user.id != id):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Have no permission",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
     query = f"SELECT * FROM users where id={id}"
     response = TbsDb(db_module_filename, "Cloudflare").get_item(query)
     return response