From ea923ffc6188a6520a1b37c0993804583ff02471 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dieter=20Schl=C3=BCter?= Date: Fri, 19 Jun 2026 01:24:04 +0200 Subject: [PATCH] fix(auth): require_admin akzeptiert jetzt auch SSO-Admin-Nutzer MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Vorher pruefte require_admin nur den X-Admin-Key-Header — SSO-Admins (aus ADMIN_USERS) bekamen 401. Das brach alle Admin-Panel-Tabs ausser der Nutzerliste im Browser. Co-Authored-By: Claude Sonnet 4.6 --- app/auth.py | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/app/auth.py b/app/auth.py index b8ff45d..8b7cad7 100644 --- a/app/auth.py +++ b/app/auth.py @@ -122,15 +122,21 @@ def require_user(request: Request) -> User: return user -def require_admin(x_admin_key: str | None = Header(default=None)) -> None: - """Schuetzt die Nutzerverwaltung ueber ADMIN_API_KEY (aus der Umgebung).""" +def require_admin( + request: Request, x_admin_key: str | None = Header(default=None) +) -> None: + """Schuetzt Admin-Endpunkte: ADMIN_API_KEY-Header ODER SSO-Admin-Nutzer.""" expected = settings.admin_api_key.strip() + if expected and x_admin_key and x_admin_key.strip() == expected: + return + client_host = request.client.host if request.client else "" + token = _bearer_token(request.headers.get("authorization")) + user = authenticate(request.headers, client_host, token) + if is_admin_user(user): + return if not expected: - raise HTTPException( - status_code=503, detail="Admin API not configured (ADMIN_API_KEY unset)" - ) - if not x_admin_key or x_admin_key.strip() != expected: - raise HTTPException(status_code=401, detail="Invalid admin key") + raise HTTPException(status_code=503, detail="Admin API not configured (ADMIN_API_KEY unset)") + raise HTTPException(status_code=401, detail="Admin privileges required") def require_admin_or_user(