updated get otp to support login and register, implemented protected apis and other improvements

app/controllers/merchant_controller.py

@@ -2,7 +2,7 @@ import logging
 from typing import Optional
 from datetime import datetime, timedelta
 from fastapi import APIRouter, HTTPException, Query, Depends, status, Body
-from app.models.merchant import MerchantRegister
+from app.models.merchant import MerchantRegister, GetOtpRequest
 from app.services.merchant_services import generate_and_send_otp, get_otp_from_cache, verify_otp_and_save_merchant, validate_merchant
 
 
@@ -68,35 +68,36 @@ async def customer_otp_verification(user: MerchantRegister = Body(...)):
         logger.error("Unexpected error while verifying and registering merchant: %s", e)
         raise HTTPException(status_code=500, detail="Failed to verify and register merchant") from e
 
-@router.get("/otp/get")
-async def get_otps(key: str = Query(..., description="The email or mobile number to retrieve the OTP for")):
+@router.post("/otp/get")
+async def get_otps(payload: GetOtpRequest):
     """
     API endpoint to retrieve the email or SMS OTP from Redis cache.
 
     Args:
-        key (str): The email or mobile number to retrieve the OTP for.
+        payload (GetOtpRequest): The request payload containing the identifier and type.
 
     Returns:
         dict: The OTP data if found, or an error message if not found.
     """
     try:
-        logger.info("Retrieving OTP for key: %s", key)
+        logger.info("Retrieving OTP for identifier: %s, type: %s", payload.identifier, payload.type)
+
+        # Construct the Redis key based on the type
+        redis_key = f"otp:{payload.type}:{payload.identifier}"
 
         # Retrieve OTP from Redis
-        otp_data = await get_otp_from_cache(f"otp:reg:{key}")
+        otp_data = await get_otp_from_cache(redis_key)
         if not otp_data:
             raise HTTPException(status_code=404, detail="OTP not found or expired")
 
-        return {"key": key, "otp_data": otp_data}
+        return {"identifier": payload.identifier, "type": payload.type, "otp_data": otp_data}
 
     except HTTPException as e:
-        logger.error("Failed to retrieve OTP for key %s: %s", key, e.detail)
+        logger.error("Failed to retrieve OTP for identifier %s, type %s: %s", payload.identifier, payload.type, e.detail)
         raise e
     except Exception as e:
-        logger.error("Unexpected error while retrieving OTP for key %s: %s", key, e)
-        raise HTTPException(status_code=500, detail="Failed to retrieve OTP") from e  
-    
-from app.services.merchant_services import generate_and_send_otp
+        logger.error("Unexpected error while retrieving OTP for identifier %s, type %s: %s", payload.identifier, payload.type, e)
+        raise HTTPException(status_code=500, detail="Failed to retrieve OTP") from e
 
 @router.post("/otp/regenerate")
 async def regenerate_otp(user: MerchantRegister = Body(...)):

app/controllers/merchant_login_controller.py

@@ -3,9 +3,12 @@ from app.services.merchant_services import (
     login_service,
     refresh_token_service,
     logout_service,
+    get_user_details_service,
 )
 from fastapi.security import OAuth2PasswordRequestForm
 from fastapi import APIRouter, HTTPException, Query, Depends, status, Body
+from app.models.merchant import LoginOtpRequest, RefreshTokenRequest, MerchantDetailsResponse
+from app.utils.auth_utils import verify_token
 import logging
 
 # Initialize router and logger
@@ -13,18 +16,18 @@ router = APIRouter(prefix="/merchant")
 logger = logging.getLogger(__name__)
 
 @router.post("/login/otp")
-async def generate_login_otp(identifier: str = Body(..., description="Email or Mobile number")):
+async def generate_login_otp(payload: LoginOtpRequest):
     """
     Generate and send login OTP to the provided email or mobile number.
 
     Args:
-        identifier (str): Email or mobile number.
+        payload (GenerateLoginOtpRequest): The request payload containing the identifier.
 
     Returns:
         dict: Confirmation message indicating OTP has been sent.
     """
     try:
-        result = await generate_login_otp_service(identifier)
+        result = await generate_login_otp_service(payload.identifier)
         return result
     except HTTPException as e:
         logger.error("Failed to generate login OTP: %s", e.detail)
@@ -57,33 +60,29 @@ async def login(user: OAuth2PasswordRequestForm = Depends()):
 
 
 @router.post("/token/refresh")
-async def refresh_token(
-    identifier: str = Body(..., description="Email or Mobile number"),
-    refresh_token: str = Body(..., description="Refresh token")
-):
+async def refresh_token(payload: RefreshTokenRequest):
     """
     Refresh access and refresh tokens.
 
     Args:
-        identifier (str): Email or mobile number.
-        refresh_token (str): The refresh token.
+        payload (RefreshTokenRequest): The request payload containing the identifier and refresh token.
 
     Returns:
         dict: New access and refresh tokens.
     """
     try:
-        result = await refresh_token_service(identifier, refresh_token)
+        result = await refresh_token_service(payload.identifier, payload.refresh_token)
         return result
     except HTTPException as e:
-        logger.error("Failed to refresh token for identifier %s: %s", identifier, e.detail)
+        logger.error("Failed to refresh token for identifier %s: %s", payload.identifier, e.detail)
         raise e
     except Exception as e:
-        logger.error("Unexpected error while refreshing token for identifier %s: %s", identifier, e)
+        logger.error("Unexpected error while refreshing token for identifier %s: %s", payload.identifier, e)
         raise HTTPException(status_code=500, detail="Failed to refresh token") from e
 
 
 @router.post("/logout")
-async def logout(identifier: str = Body(..., description="Email or Mobile number")):
+async def logout(payload: LoginOtpRequest):
     """
     Logout the user by invalidating access and refresh tokens.
 
@@ -94,11 +93,32 @@ async def logout(identifier: str = Body(..., description="Email or Mobile number
         dict: Confirmation message.
     """
     try:
-        result = await logout_service(identifier)
+        result = await logout_service(payload.identifier)
         return result
     except HTTPException as e:
         logger.error("Failed to logout: %s", e.detail)
         raise e
     except Exception as e:
         logger.error("Unexpected error during logout: %s", e)
-        raise HTTPException(status_code=500, detail="Failed to logout") from e
+        raise HTTPException(status_code=500, detail="Failed to logout") from e
+
+@router.get("/user/details", response_model=MerchantDetailsResponse, dependencies=[Depends(verify_token)])
+async def get_user_details(identifier: str = Query(..., description="Email or Mobile number")):
+    """
+    Get user details using the identifier (email or mobile).
+
+    Args:
+        identifier (str): Email or mobile number.
+
+    Returns:
+        MerchantDetailsResponse: User details from the database.
+    """
+    try:
+        result = await get_user_details_service(identifier)
+        return result
+    except HTTPException as e:
+        logger.error("Failed to retrieve user details for identifier %s: %s", identifier, e.detail)
+        raise e
+    except Exception as e:
+        logger.error("Unexpected error while retrieving user details for identifier %s: %s", identifier, e)
+        raise HTTPException(status_code=500, detail="Failed to retrieve user details") from e

app/models/merchant.py

@@ -1,5 +1,5 @@
 from pydantic import BaseModel, EmailStr, Field
-from typing import Optional
+from typing import Optional, Literal
 from datetime import datetime
 
 class MerchantRegister(BaseModel):
@@ -16,4 +16,22 @@ class MerchantRegister(BaseModel):
     status: Optional[str] = Field("pending-verification", description="The status of the customer account")
     email_ver_code: Optional[str] = None #(..., description="The email verification code")
     mobile_ver_code: Optional[str] = None #(..., description="The mobile verification code")
-    created_at: Optional[datetime] = Field(default_factory=datetime.now, description="The timestamp when the customer was created")
+    created_at: Optional[datetime] = Field(default_factory=datetime.now, description="The timestamp when the customer was created")
+    
+class LoginOtpRequest(BaseModel):
+    identifier: str = Field(..., description="Email or Mobile number")
+    
+class RefreshTokenRequest(BaseModel):
+    identifier: str = Field(..., description="Email or Mobile number")
+    refresh_token: str = Field(..., description="Refresh token")
+    
+class GetOtpRequest(BaseModel):
+    identifier: str = Field(..., description="The email or mobile number to retrieve the OTP for")
+    type: Literal["register", "login"] = Field(..., description="The type of OTP (register or login)")
+    
+class MerchantDetailsResponse(BaseModel):
+    merchant_id: str
+    merchant_name: str
+    mobile: str
+    email: EmailStr
+    country: str

app/services/merchant_services.py

@@ -1,7 +1,7 @@
 import logging
 import random   
 from fastapi import HTTPException
-from app.models.merchant import MerchantRegister
+from app.models.merchant import MerchantRegister, MerchantDetailsResponse
 from app.repositories.db_repository import save_merchant, get_merchant_by_name, get_merchant_by_email, get_merchant_by_mobile
 from app.utils.merchant_utils import generate_tenant_id
 from app.utils.auth_utils import validate_email, validate_mobile, generate_tokens
@@ -62,8 +62,8 @@ async def send_sms_email_verification(email: str, mobile: str):
     # Generate a 6-digit OTP
     otp = ''.join(random.choices("0123456789", k=6))    
     # Store OTP in cache with a 15-minute expiry
-    await set_otp(f"otp:reg:{email}", {"otp": otp, "expiry_duration": 15 * 60})  # 15 minutes in seconds
-    await set_otp(f"otp:reg:{mobile}", {"otp": otp, "expiry_duration": 15 * 60})  # 15 minutes in seconds
+    await set_otp(f"otp:register:{email}", {"otp": otp, "expiry_duration": 15 * 60})  # 15 minutes in seconds
+    await set_otp(f"otp:register:{mobile}", {"otp": otp, "expiry_duration": 15 * 60})  # 15 minutes in seconds
     # Send the OTP to the email address 
     # (You would typically use an email service here)
     # For demonstration, we'll just log the OTP    
@@ -83,8 +83,8 @@ async def verify_otp_and_save_merchant(merchant: MerchantRegister) -> dict:
     errors = []
 
     # Retrieve OTPs from cache
-    email_otp_data = await get_otp(f"otp:reg:{merchant.email}")
-    mobile_otp_data = await get_otp(f"otp:reg:{merchant.mobile}")
+    email_otp_data = await get_otp(f"otp:register:{merchant.email}")
+    mobile_otp_data = await get_otp(f"otp:register:{merchant.mobile}")
 
     # Verify email OTP
     email_verified = email_otp_data and email_otp_data["otp"] == merchant.email_ver_code
@@ -143,8 +143,8 @@ async def generate_and_send_otp(email: str, mobile: str) -> None:
         otp = ''.join(random.choices("0123456789", k=6))
 
         # Store OTP in cache with a 15-minute expiry
-        await set_otp(f"otp:reg:{email}", {"otp": otp, "expiry_duration": 15 * 60})  # 15 minutes in seconds
-        await set_otp(f"otp:reg:{mobile}", {"otp": otp, "expiry_duration": 15 * 60})
+        await set_otp(f"otp:register:{email}", {"otp": otp, "expiry_duration": 15 * 60})  # 15 minutes in seconds
+        await set_otp(f"otp:register:{mobile}", {"otp": otp, "expiry_duration": 15 * 60})
 
         # Log the OTP generation
         logger.info("Generated OTP for %s & %s: %s", email, mobile, otp)
@@ -254,3 +254,45 @@ async def logout_service(identifier: str) -> dict:
     await delete_cache(f"token:login:refresh:{identifier}")
     
     return {"message": "Successfully logged out."}
+
+async def get_user_details_service(identifier: str) -> MerchantDetailsResponse:
+    """
+    Retrieve user details from the database using the identifier.
+
+    Args:
+        identifier (str): Email or mobile number.
+
+    Returns:
+        MerchantDetailsResponse: User details if found.
+
+    Raises:
+        HTTPException: If the user is not found.
+    """
+    try:
+        if "@" in identifier:
+            # Fetch user by email
+            user = await get_merchant_by_email(identifier)
+        else:
+            # Fetch user by mobile
+            user = await get_merchant_by_mobile(identifier)
+
+        if not user:
+            raise HTTPException(status_code=404, detail="User not found")
+        
+        # Convert ObjectId to string if present
+        if "_id" in user:
+            user["_id"] = str(user["_id"])
+
+        # Extract only the required fields
+        response_data = MerchantDetailsResponse(
+            merchant_id=user.get("merchant_id"),
+            merchant_name=user.get("merchant_name"),
+            mobile=user.get("mobile"),
+            email=user.get("email"),
+            country=user.get("country"),
+        )
+
+        return response_data
+    except Exception as e:
+        logger.error("Failed to retrieve user details for identifier %s: %s", identifier, e)
+        raise HTTPException(status_code=500, detail="Failed to retrieve user details") from e

app/utils/auth_utils.py

@@ -1,8 +1,11 @@
 import re
 import logging
-from fastapi import HTTPException
+from fastapi import HTTPException, Security  # Import Security here
 from jose import JWTError, jwt
 from datetime import datetime, timedelta
+from fastapi.security import HTTPBearer
+
+security = HTTPBearer()
 
 SECRET_KEY = "B@@kMy$er^!(e"
 ALGORITHM = "HS256"
@@ -51,18 +54,22 @@ def generate_tokens(identifier: str) -> dict:
     return {"access_token": access_token, "refresh_token": refresh_token, "token_type": "bearer"}
 
 
-def verify_token(token: str) -> dict:
+def verify_token(token: str = Security(security)) -> dict:
     """
-    Verify and decode a JWT token.
+    Verify the access token.
 
     Args:
-        token (str): The JWT token.
+        token (str): The access token.
 
     Returns:
         dict: Decoded token data.
+
+    Raises:
+        HTTPException: If the token is invalid or expired.
     """
     try:
-        return jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
+        payload = jwt.decode(token.credentials, SECRET_KEY, algorithms=[ALGORITHM])
+        return payload
     except jwt.ExpiredSignatureError:
         raise HTTPException(status_code=401, detail="Token has expired")
     except jwt.InvalidTokenError: