cb90d0db0c
Two low-risk Pydantic V1 idioms that will be hard errors in V3:
- Query(regex=...) -> Query(pattern=...) (audit_routes, control_generator_routes)
- class Config: from_attributes=True -> model_config = ConfigDict(...)
in source_policy_router.py (schemas.py is intentionally skipped — it is
the Phase 1 schema-split target and the ConfigDict conversion is most
efficient to do during that split).
Naive -> aware datetime sweep across 47 files:
- datetime.utcnow() -> datetime.now(timezone.utc)
- default=datetime.utcnow -> default=lambda: datetime.now(timezone.utc)
- onupdate=datetime.utcnow -> onupdate=lambda: datetime.now(timezone.utc)
All SQLAlchemy DateTime columns in the project already declare
timezone=True, so the DB schema expects aware datetimes. Before this
commit, the in-Python side was generating naive values and the driver
was silently coercing them. This is a latent-bug fix, not a behavior
change at the DB boundary.
Verified:
- 173/173 pytest compliance/tests/ pass (same as baseline)
- tests/contracts/test_openapi_baseline.py passes (360 paths,
484 operations unchanged)
- DeprecationWarning count dropped from 158 -> 35
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
360 lines
12 KiB
Python
360 lines
12 KiB
Python
"""
|
|
Consent Service Client für BreakPilot
|
|
Kommuniziert mit dem Consent Management Service für GDPR-Compliance
|
|
"""
|
|
|
|
import httpx
|
|
import jwt
|
|
from datetime import datetime, timedelta, timezone
|
|
from typing import Optional, List, Dict, Any
|
|
from dataclasses import dataclass
|
|
from enum import Enum
|
|
import os
|
|
import uuid
|
|
|
|
# Consent Service URL (aus Umgebungsvariable oder Standard für lokale Entwicklung)
|
|
CONSENT_SERVICE_URL = os.getenv("CONSENT_SERVICE_URL", "http://localhost:8081")
|
|
|
|
# JWT Secret - MUSS mit dem Go Consent Service übereinstimmen!
|
|
JWT_SECRET = os.getenv("JWT_SECRET", "breakpilot-dev-jwt-secret-2024")
|
|
|
|
|
|
def generate_jwt_token(
|
|
user_id: str = None,
|
|
email: str = "demo@breakpilot.app",
|
|
role: str = "user",
|
|
expires_hours: int = 24
|
|
) -> str:
|
|
"""
|
|
Generiert einen JWT Token für die Authentifizierung beim Consent Service.
|
|
|
|
Args:
|
|
user_id: Die User-ID (wird generiert falls nicht angegeben)
|
|
email: Die E-Mail-Adresse des Benutzers
|
|
role: Die Rolle (user, admin, super_admin)
|
|
expires_hours: Gültigkeitsdauer in Stunden
|
|
|
|
Returns:
|
|
JWT Token als String
|
|
"""
|
|
if user_id is None:
|
|
user_id = str(uuid.uuid4())
|
|
|
|
payload = {
|
|
"user_id": user_id,
|
|
"email": email,
|
|
"role": role,
|
|
"exp": datetime.now(timezone.utc) + timedelta(hours=expires_hours),
|
|
"iat": datetime.now(timezone.utc),
|
|
}
|
|
|
|
return jwt.encode(payload, JWT_SECRET, algorithm="HS256")
|
|
|
|
|
|
def generate_demo_token() -> str:
|
|
"""Generiert einen Demo-Token für nicht-authentifizierte Benutzer"""
|
|
return generate_jwt_token(
|
|
user_id="demo-user-" + str(uuid.uuid4())[:8],
|
|
email="demo@breakpilot.app",
|
|
role="user"
|
|
)
|
|
|
|
|
|
class DocumentType(str, Enum):
|
|
TERMS = "terms"
|
|
PRIVACY = "privacy"
|
|
COOKIES = "cookies"
|
|
COMMUNITY = "community"
|
|
|
|
|
|
@dataclass
|
|
class ConsentStatus:
|
|
has_consent: bool
|
|
current_version_id: Optional[str] = None
|
|
consented_version: Optional[str] = None
|
|
needs_update: bool = False
|
|
consented_at: Optional[str] = None
|
|
|
|
|
|
@dataclass
|
|
class DocumentVersion:
|
|
id: str
|
|
document_id: str
|
|
version: str
|
|
language: str
|
|
title: str
|
|
content: str
|
|
summary: Optional[str] = None
|
|
|
|
|
|
class ConsentClient:
|
|
"""Client für die Kommunikation mit dem Consent Service"""
|
|
|
|
def __init__(self, base_url: str = CONSENT_SERVICE_URL):
|
|
self.base_url = base_url.rstrip("/")
|
|
self.api_url = f"{self.base_url}/api/v1"
|
|
|
|
def _get_headers(self, jwt_token: str) -> Dict[str, str]:
|
|
"""Erstellt die Header mit JWT Token"""
|
|
return {
|
|
"Authorization": f"Bearer {jwt_token}",
|
|
"Content-Type": "application/json"
|
|
}
|
|
|
|
async def check_consent(
|
|
self,
|
|
jwt_token: str,
|
|
document_type: DocumentType,
|
|
language: str = "de"
|
|
) -> ConsentStatus:
|
|
"""
|
|
Prüft ob der Benutzer dem Dokument zugestimmt hat.
|
|
Gibt zurück ob eine Zustimmung vorliegt und ob sie aktuell ist.
|
|
"""
|
|
async with httpx.AsyncClient() as client:
|
|
try:
|
|
response = await client.get(
|
|
f"{self.api_url}/consent/check/{document_type.value}",
|
|
headers=self._get_headers(jwt_token),
|
|
params={"language": language},
|
|
timeout=10.0
|
|
)
|
|
|
|
if response.status_code == 200:
|
|
data = response.json()
|
|
return ConsentStatus(
|
|
has_consent=data.get("has_consent", False),
|
|
current_version_id=data.get("current_version_id"),
|
|
consented_version=data.get("consented_version"),
|
|
needs_update=data.get("needs_update", False),
|
|
consented_at=data.get("consented_at")
|
|
)
|
|
else:
|
|
return ConsentStatus(has_consent=False, needs_update=True)
|
|
|
|
except httpx.RequestError:
|
|
# Bei Verbindungsproblemen: Consent nicht erzwingen
|
|
return ConsentStatus(has_consent=True, needs_update=False)
|
|
|
|
async def check_all_mandatory_consents(
|
|
self,
|
|
jwt_token: str,
|
|
language: str = "de"
|
|
) -> Dict[str, ConsentStatus]:
|
|
"""
|
|
Prüft alle verpflichtenden Dokumente (Terms, Privacy).
|
|
Gibt ein Dictionary mit dem Status für jedes Dokument zurück.
|
|
"""
|
|
mandatory_docs = [DocumentType.TERMS, DocumentType.PRIVACY]
|
|
results = {}
|
|
|
|
for doc_type in mandatory_docs:
|
|
results[doc_type.value] = await self.check_consent(jwt_token, doc_type, language)
|
|
|
|
return results
|
|
|
|
async def get_pending_consents(
|
|
self,
|
|
jwt_token: str,
|
|
language: str = "de"
|
|
) -> List[Dict[str, Any]]:
|
|
"""
|
|
Gibt eine Liste aller Dokumente zurück, die noch Zustimmung benötigen.
|
|
Nützlich für die Anzeige beim Login/Registration.
|
|
"""
|
|
pending = []
|
|
statuses = await self.check_all_mandatory_consents(jwt_token, language)
|
|
|
|
for doc_type, status in statuses.items():
|
|
if not status.has_consent or status.needs_update:
|
|
# Hole das aktuelle Dokument
|
|
doc = await self.get_latest_document(jwt_token, doc_type, language)
|
|
if doc:
|
|
pending.append({
|
|
"type": doc_type,
|
|
"version_id": status.current_version_id,
|
|
"title": doc.title,
|
|
"content": doc.content,
|
|
"summary": doc.summary,
|
|
"is_update": status.has_consent and status.needs_update
|
|
})
|
|
|
|
return pending
|
|
|
|
async def get_latest_document(
|
|
self,
|
|
jwt_token: str,
|
|
document_type: str,
|
|
language: str = "de"
|
|
) -> Optional[DocumentVersion]:
|
|
"""Holt die aktuellste Version eines Dokuments"""
|
|
async with httpx.AsyncClient() as client:
|
|
try:
|
|
response = await client.get(
|
|
f"{self.api_url}/documents/{document_type}/latest",
|
|
headers=self._get_headers(jwt_token),
|
|
params={"language": language},
|
|
timeout=10.0
|
|
)
|
|
|
|
if response.status_code == 200:
|
|
data = response.json()
|
|
return DocumentVersion(
|
|
id=data["id"],
|
|
document_id=data["document_id"],
|
|
version=data["version"],
|
|
language=data["language"],
|
|
title=data["title"],
|
|
content=data["content"],
|
|
summary=data.get("summary")
|
|
)
|
|
return None
|
|
|
|
except httpx.RequestError:
|
|
return None
|
|
|
|
async def give_consent(
|
|
self,
|
|
jwt_token: str,
|
|
document_type: str,
|
|
version_id: str,
|
|
consented: bool = True
|
|
) -> bool:
|
|
"""
|
|
Speichert die Zustimmung des Benutzers.
|
|
Gibt True zurück bei Erfolg.
|
|
"""
|
|
async with httpx.AsyncClient() as client:
|
|
try:
|
|
response = await client.post(
|
|
f"{self.api_url}/consent",
|
|
headers=self._get_headers(jwt_token),
|
|
json={
|
|
"document_type": document_type,
|
|
"version_id": version_id,
|
|
"consented": consented
|
|
},
|
|
timeout=10.0
|
|
)
|
|
return response.status_code == 201
|
|
|
|
except httpx.RequestError:
|
|
return False
|
|
|
|
async def get_cookie_categories(
|
|
self,
|
|
jwt_token: str,
|
|
language: str = "de"
|
|
) -> List[Dict[str, Any]]:
|
|
"""Holt alle Cookie-Kategorien für das Cookie-Banner"""
|
|
async with httpx.AsyncClient() as client:
|
|
try:
|
|
response = await client.get(
|
|
f"{self.api_url}/cookies/categories",
|
|
headers=self._get_headers(jwt_token),
|
|
params={"language": language},
|
|
timeout=10.0
|
|
)
|
|
|
|
if response.status_code == 200:
|
|
return response.json().get("categories", [])
|
|
return []
|
|
|
|
except httpx.RequestError:
|
|
return []
|
|
|
|
async def set_cookie_consent(
|
|
self,
|
|
jwt_token: str,
|
|
categories: List[Dict[str, Any]]
|
|
) -> bool:
|
|
"""
|
|
Speichert die Cookie-Präferenzen.
|
|
categories: [{"category_id": "...", "consented": true/false}, ...]
|
|
"""
|
|
async with httpx.AsyncClient() as client:
|
|
try:
|
|
response = await client.post(
|
|
f"{self.api_url}/cookies/consent",
|
|
headers=self._get_headers(jwt_token),
|
|
json={"categories": categories},
|
|
timeout=10.0
|
|
)
|
|
return response.status_code == 200
|
|
|
|
except httpx.RequestError:
|
|
return False
|
|
|
|
async def get_my_data(self, jwt_token: str) -> Optional[Dict[str, Any]]:
|
|
"""GDPR Art. 15: Holt alle Daten des Benutzers"""
|
|
async with httpx.AsyncClient() as client:
|
|
try:
|
|
response = await client.get(
|
|
f"{self.api_url}/privacy/my-data",
|
|
headers=self._get_headers(jwt_token),
|
|
timeout=30.0
|
|
)
|
|
|
|
if response.status_code == 200:
|
|
return response.json()
|
|
return None
|
|
|
|
except httpx.RequestError:
|
|
return None
|
|
|
|
async def request_data_export(self, jwt_token: str) -> Optional[str]:
|
|
"""GDPR Art. 20: Fordert einen Datenexport an"""
|
|
async with httpx.AsyncClient() as client:
|
|
try:
|
|
response = await client.post(
|
|
f"{self.api_url}/privacy/export",
|
|
headers=self._get_headers(jwt_token),
|
|
timeout=10.0
|
|
)
|
|
|
|
if response.status_code == 202:
|
|
return response.json().get("request_id")
|
|
return None
|
|
|
|
except httpx.RequestError:
|
|
return None
|
|
|
|
async def request_data_deletion(
|
|
self,
|
|
jwt_token: str,
|
|
reason: Optional[str] = None
|
|
) -> Optional[str]:
|
|
"""GDPR Art. 17: Fordert Löschung aller Daten an"""
|
|
async with httpx.AsyncClient() as client:
|
|
try:
|
|
response = await client.post(
|
|
f"{self.api_url}/privacy/delete",
|
|
headers=self._get_headers(jwt_token),
|
|
json={"reason": reason} if reason else {},
|
|
timeout=10.0
|
|
)
|
|
|
|
if response.status_code == 202:
|
|
return response.json().get("request_id")
|
|
return None
|
|
|
|
except httpx.RequestError:
|
|
return None
|
|
|
|
async def health_check(self) -> bool:
|
|
"""Prüft ob der Consent Service erreichbar ist"""
|
|
async with httpx.AsyncClient() as client:
|
|
try:
|
|
response = await client.get(
|
|
f"{self.base_url}/health",
|
|
timeout=5.0
|
|
)
|
|
return response.status_code == 200
|
|
|
|
except httpx.RequestError:
|
|
return False
|
|
|
|
|
|
# Singleton-Instanz für einfachen Zugriff
|
|
consent_client = ConsentClient()
|