Major cleanup and refactoring of the backend (frontend not fully updated).

passkey/fastapi/main.py

@@ -9,15 +9,12 @@ This module provides a simple WebAuthn implementation that:
 - Enables true passwordless authentication where users don't need to enter a user_name
 """
 
+import contextlib
 import logging
 from contextlib import asynccontextmanager
 from pathlib import Path
 
-from fastapi import (
-    FastAPI,
-    Request,
-    Response,
-)
+from fastapi import Cookie, FastAPI, Request, Response
 from fastapi.responses import (
     FileResponse,
     JSONResponse,
@@ -25,12 +22,9 @@ from fastapi.responses import (
 from fastapi.staticfiles import StaticFiles
 
 from ..db import sql
-from .api import (
-    register_api_routes,
-    validate_token,
-)
+from . import session, ws
+from .api import register_api_routes
 from .reset import register_reset_routes
-from .ws import ws_app
 
 STATIC_DIR = Path(__file__).parent.parent / "frontend-build"
 
@@ -44,7 +38,7 @@ async def lifespan(app: FastAPI):
 app = FastAPI(lifespan=lifespan)
 
 # Mount the WebSocket subapp
-app.mount("/auth/ws", ws_app)
+app.mount("/auth/ws", ws.app)
 
 # Register API routes
 register_api_routes(app)
@@ -52,24 +46,19 @@ register_reset_routes(app)
 
 
 @app.get("/auth/forward-auth")
-async def forward_authentication(request: Request):
-    """A verification endpoint to use with Caddy forward_auth or Nginx auth_request."""
-    # Create a dummy response object for internal validation (we won't use it for cookies)
-    response = Response()
+async def forward_authentication(request: Request, auth=Cookie(None)):
+    """A validation endpoint to use with Caddy forward_auth or Nginx auth_request."""
+    with contextlib.suppress(ValueError):
+        s = await session.get_session(auth)
+        # If authenticated, return a success response
+        if s.info and s.info["type"] == "authenticated":
+            return Response(status_code=204, headers={"x-auth-user": str(s.user_uuid)})
 
-    result = await validate_token(request, response)
-    if result.get("status") != "success":
-        # Serve the index.html of the authentication app if not authenticated
-        return FileResponse(
-            STATIC_DIR / "index.html",
-            status_code=401,
-            headers={"www-authenticate": "PrivateToken"},
-        )
-
-    # If authenticated, return a success response
-    return Response(
-        status_code=204,
-        headers={"x-auth-user-id": result["user_id"]},
+    # Serve the index.html of the authentication app if not authenticated
+    return FileResponse(
+        STATIC_DIR / "index.html",
+        status_code=401,
+        headers={"www-authenticate": "PrivateToken"},
     )