xiaoxia-saas/apps/api/app/middleware/auth.py

"""
Authentication dependency compatibility layer.

Canonical bearer-token parsing lives in app.auth. This module re-exports
common auth dependencies for backward compatibility.
"""

from __future__ import annotations

import logging

from app.auth import AuthenticatedUser
from app.auth import get_current_user as get_authenticated_user
from app.dependencies import get_user_repository
from fastapi import Depends, HTTPException
from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer

logger = logging.getLogger(__name__)

from packages.domain.entities import User
from packages.ports.user_repository import UserRepository

optional_bearer_scheme = HTTPBearer(auto_error=False)


async def get_current_user(
    authenticated_user: AuthenticatedUser = Depends(get_authenticated_user),
) -> User:
    return authenticated_user.user


async def get_current_user_optional(
    credentials: HTTPAuthorizationCredentials | None = Depends(optional_bearer_scheme),
    user_repository: UserRepository = Depends(get_user_repository),
) -> User | None:
    if credentials is None:
        return None
    try:
        authenticated_user = await get_authenticated_user(credentials, user_repository)
    except HTTPException as exc:
        if exc.status_code >= 500:
            # 服务端错误不应被静默吞掉，记录日志
            logger.error("可选认证遇到服务端错误，status=%s", exc.status_code, exc_info=True)
        # 4xx 认证失败（如 token 无效、用户不存在）属于正常流程，返回 None
        return None
    return authenticated_user.user