api auth

app/__init__.py

@@ -58,11 +58,29 @@ def create_app(test_config=None):
                 response.headers["Cache-Control"] = "public, max-age=2592000, immutable"
         elif response.mimetype == "text/html":
             response.headers["Cache-Control"] = "no-store, no-cache, private, must-revalidate"
+            response.headers["Pragma"] = "no-cache"
+            response.headers["Expires"] = "0"
         return response
 
     @login_manager.user_loader
     def load_user(user_id): return db.session.get(User, int(user_id))
 
+    @login_manager.request_loader
+    def load_user_from_request(req):
+        header = req.headers.get("Authorization", "")
+        scheme, _, token = header.partition(" ")
+        if scheme.lower() != "bearer" or not token.strip():
+            return None
+        from .api_tokens import load_access_token
+        return load_access_token(token.strip())
+
+    @login_manager.unauthorized_handler
+    def unauthorized():
+        if request.path.startswith("/api/"):
+            return {"ok": False, "message": "Wymagane uwierzytelnienie Bearer lub aktywna sesja"}, 401
+        from flask import redirect
+        return redirect(url_for("auth.login", next=request.url))
+
     @app.context_processor
     def inject_theme():
         themes = _themes(app)