SEP-952: Unify auth in get_current_user() — accept Bearer token and cookie (#555)

Updated SEP auth to support Bearer-first with cookie fallback during SPA
migration, and aligned SEP error/static handling plus tests to preserve
correct API vs HTML behavior.

- `app/sep/deps.py`: composed `get_current_user` to try `oauth2_scheme`
+ `app.api.deps.get_current_user first`, then fall back to cookie auth
(`get_current_user_from_cookie`) without changing legacy cookie redirect
behavior.
- `app/sep/main.py`: updated SEP default `HTTPException` handling to
return JSON for Bearer-authenticated requests instead of redirecting, so
SPA/API clients receive proper 401/403 responses.
- `app/sep/utils/static.py`: simplified `AuthenticatedStaticFiles` to
use unified `get_current_user(request)` instead of maintaining separate
Bearer/cookie logic.

---------

Co-authored-by: Yan Orestes <yan.orestes@percona.com>

Author: peter-o-addo

app/sep/deps.py

@@ -26,6 +26,8 @@
 from pydantic import ValidationError
 from sqlmodel.ext.asyncio.session import AsyncSession
 
+from app.api.deps import get_current_user as get_current_user_api
+from app.api.deps import oauth2_scheme
 from app.core.alerts.config import alert_settings
 from app.core.auth.exceptions import HTTPForbiddenException
 from app.core.auth.utils import get_user_model
@@ -123,17 +125,18 @@ def get_access_token_from_cookie(
 AccessTokenCookie = Annotated[str, Depends(get_access_token_from_cookie)]
 
 
-async def get_current_user(
-    request: Request,
-) -> User:
-    """Return the authenticated user from a cookie token.
+async def get_current_user_from_cookie(request: Request) -> User:
+    """Return the authenticated user from the signed session cookie.
 
-    :param request: The HTTP request object from which the base URL is derived.
+    Loads and verifies the session cookie, decodes the JWT into a user, and
+    rejects inactive accounts with a login redirect (legacy Jinja2 behavior).
+
+    :param request: The incoming HTTP request.
     :type request: Request
     :return: The authenticated user.
     :rtype: User
-    :raises LoginRedirectException: If the token is invalid or the user is
-        inactive.
+    :raises LoginRedirectException: If the cookie or JWT is invalid or the user
+        is inactive.
     """
     token = get_access_token_from_cookie(request)
     try:
@@ -149,6 +152,49 @@ async def get_current_user(
     return user
 
 
+def is_bearer_authenticated(request: Request) -> bool:
+    """Return whether the request carries an ``Authorization: Bearer`` header.
+
+    Inspects only the ``Authorization`` header prefix — the token itself is not
+    validated. Intended as a routing signal to pick between Bearer and cookie
+    authentication, and to render API-style error responses for SPA clients.
+
+    :param request: The incoming HTTP request.
+    :type request: Request
+    :return: ``True`` when the header starts with ``Bearer ``, ``False`` otherwise.
+    :rtype: bool
+    """
+    return request.headers.get("authorization", "").lower().startswith("bearer ")
+
+
+async def get_current_user(
+    request: Request,
+) -> User:
+    """Return the authenticated user from a Bearer token or session cookie.
+
+    The ``Authorization: Bearer`` header is tried first (React SPA) and, when
+    present, failures from :func:`app.api.deps.get_current_user` are raised as
+    HTTP API errors (401/403) rather than converted into a login redirect —
+    including the case of a malformed/empty Bearer token. When the header is
+    absent, authentication falls back to the signed session cookie (legacy
+    Jinja2).
+
+    :param request: The incoming HTTP request.
+    :type request: Request
+    :return: The authenticated user.
+    :rtype: User
+    :raises HTTPUnauthorizedException: If a Bearer token is present but invalid.
+    :raises HTTPForbiddenException: If the user resolved from Bearer is inactive.
+    :raises LoginRedirectException: If cookie-based auth fails or the cookie user
+        is inactive.
+    """
+    if is_bearer_authenticated(request):
+        bearer_token = await oauth2_scheme(request)
+        return await get_current_user_api(bearer_token)
+
+    return await get_current_user_from_cookie(request)
+
+
 IsAuthenticated = Depends(get_current_user)
 CurrentUser = Annotated[User, IsAuthenticated]
 

app/sep/main.py

@@ -45,6 +45,7 @@
     get_current_user,
     get_default_context,
     get_tasks_index_context,
+    is_bearer_authenticated,
     IsAuthenticated,
     IsCsrfValidated,
     IsNotAuthenticated,
@@ -263,11 +264,11 @@ async def json_exception_handler(
 
 
 @sep_app.exception_handler(HTTPException)
-async def default_exception_handler(
-    request: Request, exc: HTTPException
-) -> RedirectResponse:
+async def default_exception_handler(request: Request, exc: HTTPException) -> Response:
     """Define default exception handler."""
-    if request.url.path.startswith("/checksums/api/"):
+    if request.url.path.startswith("/checksums/api/") or is_bearer_authenticated(
+        request
+    ):
         return JSONResponse(
             {"detail": exc.detail},
             status_code=exc.status_code,

app/sep/utils/static.py

@@ -15,12 +15,10 @@
 
 """Define utilities regarding static files."""
 
-from fastapi import HTTPException, Request
+from fastapi import Request
 from starlette.staticfiles import StaticFiles
 from starlette.types import Receive, Scope, Send
 
-from app.api.deps import get_current_user as get_current_user_api
-from app.api.deps import oauth2_scheme
 from app.sep.deps import get_current_user
 
 
@@ -43,9 +41,5 @@ async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
         """
         if scope["type"] == "http":
             request = Request(scope, receive, send)
-            try:
-                token = await oauth2_scheme(request)
-                await get_current_user_api(token)
-            except HTTPException:
-                await get_current_user(request)
+            await get_current_user(request)
         await super().__call__(scope, receive, send)

changelog.d/SEP-952.changed.md

@@ -0,0 +1 @@
+SEP authentication now accepts `Authorization: Bearer` tokens in addition to the signed session cookie. API/SPA consumers receive 401/403 JSON on auth failure instead of a 303 redirect to `/login`; cookie-authenticated Jinja2 requests continue to redirect as before.

tests/app/sep/test_deps.py

@@ -23,7 +23,10 @@
 from itsdangerous import BadSignature
 from pydantic import ValidationError
 
-from app.core.auth.exceptions import HTTPForbiddenException
+from app.core.auth.exceptions import (
+    HTTPForbiddenException,
+    HTTPUnauthorizedException,
+)
 from app.core.exceptions import HTTPConflictException, HTTPNotFoundException
 from app.models import CasdoorUser
 from app.sep.config import sep_settings
@@ -68,11 +71,18 @@
 EXPECTED_NODE_COUNT = 5
 
 
-def _make_request() -> Request:
-    """Build a minimal Request with messages state for testing."""
+def _make_request(authorization: str | None = None) -> Request:
+    """Build a minimal Request with messages state for testing.
+
+    :param authorization: Value for the ``Authorization`` header, if any.
+    :type authorization: str | None
+    """
+    headers = []
+    if authorization is not None:
+        headers.append((b"authorization", authorization.encode()))
     scope = {
         "type": "http",
-        "headers": [],
+        "headers": headers,
         "client": ("127.0.0.1", "80"),
         "path": "/",
         "app": MagicMock(),
@@ -98,6 +108,134 @@ def test_returns_setting_when_configured(self) -> None:
 class TestGetCurrentUser:
     """Test get_current_user dependency."""
 
+    @pytest.mark.asyncio
+    async def test_valid_bearer_returns_user(self) -> None:
+        """Assert a valid Bearer path returns the user from the API dependency."""
+        request = _make_request(authorization="Bearer bearer-token")
+        active_user = CasdoorUserFactory.build(is_forbidden=False)
+        mock_oauth2 = AsyncMock(return_value="bearer-token")
+        mock_api_user = AsyncMock(return_value=active_user)
+        with (
+            patch("app.sep.deps.oauth2_scheme", mock_oauth2),
+            patch("app.sep.deps.get_current_user_api", mock_api_user),
+            patch(
+                "app.sep.deps.get_access_token_from_cookie",
+                side_effect=AssertionError(
+                    "cookie must not be read when Bearer succeeds"
+                ),
+            ),
+        ):
+            result = await get_current_user(request)
+        assert result is active_user
+        mock_oauth2.assert_awaited_once_with(request)
+        mock_api_user.assert_awaited_once_with("bearer-token")
+
+    @pytest.mark.asyncio
+    async def test_valid_cookie_returns_user(self) -> None:
+        """Assert cookie-only auth still returns an active user."""
+        request = _make_request()
+        active_user = CasdoorUserFactory.build(is_forbidden=False)
+        with (
+            patch(
+                "app.sep.deps.oauth2_scheme",
+                AsyncMock(
+                    side_effect=AssertionError(
+                        "oauth2_scheme must not be called without a Bearer header"
+                    )
+                ),
+            ),
+            patch(
+                "app.sep.deps.get_access_token_from_cookie", return_value="cookie-token"
+            ),
+            patch.object(CasdoorUser, "from_jwt", return_value=active_user),
+        ):
+            result = await get_current_user(request)
+        assert result is active_user
+
+    @pytest.mark.asyncio
+    async def test_bearer_and_cookie_present_bearer_wins(self) -> None:
+        """Assert Authorization Bearer is preferred over session cookie."""
+        request = _make_request(authorization="Bearer bearer-token")
+        bearer_user = CasdoorUserFactory.build(username="bearer-user")
+        cookie_user = CasdoorUserFactory.build(username="cookie-user")
+        with (
+            patch("app.sep.deps.oauth2_scheme", AsyncMock(return_value="bearer-token")),
+            patch(
+                "app.sep.deps.get_current_user_api", AsyncMock(return_value=bearer_user)
+            ),
+            patch(
+                "app.sep.deps.get_access_token_from_cookie",
+                return_value="cookie-token",
+            ),
+            patch.object(
+                CasdoorUser,
+                "from_jwt",
+                return_value=cookie_user,
+            ),
+        ):
+            result = await get_current_user(request)
+        assert result.username == "bearer-user"
+
+    @pytest.mark.asyncio
+    async def test_neither_bearer_nor_cookie_raises_redirect(self) -> None:
+        """Assert missing Bearer and missing cookie raises LoginRedirectException."""
+        request = _make_request()
+        with (
+            patch(
+                "app.sep.deps.get_access_token_from_cookie",
+                side_effect=LoginRedirectException(request),
+            ),
+            pytest.raises(LoginRedirectException),
+        ):
+            await get_current_user(request)
+
+    @pytest.mark.asyncio
+    async def test_invalid_bearer_raises_unauthorized(self) -> None:
+        """Assert invalid JWT via Bearer raises HTTPUnauthorizedException."""
+        request = _make_request(authorization="Bearer bad-token")
+        with (
+            patch("app.sep.deps.oauth2_scheme", AsyncMock(return_value="bad-token")),
+            patch(
+                "app.sep.deps.get_current_user_api",
+                AsyncMock(side_effect=HTTPUnauthorizedException),
+            ),
+            pytest.raises(HTTPUnauthorizedException),
+        ):
+            await get_current_user(request)
+
+    @pytest.mark.asyncio
+    async def test_inactive_user_via_bearer_raises_forbidden(self) -> None:
+        """Assert inactive user resolved via Bearer raises HTTPForbiddenException."""
+        request = _make_request(authorization="Bearer token")
+        with (
+            patch("app.sep.deps.oauth2_scheme", AsyncMock(return_value="token")),
+            patch(
+                "app.sep.deps.get_current_user_api",
+                AsyncMock(side_effect=HTTPForbiddenException("User is not active")),
+            ),
+            pytest.raises(HTTPForbiddenException),
+        ):
+            await get_current_user(request)
+
+    @pytest.mark.asyncio
+    async def test_malformed_bearer_header_does_not_fall_back_to_cookie(self) -> None:
+        """Assert a malformed Bearer header surfaces the 401 without cookie fallback."""
+        request = _make_request(authorization="Bearer ")
+        with (
+            patch(
+                "app.sep.deps.oauth2_scheme",
+                AsyncMock(side_effect=HTTPException(status_code=401)),
+            ),
+            patch(
+                "app.sep.deps.get_access_token_from_cookie",
+                side_effect=AssertionError(
+                    "cookie must not be read for a Bearer-authenticated request"
+                ),
+            ),
+            pytest.raises(HTTPException),
+        ):
+            await get_current_user(request)
+
     @pytest.mark.asyncio
     async def test_bad_signature_raises_redirect(self) -> None:
         """Assert BadSignature during JWT decode raises LoginRedirectException."""

tests/app/sep/test_main.py

@@ -22,7 +22,11 @@
 from fastapi.responses import HTMLResponse
 from fastapi.testclient import TestClient
 
-from app.core.auth.exceptions import BaseAuthProviderException
+from app.core.auth.exceptions import (
+    BaseAuthProviderException,
+    HTTPForbiddenException,
+    HTTPUnauthorizedException,
+)
 from app.core.exceptions import HTTPBadGatewayException, HTTPServiceUnavailableException
 from app.sep.config import sep_settings
 from app.sep.deps import get_access_token_from_cookie
@@ -279,6 +283,60 @@ def test_default_error_handler(self, mocker, dummy_context, test_client):
         assert response.headers["location"] == fake_referer
         messages_error_mock.assert_called_once_with(mocker.ANY, error_detail)
 
+    @pytest.mark.parametrize(
+        ("exc", "expected_status"),
+        [
+            pytest.param(
+                HTTPUnauthorizedException(),
+                status.HTTP_401_UNAUTHORIZED,
+                id="bearer_unauthorized",
+            ),
+            pytest.param(
+                HTTPForbiddenException("User is not active"),
+                status.HTTP_403_FORBIDDEN,
+                id="bearer_forbidden",
+            ),
+        ],
+    )
+    def test_default_error_handler_bearer_returns_json(
+        self, mocker, dummy_context, test_client, exc, expected_status
+    ):
+        """Test returning JSON for Bearer-authenticated HTTP exceptions."""
+        mocker.patch(
+            "app.sep.main.templates.TemplateResponse",
+            side_effect=exc,
+        )
+
+        response = test_client.get(
+            "/",
+            headers={"Authorization": "Bearer any-token"},
+            follow_redirects=False,
+        )
+
+        assert response.status_code == expected_status
+        assert response.json()["detail"] == exc.detail
+
+    def test_default_error_handler_unauthorized_without_bearer_redirects(
+        self, mocker, dummy_context, test_client
+    ):
+        """Test using referer redirect when Authorization Bearer is absent."""
+        mocker.patch(
+            "app.sep.main.templates.TemplateResponse",
+            side_effect=HTTPUnauthorizedException(),
+        )
+        messages_error_mock = mocker.patch("app.sep.main.messages.error")
+        fake_referer = "/some-page"
+
+        response = test_client.get(
+            "/",
+            headers={"Referer": fake_referer},
+            follow_redirects=False,
+        )
+
+        assert response.status_code == status.HTTP_303_SEE_OTHER
+        assert response.headers["location"] == fake_referer
+        messages_error_mock.assert_called_once()
+
     def test_auth_provider_exception_handler(
         self, mocker, dummy_access_token, dummy_context, test_client_with_session_cookie
     ):