backend/api/auth_routes.py

from fastapi import APIRouter, HTTPException
from datetime import datetime, timedelta
import random
from backend.models.user import OTPRequest, OTPVerify
from backend.core.database import get_database
from backend.core.security import create_access_token
from backend.services.telethon_client import send_telegram_message
from backend.worker.telegram_bot import send_sys_log

router = APIRouter(prefix="/auth", tags=["Authentication"])

@router.post("/send-otp")
async def send_otp(request: OTPRequest):
    db = get_database()
    identifier = request.telegram_username_or_phone
    
    # Generate a 6-digit OTP
    otp_code = str(random.randint(100000, 999999))
    expiry = datetime.utcnow() + timedelta(minutes=5)
    
    # Store OTP in MongoDB
    await db["otps"].update_one(
        {"identifier": identifier},
        {"$set": {"otp": otp_code, "expires_at": expiry}},
        upsert=True
    )
    
    # Send OTP via Telethon (MTProto)
    message = f"🔐 Your HF Cron Manager Pro login OTP is: {otp_code}\n\nThis code is valid for 5 minutes."
    
    try:
        await send_telegram_message(identifier, message)
    except Exception as e:
        print("Telethon Execution Error:", str(e))
        raise HTTPException(status_code=500, detail=f"Failed to send Telegram message via Telethon. Ensure you have started the bot. Error: {str(e)}")
    
    return {"message": "OTP sent successfully. Please check Telegram."}

@router.post("/verify-otp")
async def verify_otp(request: OTPVerify):
    db = get_database()
    identifier = request.telegram_username_or_phone
    
    # Fetch OTP record
    otp_record = await db["otps"].find_one({"identifier": identifier})
    
    if not otp_record or otp_record["otp"] != request.otp:
        raise HTTPException(status_code=400, detail="Invalid OTP")
        
    if otp_record["expires_at"] < datetime.utcnow():
        await db["otps"].delete_one({"identifier": identifier})
        raise HTTPException(status_code=400, detail="OTP has expired")
        
    # OTP is valid, clear it from DB
    await db["otps"].delete_one({"identifier": identifier})
    
    # Find user or create new user
    user = await db["users"].find_one({"telegram_id": identifier})
    if not user:
        new_user = {
            "telegram_id": identifier,
            "telegram_username": identifier, 
            "is_admin": False,
            "created_at": datetime.utcnow()
        }
        await db["users"].insert_one(new_user)
    
    # Generate JWT Session Token
    access_token = create_access_token(data={"sub": identifier})
    
    # 🔴 Trigger the live logging bot
    await send_sys_log(f"👤 **User Access:** Telegram ID `{identifier}` just logged into the portal.")
    
    return {
        "access_token": access_token, 
        "token_type": "bearer",
        "message": "Login successful"
    }