Merge pull request #200 from hotosm/feature/auth-staff

Users roles

API/auth/__init__.py

@@ -6,12 +6,13 @@
 from fastapi import Header, HTTPException, status
 
 from src.galaxy import config
-
+from src.galaxy.validation.models import UserRole
 
 class AuthUser(BaseModel):
     id: int
     username: str
     img_url: str
+    role: str
 
 
 class Login(BaseModel):
@@ -22,7 +23,7 @@ class Token(BaseModel):
     access_token: str
 
 
-def login_required(access_token: str = Header(...)):
+def deserialize_access_token(access_token: str):
     deserializer = URLSafeSerializer(config.get("OAUTH", "secret_key"))
 
     try:
@@ -41,3 +42,19 @@ def login_required(access_token: str = Header(...)):
         )
 
     return user_data
+
+
+def login_required(access_token: str = Header(...)):
+    return deserialize_access_token(access_token)
+
+
+def is_staff_member(access_token: str = Header(...)):
+    user_data = deserialize_access_token(access_token)
+
+    if UserRole[user_data["role"]] not in (UserRole.STAFF, UserRole.ADMIN):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED, detail="User is not staff member"
+        )
+
+    return user_data
+

API/auth/routers.py

@@ -5,7 +5,8 @@
 from requests_oauthlib import OAuth2Session
 
 from src.galaxy import config
-from . import AuthUser, Login, Token, login_required
+from src.galaxy.app import Underpass
+from . import AuthUser, Login, Token, login_required, is_staff_member
 
 router = APIRouter(prefix="/auth")
 
@@ -56,10 +57,14 @@ def callback(request: Request):
 
     serializer = URLSafeSerializer(config.get("OAUTH", "secret_key"))
 
+    user_id = data.get("id")
+    user_role =Underpass().get_user_role(user_id)
+
     user_data = {
-        "id": data.get("id"),
+        "id": user_id,
         "username": data.get("display_name"),
         "img_url": data.get("img").get("href") if data.get("img") else None,
+        "role": user_role.name,
     }
 
     token = serializer.dumps(user_data)
@@ -71,5 +76,5 @@ def callback(request: Request):
 
 
 @router.get("/me", response_model=AuthUser)
-def my_data(user_data: AuthUser = Depends(login_required)):
+def my_data(user_data: AuthUser = Depends(is_staff_member)):
     return user_data

migrations/00001.sql

@@ -0,0 +1,4 @@
+CREATE TABLE users_roles (
+	user_id BIGINT PRIMARY KEY,
+	role INTEGER NOT NULL
+);

src/galaxy/app.py

@@ -185,6 +185,19 @@ def training_list(self, params):
         return query_result
 
 
+    def get_user_role(self, user_id: int):
+        query = f"select role from users_roles where user_id = {user_id}"
+        query_result = self.database.executequery(query)
+
+        if len(query_result) == 0:
+            return UserRole.NONE
+
+        role_int = query_result[0]["role"]
+        user_role = UserRole(role_int)
+
+        return user_role
+
+
 class Insight:
     """This class connects to Insight database and responsible for all the Insight related functionality"""
 

src/galaxy/validation/models.py

@@ -536,3 +536,8 @@ def check_geometry_area(cls, value, values):
                 raise ValueError(f"""Polygon Area {int(area_km2)} Sq.KM is higher than {RAWDATA_CURRENT_POLYGON_AREA} Sq.KM""")
         return value
 
+class UserRole(Enum):
+    ADMIN = 1
+    STAFF = 2
+    NONE = 3
+