update configuration docker setup for data platform

2026-05-07 17:57:42 +07:00
parent ce949dcc8f
commit 1dba772e62
53 changed files with 6732 additions and 24 deletions
--- a/03-apiservice/app/security/keycloak_auth.py
+++ b/03-apiservice/app/security/keycloak_auth.py
@@ -0,0 +1,146 @@
+"""
+Keycloak authentication for web pages
+Note: This is ONLY for web UI authentication, NOT for API endpoints
+API endpoints use API Key authentication (see app/security/dependencies.py)
+"""
+from typing import Optional
+from fastapi import HTTPException, Request, status
+from keycloak import KeycloakOpenID
+from app.core.config import settings
+import logging
+
+logger = logging.getLogger(__name__)
+
+# Initialize Keycloak OpenID client
+def get_keycloak_client() -> KeycloakOpenID:
+    """Get Keycloak OpenID client instance"""
+    try:
+        if settings.DEBUG_AUTH:
+            logger.info("=" * 80)
+            logger.info("KEYCLOAK CLIENT INITIALIZATION")
+            logger.info(f"Server URL: {settings.KEYCLOAK_SERVER_URL}")
+            logger.info(f"Realm: {settings.KEYCLOAK_REALM}")
+            logger.info(f"Client ID: {settings.KEYCLOAK_CLIENT_ID}")
+            logger.info(f"Client Secret: {'*' * len(settings.KEYCLOAK_CLIENT_SECRET) if settings.KEYCLOAK_CLIENT_SECRET else 'NOT SET'}")
+            logger.info(f"Redirect URI: {settings.KEYCLOAK_REDIRECT_URI}")
+            logger.info("=" * 80)
+        
+        return KeycloakOpenID(
+            server_url=settings.KEYCLOAK_SERVER_URL,
+            client_id=settings.KEYCLOAK_CLIENT_ID,
+            realm_name=settings.KEYCLOAK_REALM,
+            client_secret_key=settings.KEYCLOAK_CLIENT_SECRET,
+            verify=True
+        )
+    except Exception as e:
+        logger.error(f"Failed to initialize Keycloak client: {e}")
+        if settings.DEBUG_AUTH:
+            import traceback
+            logger.error(f"Traceback: {traceback.format_exc()}")
+        raise
+
+
+def get_current_user(request: Request) -> Optional[dict]:
+    """
+    Get current authenticated user from session
+    Returns None if not authenticated
+    """
+    return request.session.get("user")
+
+
+def require_user(request: Request) -> dict:
+    """
+    Dependency to require authenticated user
+    Raises 401 if not authenticated
+    """
+    user = get_current_user(request)
+    if not user:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Authentication required"
+        )
+    return user
+
+
+def get_login_url(redirect_to: str = "/") -> str:
+    """
+    Generate Keycloak login URL
+    
+    Args:
+        redirect_to: Path to redirect after successful login
+    
+    Returns:
+        Keycloak authorization URL
+    """
+    try:
+        if settings.DEBUG_AUTH:
+            logger.info("=" * 80)
+            logger.info("GENERATING LOGIN URL")
+            logger.info(f"Redirect to after login: {redirect_to}")
+            logger.info(f"Keycloak redirect URI: {settings.KEYCLOAK_REDIRECT_URI}")
+        
+        keycloak_client = get_keycloak_client()
+        auth_url = keycloak_client.auth_url(
+            redirect_uri=settings.KEYCLOAK_REDIRECT_URI,
+            state=redirect_to
+        )
+        
+        if settings.DEBUG_AUTH:
+            logger.info(f"Generated auth URL: {auth_url}")
+            logger.info("=" * 80)
+        
+        return auth_url
+    except Exception as e:
+        logger.error(f"Failed to generate login URL: {e}")
+        if settings.DEBUG_AUTH:
+            import traceback
+            logger.error(f"Traceback: {traceback.format_exc()}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail="Authentication service unavailable"
+        )
+
+
+async def verify_token(token: str) -> dict:
+    """
+    Verify and decode Keycloak access token
+    
+    Args:
+        token: Access token from Keycloak
+    
+    Returns:
+        User information from token
+    """
+    try:
+        keycloak_client = get_keycloak_client()
+        userinfo = keycloak_client.userinfo(token)
+        return userinfo
+    except Exception as e:
+        logger.error(f"Token verification failed: {e}")
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid or expired token"
+        )
+
+
+def get_logout_url(redirect_uri: str = None) -> str:
+    """
+    Generate Keycloak logout URL
+    
+    Args:
+        redirect_uri: Where to redirect after logout
+    
+    Returns:
+        Keycloak logout URL
+    """
+    try:
+        keycloak_client = get_keycloak_client()
+        if redirect_uri is None:
+            redirect_uri = f"{settings.ROOT_PATH}/" if settings.ROOT_PATH else "/"
+        
+        logout_url = keycloak_client.logout_url(redirect_uri=redirect_uri)
+        return logout_url
+    except Exception as e:
+        logger.error(f"Failed to generate logout URL: {e}")
+        # Return simple redirect if Keycloak logout fails
+        return redirect_uri or "/"