mirror of
https://github.com/andrey271192/vps_monitoring.git
synced 2026-09-20 11:55:34 +00:00
f9f9195e14
- Validate Telegram WebApp initData using HMAC-SHA256 - Dual auth: cookie (web panel) OR X-Telegram-Init-Data header - Mini App sends initData with every API request - Retry button on auth failure instead of dead end Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
92 lines
2.6 KiB
Python
92 lines
2.6 KiB
Python
import hashlib
|
|
import hmac
|
|
import json
|
|
from datetime import datetime, timedelta
|
|
from urllib.parse import parse_qs
|
|
|
|
from jose import jwt
|
|
from passlib.context import CryptContext
|
|
from fastapi import Request, HTTPException
|
|
from fastapi.responses import RedirectResponse
|
|
from server.config import load_settings
|
|
|
|
SECRET_KEY = "vps-monitoring-secret-key-change-me-in-production"
|
|
ALGORITHM = "HS256"
|
|
TOKEN_EXPIRE_HOURS = 24
|
|
|
|
pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
|
|
|
|
|
|
def verify_password(plain_password: str, hashed_password: str) -> bool:
|
|
return plain_password == hashed_password
|
|
|
|
|
|
def create_token(username: str) -> str:
|
|
expire = datetime.utcnow() + timedelta(hours=TOKEN_EXPIRE_HOURS)
|
|
return jwt.encode({"sub": username, "exp": expire}, SECRET_KEY, algorithm=ALGORITHM)
|
|
|
|
|
|
def verify_token(token: str) -> str | None:
|
|
try:
|
|
payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
|
|
return payload.get("sub")
|
|
except Exception:
|
|
return None
|
|
|
|
|
|
def verify_telegram_init_data(init_data: str) -> bool:
|
|
"""Validate Telegram WebApp initData using bot token."""
|
|
settings = load_settings()
|
|
bot_token = settings.get("telegram_bot_token", "")
|
|
if not bot_token:
|
|
return False
|
|
|
|
try:
|
|
parsed = parse_qs(init_data)
|
|
received_hash = parsed.get("hash", [""])[0]
|
|
if not received_hash:
|
|
return False
|
|
|
|
# Build data-check-string
|
|
data_pairs = []
|
|
for key, values in parsed.items():
|
|
if key != "hash":
|
|
data_pairs.append(f"{key}={values[0]}")
|
|
data_pairs.sort()
|
|
data_check_string = "\n".join(data_pairs)
|
|
|
|
# HMAC-SHA256
|
|
secret_key = hmac.new(
|
|
b"WebAppData", bot_token.encode(), hashlib.sha256
|
|
).digest()
|
|
calculated_hash = hmac.new(
|
|
secret_key, data_check_string.encode(), hashlib.sha256
|
|
).hexdigest()
|
|
|
|
return calculated_hash == received_hash
|
|
except Exception:
|
|
return False
|
|
|
|
|
|
def get_current_user(request: Request) -> str | None:
|
|
# 1. Cookie auth
|
|
token = request.cookies.get("access_token")
|
|
if token:
|
|
user = verify_token(token)
|
|
if user:
|
|
return user
|
|
|
|
# 2. Telegram initData auth (header)
|
|
tg_init = request.headers.get("X-Telegram-Init-Data")
|
|
if tg_init and verify_telegram_init_data(tg_init):
|
|
return "telegram_user"
|
|
|
|
return None
|
|
|
|
|
|
def require_auth(request: Request):
|
|
user = get_current_user(request)
|
|
if not user:
|
|
raise HTTPException(status_code=401, detail="Not authenticated")
|
|
return user
|