Update routes/logs.py

routes/logs.py

@@ -1,13 +1,80 @@
+import os
 import logging
 import aiohttp
 from fastapi import APIRouter, HTTPException, Query, Header
-from typing import List, Dict, Any
-
-from . import SUPABASE_URL, SUPABASE_HEADERS, verify_token_with_permissions
+from typing import Dict, Any
 
 router = APIRouter()
+
+# Supabase configs
+SUPABASE_URL = "https://ussxqnifefkgkaumjann.supabase.co"
+SUPABASE_KEY = os.getenv("SUPA_KEY")
+SUPABASE_ROLE_KEY = os.getenv("SUPA_SERVICE_KEY")
+
+if not SUPABASE_KEY or not SUPABASE_ROLE_KEY:
+    raise ValueError("❌ SUPA_KEY ou SUPA_SERVICE_KEY não foram definidos no ambiente!")
+
+SUPABASE_HEADERS = {
+    "apikey": SUPABASE_KEY,
+    "Authorization": f"Bearer {SUPABASE_KEY}",
+    "Content-Type": "application/json"
+}
+
+SUPABASE_ROLE_HEADERS = {
+    "apikey": SUPABASE_ROLE_KEY,
+    "Authorization": f"Bearer {SUPABASE_ROLE_KEY}",
+    "Content-Type": "application/json"
+}
+
+# Logging
+logging.basicConfig(level=logging.INFO)
 logger = logging.getLogger(__name__)
 
+# Verificação de token e permissões
+async def verify_token_with_permissions(user_token: str, required_permission: str = None) -> Dict[str, Any]:
+    headers = {
+        "Authorization": f"Bearer {user_token}",
+        "apikey": SUPABASE_KEY,
+        "Content-Type": "application/json"
+    }
+
+    async with aiohttp.ClientSession() as session:
+        async with session.get(f"{SUPABASE_URL}/auth/v1/user", headers=headers) as response:
+            if response.status != 200:
+                raise HTTPException(status_code=401, detail="Token inválido ou expirado")
+
+            user_data = await response.json()
+            user_id = user_data.get("id")
+            if not user_id:
+                raise HTTPException(status_code=400, detail="ID do usuário não encontrado")
+
+    user_data_url = f"{SUPABASE_URL}/rest/v1/User?id=eq.{user_id}&select=is_admin,edit_onboarding"
+    async with aiohttp.ClientSession() as session:
+        async with session.get(user_data_url, headers=SUPABASE_HEADERS) as response:
+            if response.status != 200 or not await response.json():
+                raise HTTPException(status_code=403, detail="Acesso negado: não foi possível verificar permissões")
+
+            user_info = (await response.json())[0]
+            is_admin = user_info.get("is_admin", False)
+
+            if not is_admin:
+                raise HTTPException(status_code=403, detail="Acesso negado: privilégios de administrador necessários")
+
+            if required_permission:
+                has_permission = user_info.get(required_permission, False)
+                if not has_permission:
+                    raise HTTPException(
+                        status_code=403,
+                        detail=f"Acesso negado: permissão '{required_permission}' necessária"
+                    )
+
+    return {
+        "user_id": user_id,
+        "is_admin": is_admin,
+        "permissions": user_info
+    }
+
+# Rota para buscar logs
 @router.get("/logs")
 async def get_logs(
     page: int = Query(0, ge=0),
@@ -19,7 +86,6 @@ async def get_logs(
     Cada página contém no máximo 50 logs.
     """
     try:
-        # Verifica permissão de administrador
         await verify_token_with_permissions(user_token)
 
         limit = 50
@@ -36,7 +102,6 @@ async def get_logs(
 
                 logs = await response.json()
 
-        # Se não houver registros, retorna lista vazia
         if not logs:
             return {
                 "logs": [],
@@ -44,24 +109,22 @@ async def get_logs(
                 "has_next": False
             }
 
-        # Coletar todos os user_ids distintos
+        # Pegar dados dos usuários responsáveis pelos logs
         user_ids = list({log["user"] for log in logs if log.get("user")})
-        if not user_ids:
-            user_info_map = {}
-        else:
+        user_info_map = {}
+
+        if user_ids:
             user_ids_query = ",".join(f'"{uid}"' for uid in user_ids)
             users_url = f"{SUPABASE_URL}/rest/v1/User?id=in.({user_ids_query})&select=id,name,avatar"
 
             async with aiohttp.ClientSession() as session:
                 async with session.get(users_url, headers=SUPABASE_HEADERS) as response:
-                    if response.status != 200:
-                        logger.warning("⚠️ Erro ao buscar dados dos usuários")
-                        user_info_map = {}
-                    else:
+                    if response.status == 200:
                         users_data = await response.json()
                         user_info_map = {user["id"]: {"name": user["name"], "avatar": user["avatar"]} for user in users_data}
+                    else:
+                        logger.warning("⚠️ Erro ao buscar dados dos usuários")
 
-        # Montar resposta com user_info
         enriched_logs = []
         for log in logs:
             user_data = user_info_map.get(log["user"], {"name": None, "avatar": None})
@@ -91,4 +154,4 @@ async def get_logs(
         raise he
     except Exception as e:
         logger.error(f"❌ Erro interno ao buscar logs: {str(e)}")
-        raise HTTPException(status_code=500, detail="Erro interno do servidor")
+        raise HTTPException(status_code=500, detail="Erro interno do servidor")