dschlueter/my_voice_assistant_v2
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix(auth): require_admin akzeptiert jetzt auch SSO-Admin-Nutzer

Browse source 
Vorher pruefte require_admin nur den X-Admin-Key-Header — SSO-Admins
(aus ADMIN_USERS) bekamen 401. Das brach alle Admin-Panel-Tabs ausser
der Nutzerliste im Browser.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Dieter Schlüter 2026-06-19 01:24:04 +02:00
commit ea923ffc61
1 changed files with 13 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

20
app/auth.py
View file

@ -122,15 +122,21 @@ def require_user(request: Request) -> User:
return user return user
def require_admin(x_admin_key: str | None = Header(default=None)) -> None: def require_admin(
"""Schuetzt die Nutzerverwaltung ueber ADMIN_API_KEY (aus der Umgebung).""" request: Request, x_admin_key: str | None = Header(default=None)
) -> None:
"""Schuetzt Admin-Endpunkte: ADMIN_API_KEY-Header ODER SSO-Admin-Nutzer."""
expected = settings.admin_api_key.strip() expected = settings.admin_api_key.strip()
if expected and x_admin_key and x_admin_key.strip() == expected:
return
client_host = request.client.host if request.client else ""
token = _bearer_token(request.headers.get("authorization"))
user = authenticate(request.headers, client_host, token)
if is_admin_user(user):
return
if not expected: if not expected:
raise HTTPException( raise HTTPException(status_code=503, detail="Admin API not configured (ADMIN_API_KEY unset)")
status_code=503, detail="Admin API not configured (ADMIN_API_KEY unset)" raise HTTPException(status_code=401, detail="Admin privileges required")
)
if not x_admin_key or x_admin_key.strip() != expected:
raise HTTPException(status_code=401, detail="Invalid admin key")
def require_admin_or_user( def require_admin_or_user(