add user? new page? new web

route/auth.py

@@ -0,0 +1,74 @@
+from fastapi import APIRouter, Depends, HTTPException, status
+from fastapi.security import OAuth2PasswordRequestForm
+from pydantic import BaseModel, field_validator
+
+from bd import Settings
+from sqlalchemy import create_engine
+from sqlalchemy.orm import sessionmaker
+
+from bd.tables.users import User
+from route.auth_utils import hash_password, verify_password, create_access_token
+
+router = APIRouter(tags=["auth"], prefix="/auth")
+
+
+def _get_session():
+    settings = Settings()
+    engine = create_engine(settings.DATABASE_URL_syncpg, future=True)
+    return sessionmaker(bind=engine, future=True)
+
+
+class RegisterIn(BaseModel):
+    username: str
+    password: str
+    first_name: str
+    last_name: str
+
+    @field_validator("password")
+    @classmethod
+    def password_strength(cls, v: str) -> str:
+        if len(v) < 8:
+            raise ValueError("Password must be at least 8 characters")
+        return v
+
+    @field_validator("username")
+    @classmethod
+    def username_clean(cls, v: str) -> str:
+        v = v.strip()
+        if len(v) < 3:
+            raise ValueError("Username must be at least 3 characters")
+        return v
+
+
+@router.post("/register", status_code=201)
+def register(payload: RegisterIn):
+    Session = _get_session()
+    with Session() as session:
+        existing = session.query(User).filter(User.username == payload.username).first()
+        if existing:
+            raise HTTPException(status_code=400, detail="Username already taken")
+        user = User(
+            first_name=payload.first_name.strip(),
+            last_name=payload.last_name.strip(),
+            username=payload.username,
+            hashed_password=hash_password(payload.password),
+        )
+        session.add(user)
+        session.commit()
+        session.refresh(user)
+        return {"id": str(user.id), "username": user.username}
+
+
+@router.post("/login")
+def login(form: OAuth2PasswordRequestForm = Depends()):
+    Session = _get_session()
+    with Session() as session:
+        user = session.query(User).filter(User.username == form.username).first()
+        if not user or not verify_password(form.password, user.hashed_password):
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="Incorrect username or password",
+                headers={"WWW-Authenticate": "Bearer"},
+            )
+        token = create_access_token({"sub": str(user.id)})
+        return {"access_token": token, "token_type": "bearer"}