96 lines
3.4 KiB
Python
96 lines
3.4 KiB
Python
from fastapi import APIRouter, Depends, HTTPException, status
|
|
from fastapi.security import OAuth2PasswordRequestForm
|
|
from pydantic import BaseModel, field_validator
|
|
from typing import Optional
|
|
from datetime import datetime, timezone
|
|
import uuid
|
|
|
|
from bd import make_engine
|
|
|
|
from bd.tables.users import User
|
|
from route.auth_utils import hash_password, verify_password, create_access_token, SECRET_KEY, ALGORITHM, oauth2_scheme
|
|
from jose import jwt, JWTError
|
|
from redis_db import blacklist_token
|
|
|
|
router = APIRouter(tags=["auth"], prefix="/auth")
|
|
|
|
|
|
def get_session():
|
|
from sqlalchemy.orm import sessionmaker
|
|
return sessionmaker(bind=make_engine(), future=True)
|
|
|
|
|
|
class RegisterIn(BaseModel):
|
|
username: str
|
|
password: str
|
|
first_name: str
|
|
last_name: str
|
|
group_id: Optional[str] = None
|
|
organization_id: Optional[str] = None
|
|
|
|
@field_validator("password")
|
|
@classmethod
|
|
def password_strength(cls, v: str) -> str:
|
|
if len(v) < 8:
|
|
raise ValueError("Password must be at least 8 characters")
|
|
return v
|
|
|
|
@field_validator("username")
|
|
@classmethod
|
|
def username_clean(cls, v: str) -> str:
|
|
v = v.strip()
|
|
if len(v) < 3:
|
|
raise ValueError("Username must be at least 3 characters")
|
|
return v
|
|
|
|
|
|
@router.post("/register", status_code=201)
|
|
def register(payload: RegisterIn):
|
|
Session = get_session()
|
|
with Session() as session:
|
|
existing = session.query(User).filter(User.username == payload.username).first()
|
|
if existing:
|
|
raise HTTPException(status_code=400, detail="Username already taken")
|
|
user = User(
|
|
first_name=payload.first_name.strip(),
|
|
last_name=payload.last_name.strip(),
|
|
username=payload.username,
|
|
hashed_password=hash_password(payload.password),
|
|
group_id=uuid.UUID(payload.group_id) if payload.group_id else None,
|
|
organization_id=uuid.UUID(payload.organization_id) if payload.organization_id else None,
|
|
)
|
|
session.add(user)
|
|
session.commit()
|
|
session.refresh(user)
|
|
return {"id": str(user.id), "username": user.username}
|
|
|
|
|
|
@router.post("/login")
|
|
def login(form: OAuth2PasswordRequestForm = Depends()):
|
|
Session = get_session()
|
|
with Session() as session:
|
|
user = session.query(User).filter(User.username == form.username).first()
|
|
if not user or not verify_password(form.password, user.hashed_password):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Incorrect username or password",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
token = create_access_token({"sub": str(user.id)})
|
|
return {"access_token": token, "token_type": "bearer"}
|
|
|
|
|
|
@router.post("/logout")
|
|
def logout(token: str = Depends(oauth2_scheme)):
|
|
"""Инвалидирует текущий Bearer-токен через Redis блэклист."""
|
|
try:
|
|
payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
|
|
jti: str | None = payload.get("jti")
|
|
exp: int | None = payload.get("exp")
|
|
if jti and exp:
|
|
ttl = max(0, exp - int(datetime.now(timezone.utc).timestamp()))
|
|
blacklist_token(jti, ttl)
|
|
except JWTError:
|
|
pass # токен уже невалиден — ничего не делаем
|
|
return {"detail": "Successfully logged out"}
|