first commit

backend/app/voice_auth.py

@@ -0,0 +1,52 @@
+import uuid
+
+from fastapi import Cookie, Depends, Header, HTTPException, status
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from .api_key_auth import _extract_api_key, parse_api_token, verify_api_token
+from .api_keys_service import KEY_PREFIX
+from .auth import COOKIE_NAME, decode_token
+from .database import get_db
+from .models import ApiKey, UserAccount
+
+
+def current_voice_user(
+    urmi_session: str | None = Cookie(default=None, alias=COOKIE_NAME),
+    authorization: str | None = Header(default=None),
+    x_api_key: str | None = Header(default=None, alias="X-Api-Key"),
+    db: Session = Depends(get_db),
+) -> UserAccount:
+    if urmi_session:
+        payload = decode_token(urmi_session)
+        try:
+            user_id = uuid.UUID(payload["sub"])
+        except (KeyError, ValueError) as exc:
+            raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid session") from exc
+        user = db.scalar(select(UserAccount).where(UserAccount.id == user_id))
+        if user and user.status == "active":
+            return user
+
+    token = _extract_api_key(authorization, x_api_key)
+    if not token or not token.startswith(KEY_PREFIX):
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Authentication required")
+
+    parsed = parse_api_token(token)
+    if parsed:
+        key_id, _ = parsed
+        api_key = db.scalar(
+            select(ApiKey).where(ApiKey.id == key_id, ApiKey.revoked_at.is_(None))
+        )
+        if api_key and verify_api_token(token, api_key.key_hash):
+            user = db.scalar(select(UserAccount).where(UserAccount.id == api_key.user_id))
+            if user and user.status == "active":
+                return user
+
+    active_keys = db.scalars(select(ApiKey).where(ApiKey.revoked_at.is_(None))).all()
+    for api_key in active_keys:
+        if verify_api_token(token, api_key.key_hash):
+            user = db.scalar(select(UserAccount).where(UserAccount.id == api_key.user_id))
+            if user and user.status == "active":
+                return user
+
+    raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid credentials")