Kevin_Ramirez
a1bbb6b1b2
Cada navegación al dashboard disparaba verify-license y auth/me contra el Hub sin ningún caché, sumando 1-6s por llamada del lado del Hub a cada request. - security.py: token_cache TTL 60s→300s (el access token vive más que el TTL anterior; cachear su verificación es seguro). - middleware.py: nuevo _license_ok_cache (TTLCache, 300s) en LicenseValidationMiddleware — SOLO cachea el camino "licencia válida" por tenant_override; inválida/expirada/error nunca se cachea y siempre revalida contra el Hub (fail-closed: el peor caso es que un tenant recién revocado siga pasando hasta 5 min más, nunca al revés).
347 lines
14 KiB
Python
347 lines
14 KiB
Python
import logging
|
|
import time
|
|
import httpx
|
|
from datetime import datetime, timezone
|
|
from typing import Callable, Optional
|
|
from fastapi import Request, Response
|
|
from fastapi.responses import JSONResponse
|
|
from starlette.middleware.base import BaseHTTPMiddleware
|
|
from cachetools import TTLCache
|
|
|
|
from .config import settings
|
|
from .security import get_tenant_from_token, verify_token, get_active_system
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
# Cache de licencia VÁLIDA por tenant (evita golpear verify-license del Hub en cada
|
|
# request). Solo el camino "válida" se cachea — inválida/expirada/error nunca se
|
|
# cachean y siempre revalidan contra el Hub (fail-closed: lo peor que puede pasar es
|
|
# que un tenant recién revocado siga pasando hasta 5 min más, nunca al revés).
|
|
_LICENSE_OK_TTL_SECONDS = 300
|
|
_license_ok_cache: TTLCache = TTLCache(maxsize=1000, ttl=_LICENSE_OK_TTL_SECONDS)
|
|
|
|
|
|
def _normalize_text(value: str | None) -> str:
|
|
if not value:
|
|
return ""
|
|
return str(value).strip().lower()
|
|
|
|
|
|
def _is_token_issue_message(*values: str | None) -> bool:
|
|
text = " ".join(_normalize_text(v) for v in values if v)
|
|
if not text:
|
|
return False
|
|
|
|
token_markers = ["token", "jwt", "bearer", "access"]
|
|
invalid_markers = [
|
|
"invalido", "inválido", "invalid", "not valid", "malformed", "signature", "unauthorized"
|
|
]
|
|
expired_markers = ["expirado", "expirada", "expired", "has expired", "caducado", "vencido"]
|
|
|
|
has_token_context = any(marker in text for marker in token_markers)
|
|
has_invalid_marker = any(marker in text for marker in invalid_markers)
|
|
has_expired_marker = any(marker in text for marker in expired_markers)
|
|
|
|
return (has_expired_marker and has_token_context) or (has_token_context and has_invalid_marker)
|
|
|
|
|
|
def _extract_company_id(request: Request) -> Optional[int]:
|
|
"""Obtiene ``company_id`` activa desde header ``X-Company-Id`` o cookie.
|
|
|
|
El frontend guarda la compañía activa en la cookie ``active_company_id``
|
|
(ver ``frontend/src/lib/stores/company.svelte.ts``). El header es la
|
|
ruta explícita para clientes no-browser.
|
|
"""
|
|
header_value = request.headers.get("X-Company-Id")
|
|
raw = header_value or request.cookies.get("active_company_id")
|
|
if not raw:
|
|
return None
|
|
try:
|
|
return int(raw)
|
|
except (TypeError, ValueError):
|
|
return None
|
|
|
|
|
|
class TenantMiddleware(BaseHTTPMiddleware):
|
|
"""
|
|
Middleware original para extraer tenant_id y user_info del token.
|
|
"""
|
|
async def dispatch(self, request: Request, call_next: Callable):
|
|
doc_prefixes = ["/api/redoc", "/api/openapi.json"]
|
|
public_prefixes = [
|
|
"/api/v1/auth",
|
|
"/api/v1/status",
|
|
"/api/health",
|
|
"/api/",
|
|
"/uploads",
|
|
"/api/v1/core/help-center",
|
|
"/api/v1/core/users/avatar",
|
|
]
|
|
|
|
path = request.url.path
|
|
|
|
if any(path == prefix or path.startswith(prefix + "/") for prefix in doc_prefixes):
|
|
return await call_next(request)
|
|
|
|
if any(path == prefix or (prefix != "/" and path.startswith(prefix)) for prefix in public_prefixes):
|
|
return await call_next(request)
|
|
|
|
auth_header = request.headers.get("Authorization")
|
|
if not auth_header or not auth_header.startswith("Bearer "):
|
|
return JSONResponse(
|
|
status_code=401,
|
|
content={
|
|
"error": "HTTP_ERROR",
|
|
"message": "Missing or invalid authorization header",
|
|
"status_code": 401,
|
|
}
|
|
)
|
|
|
|
token = auth_header.split(" ")[1]
|
|
try:
|
|
user_info = await verify_token(token)
|
|
tenant_id = get_tenant_from_token(user_info)
|
|
|
|
request.state.tenant_id = tenant_id
|
|
request.state.user_info = user_info
|
|
request.state.company_id = _extract_company_id(request)
|
|
request.state.active_system = get_active_system(request)
|
|
except Exception as e:
|
|
logger.error(f"❌ Tenant validation error: {str(e)}")
|
|
return JSONResponse(
|
|
status_code=401,
|
|
content={
|
|
"error": "HTTP_ERROR",
|
|
"message": "Invalid authentication",
|
|
"status_code": 401,
|
|
}
|
|
)
|
|
|
|
return await call_next(request)
|
|
|
|
|
|
class LicenseValidationMiddleware(BaseHTTPMiddleware):
|
|
"""
|
|
Middleware que valida la licencia contra el Hub de Aduanasoft.
|
|
El Hub siempre es requerido — tanto en SaaS como en self-hosted.
|
|
Fail-closed: si el Hub no responde o la licencia es inválida, se bloquea el acceso.
|
|
"""
|
|
async def dispatch(self, request: Request, call_next: Callable):
|
|
# En modo local (DEV_LOCAL_AUTH) no hay Hub — saltar validación de licencia.
|
|
if settings.DEV_LOCAL_AUTH:
|
|
return await call_next(request)
|
|
|
|
exempt_paths = [
|
|
"/api/docs", "/api/redoc", "/openapi.json",
|
|
"/api/v1/auth", "/api/v1/status", "/api/health",
|
|
"/api/v1/core/help-center",
|
|
"/api/v1/core/users/avatar",
|
|
]
|
|
|
|
is_exempt = any(
|
|
request.url.path == path or (path != "/" and request.url.path.startswith(path))
|
|
for path in exempt_paths
|
|
)
|
|
|
|
if is_exempt:
|
|
return await call_next(request)
|
|
|
|
auth_header = request.headers.get("Authorization")
|
|
if not auth_header or not auth_header.startswith("Bearer "):
|
|
# Permitimos pasar para que TenantMiddleware maneje el 401
|
|
return await call_next(request)
|
|
|
|
token = auth_header.split(" ")[1]
|
|
|
|
tenant_override = request.headers.get("X-Tenant-Override")
|
|
if not tenant_override:
|
|
# Fallback para flujos SSO cuando el override no viaja en header.
|
|
tenant_override = request.cookies.get("sso_tenant_id") or request.cookies.get("sso_tenant_pub")
|
|
|
|
# TenantMiddleware (corre antes) ya resolvió el token y dejó tenant en user_info.
|
|
# Sin esto, Swagger/curl sin cookies SSO llaman verify-license sin contexto y el Hub
|
|
# puede devolver 401 aunque /auth/me con el mismo Bearer responda 200.
|
|
if not tenant_override:
|
|
user_info = getattr(request.state, "user_info", None)
|
|
if isinstance(user_info, dict):
|
|
tid = user_info.get("tenant_id")
|
|
if tid is not None and str(tid).strip() != "":
|
|
tenant_override = str(tid)
|
|
|
|
# Licencia ya confirmada válida hace poco para este tenant — no volver a
|
|
# golpear al Hub (ver definición de _license_ok_cache arriba).
|
|
if tenant_override and tenant_override in _license_ok_cache:
|
|
return await call_next(request)
|
|
|
|
hub_headers = {"Authorization": f"Bearer {token}"}
|
|
if tenant_override:
|
|
hub_headers["X-Tenant-Override"] = str(tenant_override)
|
|
logger.info("[license] tenant override propagated to Hub: %s", tenant_override)
|
|
|
|
# Solo la petición HTTP al Hub va en try: los errores de rutas (p. ej. ContextVar RLS)
|
|
# deben propagarse y no etiquetarse como fallo de licencia.
|
|
try:
|
|
async with httpx.AsyncClient(timeout=5.0) as client:
|
|
response = await client.get(
|
|
f"{settings.HUB_URL}api/v1/auth/verify-license",
|
|
headers=hub_headers
|
|
)
|
|
except (httpx.ConnectError, httpx.TimeoutException) as e:
|
|
logger.critical(f"❌ CRITICAL: Hub unreachable: {str(e)}")
|
|
return JSONResponse(
|
|
status_code=503,
|
|
content={
|
|
"error": "HUB_OFFLINE",
|
|
"message": "Servicio de licencias fuera de línea. Acceso denegado.",
|
|
"status_code": 503,
|
|
}
|
|
)
|
|
except Exception as e:
|
|
logger.exception("Hub verify-license request failed: %s", e)
|
|
return JSONResponse(
|
|
status_code=500,
|
|
content={
|
|
"error": "VALIDATION_ERROR",
|
|
"message": "Error interno al contactar el servicio de licencias.",
|
|
"status_code": 500,
|
|
}
|
|
)
|
|
|
|
if response.status_code == 404:
|
|
# Endpoint no existe en este Hub — dejar pasar
|
|
return await call_next(request)
|
|
|
|
if response.status_code == 200:
|
|
try:
|
|
data = response.json()
|
|
except Exception as e:
|
|
logger.error(f"Hub verify-license JSON parse failed: {str(e)}")
|
|
return JSONResponse(
|
|
status_code=503,
|
|
content={
|
|
"error": "HUB_ERROR",
|
|
"message": "Respuesta inválida del servidor de licencias.",
|
|
"status_code": 503,
|
|
}
|
|
)
|
|
|
|
# Escenario 1: sin licencia asignada o licencia inactiva
|
|
if not data.get("valid", False):
|
|
message = data.get("message", "Sin licencia asignada para este tenant")
|
|
detail = data.get("detail")
|
|
reason = data.get("reason")
|
|
# Si el Hub reporta token inválido/expirado, devolver 401 para que
|
|
# el frontend dispare el auto-refresh (solo se activa con 401/403, no 402).
|
|
if _is_token_issue_message(message, detail, reason):
|
|
logger.warning(
|
|
"[license] token expirado/invalido detectado por verify-license; devolviendo 401 para silent refresh | message=%s detail=%s reason=%s",
|
|
message,
|
|
detail,
|
|
reason,
|
|
)
|
|
return JSONResponse(
|
|
status_code=401,
|
|
content={
|
|
"error": "TOKEN_EXPIRED",
|
|
"message": message,
|
|
"status_code": 401,
|
|
}
|
|
)
|
|
|
|
logger.warning(
|
|
"[license] licencia invalida para tenant=%s | message=%s",
|
|
data.get("tenant_slug"),
|
|
message,
|
|
)
|
|
return JSONResponse(
|
|
status_code=402,
|
|
content={
|
|
"error": "LICENSE_ERROR",
|
|
"message": message,
|
|
"status_code": 402,
|
|
}
|
|
)
|
|
|
|
# Escenario 2: licencia vencida (verificación local de expires_at)
|
|
expires_at_str = data.get("expires_at")
|
|
if expires_at_str:
|
|
try:
|
|
expires_at = datetime.fromisoformat(expires_at_str.replace("Z", "+00:00"))
|
|
if expires_at.tzinfo is None:
|
|
expires_at = expires_at.replace(tzinfo=timezone.utc)
|
|
if expires_at < datetime.now(timezone.utc):
|
|
logger.warning(
|
|
"[license] licencia expirada para tenant=%s | expires_at=%s",
|
|
data.get("tenant_slug"),
|
|
expires_at_str,
|
|
)
|
|
return JSONResponse(
|
|
status_code=402,
|
|
content={
|
|
"error": "LICENSE_EXPIRED",
|
|
"message": f"La licencia venció el {expires_at.strftime('%d/%m/%Y')}. Renueva tu suscripción.",
|
|
"status_code": 402,
|
|
}
|
|
)
|
|
except (ValueError, TypeError):
|
|
pass # Si no se puede parsear, dejamos pasar — el Hub es la fuente de verdad
|
|
|
|
request.state.license_info = data
|
|
if tenant_override:
|
|
_license_ok_cache[tenant_override] = True
|
|
return await call_next(request)
|
|
|
|
if response.status_code == 401:
|
|
logger.warning("[license] Hub verify-license devolvio 401 (token invalido/expirado)")
|
|
return JSONResponse(
|
|
status_code=401,
|
|
content={
|
|
"error": "TOKEN_EXPIRED",
|
|
"message": "Token inválido o expirado.",
|
|
"status_code": 401,
|
|
}
|
|
)
|
|
|
|
if response.status_code == 403:
|
|
return JSONResponse(
|
|
status_code=403,
|
|
content={
|
|
"error": "FORBIDDEN",
|
|
"message": "El Tenant no tiene permisos en el Hub central.",
|
|
"status_code": 403,
|
|
}
|
|
)
|
|
|
|
logger.error(f"Hub error status: {response.status_code}")
|
|
return JSONResponse(
|
|
status_code=503,
|
|
content={
|
|
"error": "HUB_ERROR",
|
|
"message": "Error en el servidor de licencias.",
|
|
"status_code": 503,
|
|
}
|
|
)
|
|
|
|
|
|
class RequestLoggingMiddleware(BaseHTTPMiddleware):
|
|
"""
|
|
Middleware original para logging de performance.
|
|
"""
|
|
async def dispatch(self, request: Request, call_next: Callable):
|
|
start_time = time.time()
|
|
excluded_paths = ["/api/docs", "/api/redoc", "/openapi.json", "/api/v1/status", "/api/health"]
|
|
|
|
if any(request.url.path == path or request.url.path.startswith(path + "/") for path in excluded_paths):
|
|
return await call_next(request)
|
|
|
|
logger.info(f"Request: {request.method} {request.url.path}")
|
|
response = await call_next(request)
|
|
process_time = time.time() - start_time
|
|
|
|
logger.info(
|
|
f"Response: {request.method} {request.url.path} "
|
|
f"Status: {response.status_code} "
|
|
f"Duration: {process_time:.3f}s"
|
|
)
|
|
response.headers["X-Process-Time"] = str(process_time)
|
|
return response |