add user? new page? new web

route/users_crud.py

@@ -1,5 +1,5 @@
-from fastapi import APIRouter, HTTPException
-from pydantic import BaseModel
+from fastapi import APIRouter, Depends, HTTPException
+from pydantic import BaseModel, field_validator
 from typing import Optional
 import uuid
 
@@ -8,18 +8,36 @@ from sqlalchemy import create_engine
 from sqlalchemy.orm import sessionmaker
 
 from bd.tables.users import User
+from route.auth_utils import get_current_user, require_admin_key, hash_password
 
 router = APIRouter(tags=["users"], prefix="/users")
 
 
 class UserCreate(BaseModel):
+    username: str
+    password: str
     first_name: str
     last_name: str
 
+    @field_validator("username")
+    @classmethod
+    def username_clean(cls, v: str) -> str:
+        v = v.strip()
+        if len(v) < 3:
+            raise ValueError("Username must be at least 3 characters")
+        return v
+
+    @field_validator("password")
+    @classmethod
+    def password_strength(cls, v: str) -> str:
+        if len(v) < 8:
+            raise ValueError("Password must be at least 8 characters")
+        return v
+
 
 class UserUpdate(BaseModel):
-    first_name: Optional[str]
-    last_name: Optional[str]
+    first_name: Optional[str] = None
+    last_name: Optional[str] = None
 
 
 def get_session():
@@ -28,24 +46,34 @@ def get_session():
     return sessionmaker(bind=engine, future=True)
 
 
-@router.post("/", status_code=201)
+@router.post("/", status_code=201, dependencies=[Depends(require_admin_key)])
 def create_user(payload: UserCreate):
     Session = get_session()
     with Session() as session:
-        user = User(first_name=payload.first_name, last_name=payload.last_name)
+        existing = session.query(User).filter(User.username == payload.username).first()
+        if existing:
+            raise HTTPException(status_code=400, detail="Username already taken")
+        user = User(
+            first_name=payload.first_name.strip(),
+            last_name=payload.last_name.strip(),
+            username=payload.username,
+            hashed_password=hash_password(payload.password),
+        )
         session.add(user)
         session.commit()
         session.refresh(user)
-        return {"id": str(user.id), "first_name": user.first_name, "last_name": user.last_name}
+        return {"id": str(user.id), "username": user.username}
 
 
 @router.put("/{user_id}")
-def update_user(user_id: str, payload: UserUpdate):
+def update_user(user_id: str, payload: UserUpdate, current_user: User = Depends(get_current_user)):
     Session = get_session()
     try:
         uid = uuid.UUID(user_id)
     except Exception:
         raise HTTPException(status_code=400, detail="Invalid UUID")
+    if uid != current_user.id:
+        raise HTTPException(status_code=403, detail="You can only update your own profile")
     with Session() as session:
         user = session.get(User, uid)
         if not user:
@@ -61,12 +89,14 @@ def update_user(user_id: str, payload: UserUpdate):
 
 
 @router.delete("/{user_id}", status_code=204)
-def delete_user(user_id: str):
+def delete_user(user_id: str, current_user: User = Depends(get_current_user)):
     Session = get_session()
     try:
         uid = uuid.UUID(user_id)
     except Exception:
         raise HTTPException(status_code=400, detail="Invalid UUID")
+    if uid != current_user.id:
+        raise HTTPException(status_code=403, detail="You can only delete your own account")
     with Session() as session:
         user = session.get(User, uid)
         if not user:
@@ -76,16 +106,13 @@ def delete_user(user_id: str):
         return {}
 
 
-@router.get("/")
-def list_users():
-    Session = get_session()
-    with Session() as session:
-        rows = session.query(User).all()
-        return [{"id": str(u.id), "first_name": u.first_name, "last_name": u.last_name} for u in rows]
+@router.get("/me")
+def get_me(current_user: User = Depends(get_current_user)):
+    return {"id": str(current_user.id), "username": current_user.username, "first_name": current_user.first_name, "last_name": current_user.last_name}
 
 
 @router.get("/{user_id}")
-def get_user(user_id: str):
+def get_user(user_id: str, current_user: User = Depends(get_current_user)):
     Session = get_session()
     try:
         uid = uuid.UUID(user_id)