
    i                        d dl mZ d dlmZ d dlmZ d dlmZmZmZ d dl	Z	d dl
mZ d dlZd dlZd dlmZ dZdd	Zdd
ZddZ ed       G d d             Zed        ZddZddZddZddZddZddddd dZy)!    )annotations)contextmanager)	dataclass)datetime	timedeltatimezoneNPath)get_settings)prenotazionimenuhomemadec                 H    t        j                  t        j                        S N)r   nowr   utc     'apps/ordini/backend/app/core/tenancy.py_utcnowr      s    <<%%r   c                >    | j                         j                         S r   )striplower)values    r   _normalize_lookupr      s    ;;=  r   c                `   	 |j                  dd      \  }}}}|dk7  ry	 t        |      }t        j	                  |      }t        j	                  |      }t        j                  d| j                  d      ||      }	t        j                  |	|      S # t        $ r Y yw xY w# t        $ r Y yw xY w)N$   Fpbkdf2_sha256sha256zutf-8)
split
ValueErrorintbytesfromhexhashlibpbkdf2_hmacencodesecretscompare_digest)
passwordstored_hash	algorithmraw_iterationssalt_hex
digest_hex
iterationssaltexpected_digest	candidates
             r   _verify_passwordr5      s    :E:K:KCQR:S7	>8Z O#(
}}X&--
3 ##Hhoog.FjYI!!)_==    s"   B 5B! 	BB!	B-,B-T)frozenc                      e Zd ZU ded<   ded<   ded<   ded<   ded<   ded<   ded	<   ded
<   ded<   ded<   ded<   ded<   ded<   y)AuthContextstrtoken	tenant_idtenant_slugtenant_nameuser_id
user_email
str | Noneusername	user_nameroleztuple[str, ...]permissionsdatabase_urldefault_staffsourceN)__name__
__module____qualname____annotations__r   r   r   r8   r8   ,   sJ    JNLO
I  Kr   r8   c               #    K   t               } t        | j                        }|j                         sd  y t	        j
                  |      }t        j                  |_        	 | |j                          y # |j                          w xY wwr   )	r   r
   tenancy_registry_databaseexistssqlite3connectRowrow_factoryclose)settingsregistry_path
connections      r   _connect_registryrW   =   sn     ~H;;<M!
/J$[[J
s   AB"A7 &B7B		Bc                    dt        |        S )Nz
sqlite:///r	   )paths    r   _tenant_database_urlrZ   M   s    T
|$$r   c                    t               }t        | dddddd|j                  dd|j                  |j                  d	      S )
Nlegacy_ordinizlegacy-ordinizOrdini Legacylegacy_adminzlegacy@ordini.localownerordinir   	documentsr   r   fiscal_documentslegacyr:   r;   r<   r=   r>   r?   rA   rB   rC   rD   rE   rF   rG   )r   r8   rF   rE   )r:   rT   s     r   _build_legacy_contextre   Q   sO    ~H!##(((c**,, r   c                   | d   xs" | d   xs | d   xs t               j                  j                         }d| j                         v r| d   nd }t	               }| d   dv rd}n|| d   dk(  rt
        n	t	               }n}	 d	d l}|j                  |      }t        |t              rWg }|D ]E  }t        |xs d
      j                         j                         }	|	r|	|v r5|j                  |	       G t	        |      }t        || d   | d   | d   | d   | d   | d   | d   | d   |t        | d         |xs t               j                  d      S # t        $ r d }Y w xY w)NrB   rA   r=   permissions_jsonrC   >   r^   super_adminr_   staffr    r;   r<   r>   r?   database_pathtenantrd   )r   rF   r   keystupleDEFAULT_STAFF_PERMISSIONSjsonloads	Exception
isinstancelistr9   r   appendr8   rZ   )
rowr:   rF   rg   rD   rp   parsed
normalizeditemr   s
             r   _row_to_contextrz   d   s   %nZnC<NnR^R`RnRnuuwM2D
2Rs-.X\#(7K
6{..e		!36v;'3I/uw	ZZ 01F fd#$&J )DJB--/557 3!!%(	)
  
+Kk"&&I|$Zk"[)#o*>?#C|~'C'C   	F	s   E EEc                    | j                  d|f      j                         }|y t        j                  |d         }|t	               k  r$| j                  d|f       | j                          y t        ||      S )Na  
        SELECT
            sessions.token,
            sessions.tenant_id,
            sessions.user_id,
            sessions.expires_at,
            tenants.slug AS tenant_slug,
            tenants.name AS tenant_name,
            tenants.database_path AS database_path,
            users.email AS user_email,
            users.username AS username,
            users.name AS user_name,
            users.role AS role,
            users.permissions_json AS permissions_json
        FROM sessions
        JOIN tenants ON tenants.id = sessions.tenant_id
        JOIN users ON users.id = sessions.user_id
        WHERE sessions.token = ?
        LIMIT 1
        
expires_atz$DELETE FROM sessions WHERE token = ?)executefetchoner   fromisoformatr   commitrz   )rV   r:   rv   r|   s       r   _resolve_session_from_registryr      s    


	( 
+, hj- 0 {''L(9:JGIAE8L3&&r   c                    t               }|j                  r| |j                  k(  rt        |       S t               5 }|
	 d d d        y t	        ||       cd d d        S # 1 sw Y   y xY wr   )r   	api_tokenre   rW   r   )r:   rT   rV   s      r   resolve_tokenr      sl    ~Hex'9'99$U++		 A
A A .j%@	A A As   AAA&)
identifierr+   session_tokenc           	        t               }|r(t        |j                               }||S t        d      | xs dj                         }|xs dj                         }|r|rt	               5 }||j                  dt        |      t        |      f      j                         }|t        ||d         rt        j                  d      }	t               j                         }
t               t        |j                        z   j                         }|j                  d|	|d   |d	   |
|f       |j                          t!        ||	      cd d d        S d d d        t        d
      t        d      # 1 sw Y   t        d
      xY w)NzSessione gestionale non valida.rj   aL  
                    SELECT
                        users.id AS user_id,
                        users.tenant_id AS tenant_id,
                        users.email AS user_email,
                        users.username AS username,
                        users.name AS user_name,
                        users.role AS role,
                        users.permissions_json AS permissions_json,
                        users.password_hash AS password_hash,
                        tenants.slug AS tenant_slug,
                        tenants.name AS tenant_name,
                        tenants.database_path AS database_path
                    FROM users
                    JOIN tenants ON tenants.id = users.tenant_id
                    WHERE lower(users.email) = ? OR lower(users.username) = ?
                    LIMIT 1
                    password_hash    )hoursz
                        INSERT INTO sessions (token, tenant_id, user_id, created_at, expires_at)
                        VALUES (?, ?, ?, ?, ?)
                        r;   r>   zCredenziali non valide.zCInserisci le credenziali del gestionale oppure una sessione valida.)r   r   r   r"   rW   r}   r   r~   r5   r)   token_urlsafer   	isoformatr   tenancy_session_duration_hoursr   rz   )r   r+   r   rT   contextnormalized_identifiernormalized_passwordrV   userr:   
created_atr|   s               r   authenticate_loginr      s   ~H 3 3 56N:;;'-2446#>r002!4  $	8J%!))$ ''<=?PQf?gh'( (*) , #(89LdSbNc(d#11"5E!(!4!4!6J"))ih>e>e.f"f!q!q!sJ&& [ 14	?JPZ[ %%'*47I$	8 $	8 $	8L 233
Z
[[Q$	8L 233s   -CE11F)returnr   )r   r9   r   r9   )r+   r9   r,   r9   r   bool)rY   r9   r   r9   )r:   r9   r   r8   )rv   zsqlite3.Rowr:   r9   r   r8   )rV   zsqlite3.Connectionr:   r9   r   AuthContext | None)r:   r9   r   r   )r   r@   r+   r@   r   r@   r   r8   )
__future__r   
contextlibr   dataclassesr   r   r   r   r&   pathlibr
   r)   rO   app.core.configr   ro   r   r   r5   r8   rW   rZ   re   rz   r   r   r   r   r   r   <module>r      s    " % ! 2 2     (@ &!>( $     %&&R"'J	A 48PTrv 4\r   