
    }i                        d dl m Z mZ d dlmZmZ d dlmZ d dlmZm	Z	m
Z
 d dlmZmZ d dlmZ d dlmZ d dlZd	Z ej(                  d
e      Zeek(  rd dlZ ej.                  dd       dZdZ edgd      Z e       ZdededefdZdedefdZde defdZ!dede fdZ" ee       ee      fdedefdZ# ee#      fd Z$ ee#      fd!Z%y)"    )datetime	timedelta)JWTErrorjwt)CryptContext)DependsHTTPExceptionstatus)
HTTPBearerHTTPAuthorizationCredentials)Session)get_dbNzasim-scheduling-secret-key-2026
SECRET_KEYu   
⚠️  SECRET_KEY tidak diset di environment!
   Token JWT menggunakan kunci default yang tidak aman.
   Buat file .env dan set: SECRET_KEY=<random-string-panjang>
   )
stacklevelHS256i  bcryptauto)schemes
deprecatedplain_passwordhashed_passwordreturnc                 .    t         j                  | |      S N)pwd_contextverify)r   r   s     3/var/www/html/asim.com/backend/app/core/security.pyverify_passwordr      s    no>>    passwordc                 ,    t         j                  |       S r   )r   hash)r!   s    r   get_password_hashr$   !   s    H%%r    datac                     | j                         }t        j                         t        t              z   }|j                  d|i       t        j                  |t        t              S )N)minutesexp)	algorithm)
copyr   utcnowr   ACCESS_TOKEN_EXPIRE_MINUTESupdater   encoder   	ALGORITHM)r%   	to_encodeexpires      r   create_access_tokenr2   %   sI    		I__3N!OOFeV_%::iyAAr    tokenc                 D    t        j                  | t        t        g      S )N)
algorithms)r   decoder   r/   )r3   s    r   decode_tokenr7   ,   s    ::eZYK@@r    credentialsdbc                    ddl m} 	 t        | j                        }t	        |j                  d            }|j                  |      j                  |j                  |k(        j                         }|r|j                  st        t        j                  dddi      |S # t        $ r t        t        j                  dddi      w xY w)	z8Dependency: pastikan request punya token JWT yang valid.r   )Usersubz'Token tidak valid atau sudah kadaluarsazWWW-AuthenticateBearer)status_codedetailheadersz%Akun tidak aktif atau tidak ditemukan)app.models.userr;   r7   r8   intget	Exceptionr	   r
   HTTP_401_UNAUTHORIZEDqueryfilteridfirst	is_active)r8   r9   r;   payloaduser_idusers         r   get_current_userrN   0   s    
 %
{667gkk%() 88D>  G!34::<Dt~~44:'2
 	

 K  
44<'2
 	

s   /B   (Cc                 X    | j                   dvrt        t        j                  d      | S )z=Dependency: hanya pengurus atau super_admin yang boleh akses.)pengurussuper_adminz#Akses ditolak: hanya untuk pengurusr>   r?   roler	   r
   HTTP_403_FORBIDDENcurrent_users    r   require_pengurusrX   I   s2     ;;118
 	
 r    c                 Z    | j                   dk7  rt        t        j                  d      | S )z/Dependency: hanya super_admin yang boleh akses.rQ   z&Akses ditolak: hanya untuk super adminrR   rS   rV   s    r   require_super_adminrZ   S   s1    M)11;
 	
 r    )&r   r   joser   r   passlib.contextr   fastapir   r	   r
   fastapi.securityr   r   sqlalchemy.ormr   app.databaser   os_DEFAULT_KEYgetenvr   warningswarnr/   r,   r   bearer_schemestrboolr   r$   dictr2   r7   rN   rX   rZ    r    r   <module>rk      s   (  ( 2 2 E "  	0RYY|\2
HMM	J 	 	% H:&A?C ?# ?$ ?& & &Bd Bs BA A A
 180F&/-2 #**:";  &--=%> r    