Light1YT
3651c85f9b
Backend-side enforcement поверх Caddy basic_auth — defense-in-depth для
12-юзеров на gendsgn.ru (admin + kopylov + 10 пилотных слотов).
- `auth/roles.yaml` — single source of truth: 2 роли (admin, pilot)
+ 12 user→role mappings. Bind-mounted в обоих backend контейнерах.
- `app/core/auth.py` (main + tradein-mvp mirror) — YAML loader через
`pyyaml`, `get_role`/`get_user_scope`/`is_path_allowed` с fnmatch globs.
Custom `_glob_to_regex` чтобы `/**` ≠ `/*` (matches multi-segment paths).
- `GET /api/v1/me` (main + tradein) — фронт читает scope при login,
фильтрует nav по `allowed_paths`/`deny_paths`.
- `rbac_guard` middleware (main + tradein):
* любой non-public path требует `X-Authenticated-User` → иначе 401
* юзер должен быть в roles.yaml → иначе 403 («человек без ролей
вообще ничего не видит» — decided 2026-05-25)
* /api/v1/admin/* — только role=admin, иначе 403
- `Caddyfile` — `header_up X-Authenticated-User {http.auth.user.id}` в
6 reverse_proxy блоках (gendsgn.ru main + trade-in + git.gendsgn.ru).
- Tests: 20 unit + integration в обоих стэках. Покрытие:
no-header / unknown user / pilot / admin × admin-path / non-admin path.
`_build_test_app()` копирует middleware inline, чтобы обойти heavy
imports (weasyprint dlopen падает на macOS dev).
Public paths (/health, /docs, /redoc, /openapi.json) пропускаются —
X-Authenticated-User там просто не приходит из Caddy.
Frontend nav-filter + 403 fullscreen — отдельный PR B.
48 lines
1.7 KiB
TOML
48 lines
1.7 KiB
TOML
[project]
|
||
name = "tradein-mvp-backend"
|
||
version = "0.1.0"
|
||
description = "Trade-In Estimator MVP — standalone fork of gendesign trade-in feature"
|
||
requires-python = ">=3.12"
|
||
dependencies = [
|
||
"fastapi>=0.115.0",
|
||
"uvicorn[standard]>=0.30.0",
|
||
"sqlalchemy>=2.0.30",
|
||
"geoalchemy2>=0.15.0", # PostGIS support для SQLAlchemy
|
||
"pydantic>=2.7.0",
|
||
"pydantic-settings>=2.3.0",
|
||
"psycopg[binary]>=3.2.0",
|
||
"Pillow>=10.3.0", # photo sanitization re-encode (#6 audit fix)
|
||
"weasyprint>=62.0",
|
||
"jinja2>=3.1.0",
|
||
"httpx>=0.27.0", # для geocoder + scrapers
|
||
"tenacity>=9.0.0", # retry с exp backoff
|
||
"selectolax>=0.3.0", # быстрый HTML парсинг для scrapers
|
||
"segno>=1.6.0", # QR-код для PDF shareable URL
|
||
"curl-cffi>=0.7.0", # impersonate=chrome120 для Cian/Avito (TLS fingerprint)
|
||
"python-multipart>=0.0.9", # FastAPI UploadFile — загрузка фото квартиры (#394)
|
||
"sentry-sdk>=2.0.0", # мониторинг ошибок → GlitchTip (#396)
|
||
"redis>=5.0.0", # async hot cache для /api/v1/search (Phase 3.2)
|
||
"pyyaml>=6.0.0", # RBAC roles.yaml loader (app/core/auth.py)
|
||
]
|
||
|
||
[dependency-groups]
|
||
dev = [
|
||
"pytest>=8.0.0",
|
||
"pytest-asyncio>=0.24.0",
|
||
"ruff>=0.5.0",
|
||
"playwright>=1.45", # address-mismatch audit fallback (issue #582 Phase 1)
|
||
]
|
||
|
||
[tool.pytest.ini_options]
|
||
asyncio_mode = "auto"
|
||
|
||
[tool.setuptools.packages.find]
|
||
include = ["app*"]
|
||
|
||
[tool.ruff]
|
||
target-version = "py312"
|
||
line-length = 100
|
||
|
||
[tool.ruff.lint]
|
||
select = ["E", "F", "I", "B", "UP", "N", "RUF"]
|
||
ignore = ["RUF001", "RUF002", "RUF003"]
|