89 lines
3.2 KiB
Python
89 lines
3.2 KiB
Python
"""
|
|
control/panel/auth.py
|
|
---------------------
|
|
Superadmin authentication for the control panel (MT-4).
|
|
|
|
Uses Flask session directly (no Flask-Login) — the panel is a standalone
|
|
app with no dependency on the main app's login_manager.
|
|
|
|
Session key: 'sa_id' (superadmin.id when logged in)
|
|
"""
|
|
|
|
import logging
|
|
|
|
from flask import (
|
|
Blueprint, render_template, redirect, url_for,
|
|
request, session, flash,
|
|
)
|
|
|
|
from control.base import control_session
|
|
from control.models import Superadmin, TenantAudit
|
|
from control.time_utils import now_eastern
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
bp = Blueprint('auth', __name__)
|
|
|
|
|
|
def _log_audit(action, superadmin_id=None, tenant_id=None, details=None):
|
|
"""Write a TenantAudit row for superadmin actions."""
|
|
try:
|
|
ip = (request.headers.get('X-Forwarded-For', '').split(',')[0].strip()
|
|
or request.remote_addr)
|
|
with control_session() as s:
|
|
s.add(TenantAudit(
|
|
superadmin_id=superadmin_id,
|
|
action=action[:50],
|
|
tenant_id=tenant_id,
|
|
details=details,
|
|
ip_address=(ip or '')[:45],
|
|
created_at=now_eastern(),
|
|
))
|
|
except Exception as exc:
|
|
logger.error('TenantAudit write failed: %s', exc)
|
|
|
|
|
|
# ── Login ─────────────────────────────────────────────────────────────────────
|
|
|
|
@bp.route('/login', methods=['GET', 'POST'])
|
|
def login():
|
|
if session.get('sa_id'):
|
|
return redirect(url_for('tenants.list_tenants'))
|
|
|
|
error = None
|
|
if request.method == 'POST':
|
|
username = (request.form.get('username') or '').strip()
|
|
password = request.form.get('password') or ''
|
|
|
|
with control_session() as s:
|
|
sa = s.query(Superadmin).filter_by(username=username, active=True).first()
|
|
if sa and sa.check_password(password):
|
|
session.permanent = True
|
|
session['sa_id'] = sa.id
|
|
session['sa_username'] = sa.username
|
|
logger.info('PANEL | login | superadmin=%s', username)
|
|
_log_audit('LOGIN', superadmin_id=sa.id,
|
|
details=f'superadmin={username}')
|
|
flash(f'Welcome, {sa.username}!', 'success')
|
|
next_url = request.args.get('next') or url_for('tenants.list_tenants')
|
|
return redirect(next_url)
|
|
else:
|
|
logger.warning('PANEL | login_fail | username=%s', username)
|
|
error = 'Invalid credentials.'
|
|
|
|
return render_template('panel/login.html', error=error)
|
|
|
|
|
|
# ── Logout ────────────────────────────────────────────────────────────────────
|
|
|
|
@bp.route('/logout')
|
|
def logout():
|
|
sa_id = session.get('sa_id')
|
|
sa_name = session.get('sa_username', '?')
|
|
session.clear()
|
|
logger.info('PANEL | logout | superadmin=%s', sa_name)
|
|
if sa_id:
|
|
_log_audit('LOGOUT', superadmin_id=sa_id, details=f'superadmin={sa_name}')
|
|
flash('Logged out.', 'info')
|
|
return redirect(url_for('auth.login'))
|