Добавил проверку на наличие скоупа print.file.send

print_service/routes/file.py

@@ -4,6 +4,7 @@
 
 import aiofiles
 import aiofiles.os
+from auth_lib.fastapi import UnionAuth
 from fastapi import APIRouter, File, UploadFile
 from fastapi.exceptions import HTTPException
 from fastapi.params import Depends
@@ -59,11 +60,13 @@ def validate_pages(cls, value: str):
 
 
 class SendInput(BaseModel):
-    surname: str = Field(
+    surname: str | None = Field(
+        default=None,
         description='Фамилия',
         example='Иванов',
     )
-    number: str = Field(
+    number: str | None = Field(
+        default=None,
         description='Номер профсоюзного или студенческого билетов',
         example='1015000',
     )
@@ -107,22 +110,35 @@ class ReceiveOutput(BaseModel):
     },
     response_model=SendOutput,
 )
-async def send(inp: SendInput, settings: Settings = Depends(get_settings)):
+async def send(
+    inp: SendInput,
+    user_auth=Depends(UnionAuth(allow_none=True)),
+    settings: Settings = Depends(get_settings),
+):
     """Получить пин код для загрузки и скачивания файла.
 
     Полученный пин-код можно использовать в методах POST и GET `/file/{pin}`.
     """
     user = db.session.query(UnionMember)
     if not settings.ALLOW_STUDENT_NUMBER:
         user = user.filter(UnionMember.union_number != None)
-    user = user.filter(
-        or_(
-            func.upper(UnionMember.student_number) == inp.number.upper(),
-            func.upper(UnionMember.union_number) == inp.number.upper(),
-        ),
-        func.upper(UnionMember.surname) == inp.surname.upper(),
-    ).one_or_none()
-    if not user:
+
+    if (inp.number is not None) and (inp.surname is not None):
+        user = user.filter(
+            or_(
+                func.upper(UnionMember.student_number) == inp.number.upper(),
+                func.upper(UnionMember.union_number) == inp.number.upper(),
+            ),
+            func.upper(UnionMember.surname) == inp.surname.upper(),
+        )
+
+    else:
+        if not "print.file.send" in [scope["name"] for scope in user_auth.get('session_scopes')]:
+            raise NotInUnion()
+
+    user = user.one_or_none()
+
+    if user is None:
         raise NotInUnion()
     try:
         pin = generate_pin(db.session)

print_service/routes/user.py

@@ -50,6 +50,7 @@ async def check_union_member(
     v: Optional[str] = __version__,
 ):
     """Проверяет наличие пользователя в списке."""
+
     surname = surname.upper()
     user = db.session.query(UnionMember)
     if not settings.ALLOW_STUDENT_NUMBER: