Upload app/api/auth.py

app/api/auth.py

@@ -0,0 +1,206 @@
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy.orm import Session
+from google.oauth2 import id_token
+from google.auth.transport import requests as google_requests
+
+from app.db.base import get_db
+from app.models.user import User, AuthProvider, UserRole
+from app.schemas.auth import (
+    RegisterRequest,
+    LoginRequest,
+    GoogleLoginRequest,
+    RefreshRequest,
+    TokenResponse,
+    UserResponse,
+    AuthResponse,
+)
+from app.core.security import (
+    hash_password,
+    verify_password,
+    create_access_token,
+    create_refresh_token,
+    decode_token,
+    get_current_user,
+)
+from app.core.config import settings
+
+router = APIRouter(prefix="/auth", tags=["Authentication"])
+
+
+def _generate_tokens(user_id: int) -> dict:
+    access_token = create_access_token({"sub": str(user_id)})
+    refresh_token = create_refresh_token({"sub": str(user_id)})
+    return {
+        "access_token": access_token,
+        "refresh_token": refresh_token,
+        "token_type": "bearer",
+    }
+
+
+@router.post("/register", response_model=AuthResponse, status_code=status.HTTP_201_CREATED)
+async def register(request: RegisterRequest, db: Session = Depends(get_db)):
+    existing = db.query(User).filter(User.email == request.email).first()
+    if existing:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="Email already registered",
+        )
+
+    user = User(
+        name=request.name,
+        email=request.email,
+        password_hash=hash_password(request.password),
+        phone=request.phone,
+        role=UserRole.CUSTOMER,
+        auth_provider=AuthProvider.LOCAL,
+    )
+    db.add(user)
+    db.commit()
+    db.refresh(user)
+
+    tokens = _generate_tokens(user.id)
+    user_data = UserResponse.model_validate(user).model_dump()
+    user_data["created_at"] = user_data["created_at"].isoformat()
+
+    return AuthResponse(
+        isSuccess=True,
+        value={"tokens": tokens, "user": user_data},
+        statusCode=201,
+    )
+
+
+@router.post("/login", response_model=AuthResponse)
+async def login(request: LoginRequest, db: Session = Depends(get_db)):
+    user = db.query(User).filter(User.email == request.email).first()
+    if not user or not user.password_hash:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid email or password",
+        )
+
+    if not verify_password(request.password, user.password_hash):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid email or password",
+        )
+
+    tokens = _generate_tokens(user.id)
+    user_data = UserResponse.model_validate(user).model_dump()
+    user_data["created_at"] = user_data["created_at"].isoformat()
+
+    return AuthResponse(
+        isSuccess=True,
+        value={"tokens": tokens, "user": user_data},
+        statusCode=200,
+    )
+
+
+@router.post("/google", response_model=AuthResponse)
+async def google_login(request: GoogleLoginRequest, db: Session = Depends(get_db)):
+    """Authenticate user with Google ID token."""
+    if not settings.GOOGLE_CLIENT_ID:
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="Google authentication is not configured",
+        )
+
+    try:
+        idinfo = id_token.verify_oauth2_token(
+            request.credential,
+            google_requests.Request(),
+            settings.GOOGLE_CLIENT_ID,
+        )
+    except ValueError:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid Google token",
+        )
+
+    google_id = idinfo.get("sub")
+    email = idinfo.get("email")
+    name = idinfo.get("name", "")
+    avatar_url = idinfo.get("picture", "")
+
+    if not email:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Google account does not have an email",
+        )
+
+    # Check if user exists by google_id
+    user = db.query(User).filter(User.google_id == google_id).first()
+
+    if not user:
+        # Check if user exists by email (link accounts)
+        user = db.query(User).filter(User.email == email).first()
+        if user:
+            # Link existing account to Google
+            user.google_id = google_id
+            user.auth_provider = AuthProvider.GOOGLE
+            if not user.avatar_url:
+                user.avatar_url = avatar_url
+        else:
+            # Create new user
+            user = User(
+                name=name,
+                email=email,
+                google_id=google_id,
+                avatar_url=avatar_url,
+                auth_provider=AuthProvider.GOOGLE,
+                role=UserRole.CUSTOMER,
+            )
+            db.add(user)
+
+    db.commit()
+    db.refresh(user)
+
+    tokens = _generate_tokens(user.id)
+    user_data = UserResponse.model_validate(user).model_dump()
+    user_data["created_at"] = user_data["created_at"].isoformat()
+
+    return AuthResponse(
+        isSuccess=True,
+        value={"tokens": tokens, "user": user_data},
+        statusCode=200,
+    )
+
+
+@router.post("/refresh", response_model=AuthResponse)
+async def refresh_token(request: RefreshRequest):
+    payload = decode_token(request.refresh_token)
+    if payload.get("type") != "refresh":
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid token type — expected refresh token",
+        )
+
+    user_id = payload.get("sub")
+    tokens = _generate_tokens(int(user_id))
+
+    return AuthResponse(
+        isSuccess=True,
+        value={"tokens": tokens},
+        statusCode=200,
+    )
+
+
+@router.get("/me", response_model=AuthResponse)
+async def get_me(
+    user_id: int = Depends(get_current_user),
+    db: Session = Depends(get_db),
+):
+    user = db.query(User).filter(User.id == user_id).first()
+    if not user:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="User not found",
+        )
+
+    user_data = UserResponse.model_validate(user).model_dump()
+    user_data["created_at"] = user_data["created_at"].isoformat()
+
+    return AuthResponse(
+        isSuccess=True,
+        value={"user": user_data},
+        statusCode=200,
+    )