Update admin_routes.py

admin_routes.py

@@ -4,10 +4,12 @@ Flare Admin API Routes
 Admin UI için gerekli tüm endpoint'ler
 """
 
+import os
 import json
 import hashlib
 import secrets
 import commentjson
+import bcrypt
 from datetime import datetime, timedelta
 from typing import Dict, List, Optional, Any
 from pathlib import Path
@@ -19,21 +21,31 @@ import jwt
 
 from utils import log
 from config_provider import ConfigProvider
-import os
-from dotenv import load_dotenv
 
-# Load environment variables
-load_dotenv()
+# ===================== Dynamic Config Loading =====================
+def get_jwt_config():
+    """Get JWT configuration based on work_mode"""
+    cfg = ConfigProvider.get()
+    
+    if cfg.global_config.is_cloud_mode():
+        # Cloud mode - use HuggingFace Secrets
+        jwt_secret = os.getenv("JWT_SECRET")
+        if not jwt_secret:
+            log("❌ JWT_SECRET not found in HuggingFace Secrets!")
+            jwt_secret = "flare-admin-secret-key-change-in-production"  # Fallback
+    else:
+        # On-premise mode - use .env file
+        from dotenv import load_dotenv
+        load_dotenv()
+        jwt_secret = os.getenv("JWT_SECRET", "flare-admin-secret-key-change-in-production")
+    
+    return {
+        "secret": jwt_secret,
+        "algorithm": os.getenv("JWT_ALGORITHM", "HS256"),
+        "expiration_hours": int(os.getenv("JWT_EXPIRATION_HOURS", "24"))
+    }
 
 # ===================== Constants & Config =====================
-JWT_SECRET = os.getenv("JWT_SECRET", "flare-admin-secret-key-change-in-production")
-JWT_ALGORITHM = os.getenv("JWT_ALGORITHM", "HS256")
-JWT_EXPIRATION_HOURS = int(os.getenv("JWT_EXPIRATION_HOURS", "24"))
-
-# Production check
-if os.getenv("ENVIRONMENT") == "production" and JWT_SECRET == "flare-admin-secret-key-change-in-production":
-    raise ValueError("JWT_SECRET must be changed in production!")
-
 router = APIRouter(prefix="/api")
 security = HTTPBearer()
 
@@ -113,6 +125,25 @@ class TestRequest(BaseModel):
     test_type: str  # "all", "ui", "backend", "integration", "spark"
 
 # ===================== Helpers =====================
+def verify_token(credentials: HTTPAuthorizationCredentials = Depends(security)) -> str:
+    """Verify JWT token and return username"""
+    jwt_config = get_jwt_config()
+    
+    try:
+        payload = jwt.decode(
+            credentials.credentials, 
+            jwt_config["secret"], 
+            algorithms=[jwt_config["algorithm"]]
+        )
+        username = payload.get("sub")
+        if username is None:
+            raise HTTPException(status_code=401, detail="Invalid token")
+        return username
+    except jwt.ExpiredSignatureError:
+        raise HTTPException(status_code=401, detail="Token expired")
+    except jwt.JWTError:
+        raise HTTPException(status_code=401, detail="Invalid token")
+        
 def hash_password(password: str, salt: str = None) -> tuple[str, str]:
     """Hash password with bcrypt. Returns (hash, salt)"""
     if salt is None:
@@ -173,6 +204,7 @@ def add_activity_log(config: Dict[str, Any], user: str, action: str, entity_type
 async def login(request: LoginRequest):
     """User login"""
     config = load_config()
+    jwt_config = get_jwt_config()
 
     # Find user
     users = config.get("config", {}).get("users", [])
@@ -182,18 +214,22 @@ async def login(request: LoginRequest):
         raise HTTPException(status_code=401, detail="Invalid credentials")
 
     # Verify password with bcrypt
-    if not verify_password(request.password, user["password_hash"], user.get("salt", "")):
-        # Fallback to simple hash for backward compatibility
-        if hash_password(request.password)[0] != user["password_hash"]:
+    if user.get("salt"):
+        # New bcrypt format
+        if not verify_password(request.password, user["password_hash"], user["salt"]):
+            raise HTTPException(status_code=401, detail="Invalid credentials")
+    else:
+        # Legacy SHA256 format
+        if hashlib.sha256(request.password.encode()).hexdigest() != user["password_hash"]:
             raise HTTPException(status_code=401, detail="Invalid credentials")
 
     # Create JWT token
-    expire = datetime.utcnow() + timedelta(hours=JWT_EXPIRATION_HOURS)
+    expire = datetime.utcnow() + timedelta(hours=jwt_config["expiration_hours"])
     payload = {
         "sub": request.username,
         "exp": expire
     }
-    token = jwt.encode(payload, JWT_SECRET, algorithm=JWT_ALGORITHM)
+    token = jwt.encode(payload, jwt_config["secret"], algorithm=jwt_config["algorithm"])
 
     log(f"✅ User '{request.username}' logged in")
     return LoginResponse(token=token, username=request.username)