Light1YT
3651c85f9b
Backend-side enforcement поверх Caddy basic_auth — defense-in-depth для
12-юзеров на gendsgn.ru (admin + kopylov + 10 пилотных слотов).
- `auth/roles.yaml` — single source of truth: 2 роли (admin, pilot)
+ 12 user→role mappings. Bind-mounted в обоих backend контейнерах.
- `app/core/auth.py` (main + tradein-mvp mirror) — YAML loader через
`pyyaml`, `get_role`/`get_user_scope`/`is_path_allowed` с fnmatch globs.
Custom `_glob_to_regex` чтобы `/**` ≠ `/*` (matches multi-segment paths).
- `GET /api/v1/me` (main + tradein) — фронт читает scope при login,
фильтрует nav по `allowed_paths`/`deny_paths`.
- `rbac_guard` middleware (main + tradein):
* любой non-public path требует `X-Authenticated-User` → иначе 401
* юзер должен быть в roles.yaml → иначе 403 («человек без ролей
вообще ничего не видит» — decided 2026-05-25)
* /api/v1/admin/* — только role=admin, иначе 403
- `Caddyfile` — `header_up X-Authenticated-User {http.auth.user.id}` в
6 reverse_proxy блоках (gendsgn.ru main + trade-in + git.gendsgn.ru).
- Tests: 20 unit + integration в обоих стэках. Покрытие:
no-header / unknown user / pilot / admin × admin-path / non-admin path.
`_build_test_app()` копирует middleware inline, чтобы обойти heavy
imports (weasyprint dlopen падает на macOS dev).
Public paths (/health, /docs, /redoc, /openapi.json) пропускаются —
X-Authenticated-User там просто не приходит из Caddy.
Frontend nav-filter + 403 fullscreen — отдельный PR B.
90 lines
2.6 KiB
TOML
90 lines
2.6 KiB
TOML
[project]
|
|
name = "gendesign-backend"
|
|
version = "0.1.0"
|
|
description = "Generative Design + Site Finder backend (FastAPI)"
|
|
requires-python = ">=3.12"
|
|
dependencies = [
|
|
"fastapi>=0.115.0",
|
|
"uvicorn[standard]>=0.30.0",
|
|
"sqlalchemy>=2.0.30",
|
|
"geoalchemy2>=0.15.0",
|
|
"alembic>=1.13.0",
|
|
"pydantic>=2.7.0",
|
|
"pydantic-settings>=2.3.0",
|
|
"psycopg[binary]>=3.2.0",
|
|
"shapely>=2.0.0",
|
|
"geopandas>=1.0.0",
|
|
"pyproj>=3.6.0",
|
|
"httpx>=0.27.0",
|
|
"redis>=5.0.0",
|
|
"celery>=5.4.0",
|
|
"playwright>=1.45.0",
|
|
"tenacity>=9.0.0",
|
|
"pillow>=10.4.0",
|
|
"weasyprint>=62.0",
|
|
"jinja2>=3.1.0",
|
|
"ezdxf>=1.3.0",
|
|
"openpyxl>=3.1.0",
|
|
"pandas>=2.2.0",
|
|
"numpy>=2.0.0",
|
|
"scikit-learn>=1.5.0",
|
|
"sentry-sdk[fastapi,celery,sqlalchemy,httpx]>=2.18.0",
|
|
"rosreestr2coord>=5.0.0",
|
|
"ijson>=3.2.0",
|
|
"pyyaml>=6.0.0", # RBAC roles.yaml loader (app/core/auth.py)
|
|
]
|
|
|
|
[dependency-groups]
|
|
dev = [
|
|
"pytest>=8.0.0",
|
|
"pytest-asyncio>=0.23.0",
|
|
"ruff>=0.5.0",
|
|
"mypy>=1.10.0",
|
|
"types-redis>=4.6.0",
|
|
"pre-commit>=3.7.0",
|
|
]
|
|
|
|
[tool.uv]
|
|
package = true
|
|
|
|
# Tell setuptools which directory IS the Python package.
|
|
# Without this, having both `app/`, `alembic/`, `db/` at top level confuses
|
|
# auto-discovery: "Multiple top-level packages discovered in a flat-layout".
|
|
# We only want to package `app/`. `alembic/` and `db/` are operational, not Python packages.
|
|
[tool.setuptools.packages.find]
|
|
include = ["app*"]
|
|
|
|
[tool.ruff]
|
|
target-version = "py312"
|
|
line-length = 100
|
|
|
|
[tool.ruff.lint]
|
|
select = ["E", "F", "I", "B", "UP", "N", "RUF", "ASYNC"]
|
|
# RUF001/002/003 — ambiguous Unicode (Cyrillic vs Latin lookalikes).
|
|
# Off because the project is Russian-language; comments/docstrings legitimately use Cyrillic.
|
|
ignore = ["RUF001", "RUF002", "RUF003"]
|
|
|
|
[tool.mypy]
|
|
python_version = "3.12"
|
|
strict_optional = true
|
|
warn_unused_ignores = true
|
|
|
|
# strict только для core-модулей (правило из памяти Validation_Findings_Apr25)
|
|
[[tool.mypy.overrides]]
|
|
module = [
|
|
"app.services.generative.geometry",
|
|
"app.services.generative.teap",
|
|
"app.services.generative.financial",
|
|
"app.services.site_finder.scorer",
|
|
]
|
|
strict = true
|
|
|
|
[tool.pytest.ini_options]
|
|
testpaths = ["tests"]
|
|
asyncio_mode = "auto"
|
|
addopts = ["-m", "not prod_smoke"]
|
|
markers = [
|
|
"slow: marks tests as slow (need real network, deselect with -m 'not slow')",
|
|
"prod_smoke: production smoke tests against live https://gendsgn.ru (run only post-deploy with -m prod_smoke)",
|
|
"integration: phantom column gate tests requiring TEST_DATABASE_URL (SSH tunnel to prod Postgres)",
|
|
]
|