Function validate_api_token

apps/api/src/security/auth.py:488–539

Validate an API token and return an APITokenUser if valid. Args: token: The full token string (lh_...) db_session: Database session Returns: APITokenUser if valid, None otherwise

(
    token: str,
    db_session: AsyncSession,
)

async def validate_api_token(
    token: str,
    db_session: AsyncSession,
) -> Optional[APITokenUser]:
    """
    Validate an API token and return an APITokenUser if valid.

    Args:
        token: The full token string (lh_...)
        db_session: Database session

    Returns:
        APITokenUser if valid, None otherwise
    """
    from src.services.api_tokens.api_tokens import validate_api_token_for_auth

    # Validate the token using the service
    api_token = await validate_api_token_for_auth(token, db_session)

    if not api_token:
        return None

    # Normalize rights to a plain dict of plain dicts so .get() works everywhere
    raw_rights = api_token.rights
    if raw_rights is None:
        rights = None
    elif isinstance(raw_rights, dict):
        # Already a dict, but inner values might be Pydantic models
        rights = {}
        for k, v in raw_rights.items():
            if isinstance(v, dict):
                rights[k] = v
            elif hasattr(v, 'model_dump'):
                rights[k] = v.model_dump()
            elif hasattr(v, 'dict'):
                rights[k] = v.dict()
            else:
                rights[k] = v
    else:
        # Full Pydantic Rights model
        rights = raw_rights.model_dump() if hasattr(raw_rights, 'model_dump') else raw_rights.dict()

    # Create and return an APITokenUser
    return APITokenUser(
        id=api_token.id,
        user_uuid=api_token.token_uuid,
        username=f"api_token_{api_token.name}",
        org_id=api_token.org_id,
        rights=rights,
        token_name=api_token.name,
        created_by_user_id=api_token.created_by_user_id,
    )


async def validate_superadmin_api_token(