Function require_scope

astrbot/dashboard/api/auth.py:145–173

(request: Request, scope: str)

async def require_scope(request: Request, scope: str) -> AuthContext:
    raw_key = _extract_raw_api_key(request)
    if raw_key:
        return await _require_api_key_scope(request, raw_key, scope)

    token = _extract_dashboard_jwt(request)
    if not token:
        raise ApiError("Missing API key", status_code=401)
    try:
        payload = jwt.decode(
            token,
            request.app.state.jwt_secret,
            algorithms=["HS256"],
        )
    except jwt.ExpiredSignatureError as exc:
        raise ApiError("Token expired", status_code=401) from exc
    except jwt.InvalidTokenError as exc:
        auth_header = request.headers.get("Authorization", "").strip()
        if auth_header.startswith("Bearer "):
            try:
                return await _require_api_key_scope(request, token, scope)
            except ApiError as api_key_exc:
                raise api_key_exc from exc
        raise ApiError("Invalid token", status_code=401) from exc

    username = payload.get("username")
    if not isinstance(username, str) or not username.strip():
        raise ApiError("Invalid token", status_code=401)
    return AuthContext(username=username, scopes=["*"], via="jwt")


def get_auth_service(request: Request) -> AuthService: