(20251128) Added creds-check for safety.

backend/api/blueprints/reports/in_out_report.py

@@ -137,8 +137,8 @@ def init(blueprint_setup_state):
 # @log_chain_to_mongo(attr_name = "logs_mongo")
 @should_not_be_under_maintenance(attr_name = "is_under_maintenance")
 @validate_input(
-    # header_validator = lambda x: SimpleCosecCredentialsHeaders(**x),
+    header_validator = lambda x: SimpleCosecCredentialsHeaders(**x),
-    # data_validator = lambda x: CosecInOutReportRequestData(**x)
+    data_validator = lambda x: CosecInOutReportRequestData(**x)
 )
 @handle_cancelled_request()
 async def in_out_report_generate(
@@ -157,6 +157,20 @@ async def in_out_report_generate(
     :return: A standard response structure.
     """
 
+    # Check for authorization:
+    proj_dir = files.get_file_directory(include_filename = False)
+    proj_dir = files.get_parent_directory(proj_dir, depth = 4)
+    creds_file = os.path.join(proj_dir, "creds", "cosec.json")
+    creds = json.from_file(creds_file)["creds"]
+    if not (
+        inbound_headers.cosecUsername == creds["username"]
+        and inbound_headers.cosecPassword == creds["password"]
+    ): return ResponseModel(
+        status_code = StatusCodes.FAILED,
+        http_code = HttpCodes.UNAUTHORIZED,
+        message = f"Unauthorized.",
+    )
+
     # Start by assuming failure:
     success = False
     report_data = None

backend/api/blueprints/reports/muster_roll.py

@@ -149,8 +149,8 @@ async def close_browser() -> None:
 # @log_chain_to_mongo(attr_name = "logs_mongo")
 @should_not_be_under_maintenance(attr_name = "is_under_maintenance")
 @validate_input(
-    # header_validator = lambda x: SimpleCosecCredentialsHeaders(**x),
+    header_validator = lambda x: SimpleCosecCredentialsHeaders(**x),
-    # data_validator = lambda x: CosecMusterRollReportRequestData(**x)
+    data_validator = lambda x: CosecMusterRollReportRequestData(**x)
 )
 @handle_cancelled_request()
 async def muster_roll_report_generate(
@@ -169,6 +169,20 @@ async def muster_roll_report_generate(
     :return: A standard response structure.
     """
 
+    # Check for authorization:
+    proj_dir = files.get_file_directory(include_filename = False)
+    proj_dir = files.get_parent_directory(proj_dir, depth = 4)
+    creds_file = os.path.join(proj_dir, "creds", "cosec.json")
+    creds = json.from_file(creds_file)["creds"]
+    if not (
+            inbound_headers.cosecUsername == creds["username"]
+            and inbound_headers.cosecPassword == creds["password"]
+    ): return ResponseModel(
+        status_code = StatusCodes.FAILED,
+        http_code = HttpCodes.UNAUTHORIZED,
+        message = f"Unauthorized.",
+    )
+
     # Start by assuming failure:
     success = False
     report_data = None