15 lines
707 B
Python
15 lines
707 B
Python
"""Credential assurance required by both Gateway and LangGraph sessions."""
|
|
|
|
from app.gateway.auth.jwt import TokenPayload
|
|
from deerflow.config.system_settings import load_system_settings
|
|
|
|
|
|
def session_policy_error(payload: TokenPayload) -> str | None:
|
|
"""Return a rejection reason for a signed but no longer permitted session."""
|
|
policy = load_system_settings().authentication
|
|
if payload.auth_method == "sso" and not policy.sso_enabled:
|
|
return "外部系统免登已关闭，请使用账号密码重新登录"
|
|
if policy.password_login_enabled and payload.auth_method not in {"password", "passphrase", "sso"}:
|
|
return "已开启登录验证，请重新登录"
|
|
return None
|