Phase 3 of Migration

backend/auth/dependencies.py

@@ -1,10 +1,14 @@
 from fastapi import Depends
 from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
 from jose import JWTError
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
 from auth.utils import decode_access_token
 from auth.models import TokenPayload, Role
+from database.postgres import get_pg_session
+from staff.orm import Staff
 from shared.exceptions import AuthenticationError, AuthorizationError
-from shared.firebase import get_db
 
 security = HTTPBearer()
 
@@ -37,18 +41,15 @@ def require_roles(*allowed_roles: Role):
     return role_checker
 
 
-async def _get_user_permissions(user: TokenPayload) -> dict:
-    """Fetch permissions from Firestore for the given user."""
+async def _get_user_permissions(user: TokenPayload, db: AsyncSession) -> dict | None:
+    """Fetch permissions from Postgres for the given user."""
     if user.role in (Role.sysadmin, Role.admin):
         return None  # Full access
-    db = get_db()
-    if not db:
+    result = await db.execute(select(Staff).where(Staff.id == user.sub).limit(1))
+    staff = result.scalar_one_or_none()
+    if staff is None:
         raise AuthorizationError()
-    doc = db.collection("admin_users").document(user.sub).get()
-    if not doc.exists:
-        raise AuthorizationError()
-    data = doc.to_dict()
-    return data.get("permissions")
+    return staff.permissions
 
 
 def require_permission(section: str, action: str):
@@ -58,17 +59,17 @@ def require_permission(section: str, action: str):
     """
     async def permission_checker(
         current_user: TokenPayload = Depends(get_current_user),
+        db: AsyncSession = Depends(get_pg_session),
     ) -> TokenPayload:
-        # sysadmin and admin have full access
         if current_user.role in (Role.sysadmin, Role.admin):
             return current_user
 
-        permissions = await _get_user_permissions(current_user)
+        permissions = await _get_user_permissions(current_user, db)
         if not permissions:
             raise AuthorizationError()
 
         if section == "mqtt":
-            if not permissions.get("mqtt", False):
+            if not permissions.get("mqtt", {}).get("access", False):
                 raise AuthorizationError()
             return current_user
 
@@ -89,11 +90,7 @@ def require_permission(section: str, action: str):
 # Pre-built convenience dependencies
 require_sysadmin = require_roles(Role.sysadmin)
 require_admin_or_above = require_roles(Role.sysadmin, Role.admin)
-
-# Staff management: only sysadmin and admin
 require_staff_management = require_roles(Role.sysadmin, Role.admin)
-
-# Viewer-level: any authenticated user (actual permission check per-action)
 require_any_authenticated = require_roles(
     Role.sysadmin, Role.admin, Role.editor, Role.user,
 )