feat(cloud-console): add user authentication and administration

packages/cloud-platform/cloud/auth.py

@@ -15,6 +15,7 @@ TASKS_READ_SCOPE = "tasks:read"
 POOL_READ_SCOPE = "pool:read"
 PLUGINS_READ_SCOPE = "plugins:read"
 PLUGINS_ADMIN_SCOPE = "plugins:admin"
+USERS_ADMIN_SCOPE = "users:admin"
 
 
 @dataclass(frozen=True)
@@ -22,6 +23,8 @@ class Principal:
     id: str = "anonymous"
     scopes: frozenset[str] = field(default_factory=frozenset)
     host_id: str | None = None
+    session_id: str | None = None
+    must_change_password: bool = False
 
     def has_scope(self, scope: str) -> bool:
         return "*" in self.scopes or scope in self.scopes
@@ -167,6 +170,30 @@ class RepositoryHostAuthProvider:
         return Principal(id=f"enrolled-host:{host_id}", host_id=host_id)
 
 
+class UserSessionAuthProvider:
+    """Resolve the opaque browser session cookie to an existing Principal."""
+
+    def __init__(self, user_auth_service: object) -> None:
+        self.user_auth_service = user_auth_service
+
+    def authenticate(self, request: object) -> Principal | None:
+        from cloud.user_auth import USER_SESSION_COOKIE
+
+        token = _extract_cookie(request, USER_SESSION_COOKIE)
+        if token is None:
+            return None
+        authenticated = self.user_auth_service.authenticate_session(token)  # type: ignore[attr-defined]
+        if authenticated is None:
+            return None
+        user = authenticated.user
+        return Principal(
+            id=f"user:{user.id}",
+            scopes=user.scopes,
+            session_id=authenticated.session.id,
+            must_change_password=user.must_change_password,
+        )
+
+
 class ChainedAuthProvider:
     def __init__(self, providers: Iterable[AuthProvider]) -> None:
         self.providers = tuple(providers)
@@ -205,6 +232,14 @@ def _extract_bearer_token(request: object) -> str | None:
     return token
 
 
+def _extract_cookie(request: object, name: str) -> str | None:
+    cookies = getattr(request, "cookies", None)
+    if cookies is None:
+        return None
+    value = cookies.get(name)
+    return value if isinstance(value, str) and value else None
+
+
 def bearer_token_digest(request: object) -> str | None:
     token = _extract_bearer_token(request)
     return digest_token(token) if token is not None else None