From ab8c1bab6a979f51f0962eb7d3523799102b26dd Mon Sep 17 00:00:00 2001 From: bot-backend Date: Wed, 5 Aug 2026 13:42:03 +0500 Subject: [PATCH] =?UTF-8?q?fix(tradein/auth):=20=D1=83=D0=B1=D1=80=D0=B0?= =?UTF-8?q?=D1=82=D1=8C=20=D1=83=D1=81=D1=82=D0=B0=D1=80=D0=B5=D0=B2=D1=88?= =?UTF-8?q?=D0=B5=D0=B5=20=C2=ABCaddy=20basic=5Fauth=20required=C2=BB=20?= =?UTF-8?q?=D0=B8=D0=B7=20401=20(#2573)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit basic_auth снят с /trade-in/* (#2555/#2558), но легаси-ветка отсутствующего идентификатора в rbac_guard (и её копии в me.py/trade_in.py) продолжала ссылаться на несуществующий гейт. Формулировка приведена к той, что уже отдают team-API и dual-off ветка самого rbac_guard: «valid session required». Лид «no authenticated user» сохранён — на него матчатся существующие тесты. Site Finder (root backend/) НЕ тронут: там basic_auth в Caddy жив, текст верен. Refs #2573 --- tradein-mvp/backend/app/api/v1/me.py | 2 +- tradein-mvp/backend/app/api/v1/trade_in.py | 4 ++-- tradein-mvp/backend/app/core/rbac.py | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/tradein-mvp/backend/app/api/v1/me.py b/tradein-mvp/backend/app/api/v1/me.py index ef1dac95..367b913e 100644 --- a/tradein-mvp/backend/app/api/v1/me.py +++ b/tradein-mvp/backend/app/api/v1/me.py @@ -78,7 +78,7 @@ async def me( if not x_authenticated_user: raise HTTPException( status_code=401, - detail="no authenticated user (Caddy basic_auth required)", + detail="no authenticated user (valid session required)", ) try: return get_user_scope(x_authenticated_user) diff --git a/tradein-mvp/backend/app/api/v1/trade_in.py b/tradein-mvp/backend/app/api/v1/trade_in.py index 853d9a1d..3bfa7e73 100644 --- a/tradein-mvp/backend/app/api/v1/trade_in.py +++ b/tradein-mvp/backend/app/api/v1/trade_in.py @@ -63,7 +63,7 @@ def _assert_estimate_access(created_by: str | None, x_authenticated_user: str | if not x_authenticated_user: raise HTTPException( status_code=401, - detail="no authenticated user (Caddy basic_auth required)", + detail="no authenticated user (valid session required)", ) from app.core.auth import get_role @@ -688,7 +688,7 @@ def estimate_history( if not x_authenticated_user: raise HTTPException( status_code=401, - detail="no authenticated user (Caddy basic_auth required)", + detail="no authenticated user (valid session required)", ) from app.core.auth import get_role diff --git a/tradein-mvp/backend/app/core/rbac.py b/tradein-mvp/backend/app/core/rbac.py index c391c366..e8c5fc04 100644 --- a/tradein-mvp/backend/app/core/rbac.py +++ b/tradein-mvp/backend/app/core/rbac.py @@ -222,7 +222,7 @@ async def rbac_guard( if not username: return JSONResponse( status_code=401, - content={"detail": "no authenticated user (Caddy basic_auth required)"}, + content={"detail": "no authenticated user (valid session required)"}, ) # #2213 defense-in-depth: если общий секрет задан — запрос с X-Authenticated-User