app/api/auth.py

# app/api/auth.py
"""

Authentication endpoints — production-hardened.



Endpoints:

  POST /api/auth/register        — create account, returns token pair

  POST /api/auth/login           — authenticate, returns token pair

  POST /api/auth/refresh         — rotate refresh token

  POST /api/auth/logout          — blacklist access token, clear refresh token

  POST /api/auth/change-password — change password with old password verification

  GET  /api/auth/profile         — get current user profile

  PATCH /api/auth/profile        — update name / coach_personality

"""

import logging
from datetime import timezone

from fastapi import APIRouter, Depends, HTTPException, Request, status
from sqlalchemy.orm import Session

from app.core.database import get_db
from app.core.security import (
    blacklist_token,
    create_token_pair_with_session,
    generate_selector_verifier,
    verify_verifier,
    set_cached_versions,
    get_current_token,
    get_current_user,
    hash_password,
    record_failed_login,
    reset_failed_logins,
    verify_password,
)
from datetime import datetime, timedelta
from app.core.limiter import limiter
from app.core.redis_client import get_redis as _get_redis
from app.models.user import User
from app.schemas.auth import (
    ChangePasswordRequest,
    LoginRequest,
    MessageResponse,
    RefreshTokenRequest,
    RefreshTokenResponse,
    RegisterRequest,
    TokenResponse,
    UpdateProfileRequest,
    UserProfile,
)

logger = logging.getLogger("hale.api.auth")
router = APIRouter(prefix="/api/auth", tags=["Authentication"])


# ──────────────────────────────────────────────
# Register
# ──────────────────────────────────────────────

@router.post(

    "/register",

    response_model=TokenResponse,

    status_code=status.HTTP_201_CREATED,

    summary="Create a new user account",

)
@limiter.limit("3/minute")
def register(

    request: Request,

    payload: RegisterRequest,

    db: Session = Depends(get_db),

) -> TokenResponse:
    # Username uniqueness
    if db.query(User).filter(User.user_id == payload.user_id).first():
        raise HTTPException(
            status_code=status.HTTP_409_CONFLICT,
            detail=f"Username '{payload.user_id}' is already taken",
        )

    # Email uniqueness (if provided)
    if payload.email:
        if db.query(User).filter(User.email == payload.email).first():
            raise HTTPException(
                status_code=status.HTTP_409_CONFLICT,
                detail="Email already registered",
            )

    user = User(
        user_id=payload.user_id,
        email=payload.email,
        name=payload.name or payload.user_id,
        hashed_password=hash_password(payload.password),
        last_login_at=datetime.now(timezone.utc),   # Set on creation so inactivity decay works
    )
    db.add(user)
    db.commit()
    db.refresh(user)

    # Issue token pair with active UserSession
    from app.models.session import UserSession
    tokens = create_token_pair_with_session(user.user_id, 1, user.user_version)
    user_session = UserSession(
        user_id=user.user_id,
        selector=tokens["selector"],
        verifier_hash=tokens["verifier_hash"],
        session_version=1,
        ip_address=request.client.host if request.client else None,
        user_agent=request.headers.get("User-Agent"),
        is_compromised=False,
        expires_at=datetime.now(timezone.utc) + timedelta(days=30),
    )
    db.add(user_session)
    db.commit()

    redis = _get_redis()
    if redis:
        set_cached_versions(user.user_id, tokens["selector"], user.user_version, 1)

    logger.info("New user registered: %s", user.user_id)

    return TokenResponse(
        access_token=tokens["access_token"],
        refresh_token=tokens["refresh_token"],
        user_id=user.user_id,
        name=user.name,
    )


async def get_login_payload(request: Request) -> LoginRequest:
    content_type = request.headers.get("content-type", "")
    if "application/x-www-form-urlencoded" in content_type:
        form_data = await request.form()
        user_id = form_data.get("username") or form_data.get("user_id")
        password = form_data.get("password")
        if not user_id or not password:
            raise HTTPException(
                status_code=status.HTTP_400_BAD_REQUEST,
                detail="Missing username or password in form data",
            )
        return LoginRequest(user_id=str(user_id), password=str(password))
    else:
        try:
            body = await request.json()
            return LoginRequest(**body)
        except Exception:
            raise HTTPException(
                status_code=status.HTTP_400_BAD_REQUEST,
                detail="Invalid JSON payload or content-type",
            )


@router.post(

    "/login",

    response_model=TokenResponse,

    summary="Login and receive a JWT token pair",

)
@limiter.limit("5/minute")
def login(

    request: Request,

    payload: LoginRequest = Depends(get_login_payload),

    db: Session = Depends(get_db),

) -> TokenResponse:
    # Find user by user_id OR email (case-insensitive)
    user_id_lower = payload.user_id.lower().strip()
    user = db.query(User).filter(
        (User.user_id.ilike(user_id_lower)) | (User.email.ilike(user_id_lower))
    ).first()

    # Unknown user
    if not user:
        logger.warning("[Login] User not found: %s", payload.user_id)
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid credentials",
        )

    if not user.hashed_password:
        logger.error("[Login] User %s exists but has no password hash!", user.user_id)
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid credentials",
        )

    # Account lockout check
    if user.is_locked:
        logger.warning("[Login] Locked account attempt: %s", user.user_id)
        raise HTTPException(
            status_code=status.HTTP_423_LOCKED,
            detail=(
                "Account temporarily locked due to too many failed login attempts. "
                "Please try again in a few minutes."
            ),
        )

    # Wrong password
    if not verify_password(payload.password, user.hashed_password):
        logger.warning("[Login] Password mismatch for user: %s", user.user_id)
        record_failed_login(db, user)
        remaining = max(0, 5 - (user.failed_login_count or 0))
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail=f"Invalid credentials. {remaining} attempt(s) remaining before lockout.",
        )

    # Inactive account
    if not user.is_active:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="Account is deactivated",
        )

    # Success — reset lockout, issue tokens with active UserSession
    reset_failed_logins(db, user)   # Also sets last_login_at
    
    from app.models.session import UserSession
    tokens = create_token_pair_with_session(user.user_id, 1, user.user_version)
    user_session = UserSession(
        user_id=user.user_id,
        selector=tokens["selector"],
        verifier_hash=tokens["verifier_hash"],
        session_version=1,
        ip_address=request.client.host if request.client else None,
        user_agent=request.headers.get("User-Agent"),
        is_compromised=False,
        expires_at=datetime.now(timezone.utc) + timedelta(days=30),
    )
    db.add(user_session)
    db.commit()

    redis = _get_redis()
    if redis:
        set_cached_versions(user.user_id, tokens["selector"], user.user_version, 1)

    logger.info("User logged in: %s", user.user_id)

    return TokenResponse(
        access_token=tokens["access_token"],
        refresh_token=tokens["refresh_token"],
        user_id=user.user_id,
        name=user.name,
    )


# ──────────────────────────────────────────────
# Refresh
# ──────────────────────────────────────────────

@router.post(

    "/refresh",

    response_model=RefreshTokenResponse,

    summary="Rotate refresh token and get a new access token",

)
@limiter.limit("10/minute")
def refresh_token(

    request: Request,

    payload: RefreshTokenRequest,

    db: Session = Depends(get_db),

) -> RefreshTokenResponse:
    """

    Validates the provided selector-verifier refresh token, rotates it (single-use RTR),

    checks the concurrency idempotency cache, and issues a fresh versioned token pair.

    """
    from app.models.session import UserSession
    import json

    token_str = payload.refresh_token
    if not token_str or "." not in token_str:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid or expired refresh token",
        )

    try:
        selector, verifier = token_str.split(".", 1)
    except ValueError:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid token format",
        )

    redis = _get_redis()
    idempotency_key = f"hale:idempotency:refresh:{selector}"

    # 1. Check Idempotency Cache for parallel tab storms / retries
    if redis:
        try:
            cached_val = redis.get(idempotency_key)
            if cached_val:
                logger.info("[Refresh] Idempotency Cache Hit for selector: %s", selector)
                resp_data = json.loads(cached_val)
                return RefreshTokenResponse(**resp_data)
        except Exception as exc:
            logger.warning("Redis idempotency read failed: %s", exc)

    # 2. Database selector lookup (B-Tree unique index hit, O(1) DB lookups)
    session = db.query(UserSession).filter(UserSession.selector == selector).first()
    if not session:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid or expired refresh token",
        )

    # 3. Fraud / Compromise detection
    if session.is_compromised:
        # Invalidate all user sessions on replay outside grace window
        db.query(UserSession).filter(UserSession.user_id == session.user_id).update({"is_compromised": True})
        db.commit()
        logger.error("[Refresh] Replay detected! Session compromised. User: %s", session.user_id)
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Suspicious activity detected. All active sessions revoked.",
        )

    # 4. Expiry checks
    if not session.expires_at:
        db.delete(session)
        db.commit()
        raise HTTPException(status_code=401, detail="Session expired")

    session_expiry = session.expires_at.replace(tzinfo=timezone.utc) if session.expires_at.tzinfo is None else session.expires_at
    if datetime.now(timezone.utc) > session_expiry:
        db.delete(session)
        db.commit()
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Session expired",
        )

    # 5. Cryptographic constant-time verification of the verifier hash
    if not verify_verifier(verifier, session.verifier_hash):
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid or expired refresh token",
        )

    user = db.query(User).filter(User.user_id == session.user_id).first()
    if not user or not user.is_active:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="Account is deactivated or not found",
        )

    # 6. Rotate (Atomic Session Version Update / Compare-And-Swap)
    current_version = session.session_version
    plain_token, new_selector, verifier_hash = generate_selector_verifier()

    # CAS update to prevent parallel worker overwrites
    updated_rows = (
        db.query(UserSession)
        .filter(UserSession.id == session.id, UserSession.session_version == current_version)
        .update({
            "selector": new_selector,
            "verifier_hash": verifier_hash,
            "session_version": current_version + 1,
            "last_active_at": datetime.now(timezone.utc),
            "ip_address": request.client.host if request.client else None,
            "user_agent": request.headers.get("User-Agent"),
        })
    )
    db.commit()

    if updated_rows == 0:
        # Fall back to won race cached response if available
        if redis:
            cached_val = redis.get(idempotency_key)
            if cached_val:
                resp_data = json.loads(cached_val)
                return RefreshTokenResponse(**resp_data)
        raise HTTPException(
            status_code=status.HTTP_409_CONFLICT,
            detail="Refresh conflict. Please retry.",
        )

    # Generate new versioned access token
    from app.core.security import create_access_token
    access = create_access_token(data={
        "sub": user.user_id,
        "sid": new_selector,
        "sv": current_version + 1,
        "uv": user.user_version
    })

    response_payload = {
        "access_token": access,
        "refresh_token": plain_token,
        "token_type": "bearer"
    }

    # 7. Write to Idempotency Cache (30s) and Version Cache
    if redis:
        try:
            redis.setex(idempotency_key, 30, json.dumps(response_payload))
            set_cached_versions(user.user_id, new_selector, user.user_version, current_version + 1)
        except Exception as exc:
            logger.warning("Redis cache update failed inside refresh: %s", exc)

    logger.info("Session rotated successfully for user: %s", user.user_id)
    return RefreshTokenResponse(**response_payload)


# ──────────────────────────────────────────────
# Logout
# ──────────────────────────────────────────────

@router.post(

    "/logout",

    response_model=MessageResponse,

    summary="Invalidate current access token and clear refresh token",

)
def logout(

    current_user: User = Depends(get_current_user),

    token: str = Depends(get_current_token),

    db: Session = Depends(get_db),

) -> MessageResponse:
    """Invalidate current session by blacklisting the access token and deleting the session selector."""
    from app.models.session import UserSession
    from app.core.security import decode_token, clear_cached_versions

    # Blacklist the current access token
    blacklist_token(token)

    # Decode claims to retrieve selector and invalidate session
    try:
        payload = decode_token(token)
        session_id = payload.get("sid")
        if session_id:
            db.query(UserSession).filter(UserSession.selector == session_id).delete()
            db.commit()
            clear_cached_versions(current_user.user_id, session_id)
    except Exception as exc:
        logger.error("[Logout] Failed to delete session cleanly: %s", exc)

    logger.info("User logged out: %s", current_user.user_id)
    return MessageResponse(message="Logged out successfully")


# ──────────────────────────────────────────────
# Change password
# ──────────────────────────────────────────────

@router.post(

    "/change-password",

    response_model=MessageResponse,

    summary="Change password with old password verification",

)
@limiter.limit("3/minute")
def change_password(

    request: Request,

    payload: ChangePasswordRequest,

    current_user: User = Depends(get_current_user),

    db: Session = Depends(get_db),

) -> MessageResponse:
    """Change user password, increment user_version (stateless invalidation), and delete all active sessions."""
    from app.models.session import UserSession
    from app.core.security import clear_cached_versions

    if not verify_password(payload.old_password, current_user.hashed_password):
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Old password is incorrect",
        )

    if payload.old_password == payload.new_password:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="New password must be different from the old password",
        )

    current_user.hashed_password = hash_password(payload.new_password)
    
    # Stateless invalidation: Increment user_version
    current_user.user_version = (current_user.user_version or 0) + 1
    
    # Revoke all multi-device sessions for this user in DB
    db.query(UserSession).filter(UserSession.user_id == current_user.user_id).delete()
    db.commit()

    # Invalidate all version caches
    clear_cached_versions(current_user.user_id)

    logger.info("Password changed and all active sessions globally revoked for: %s", current_user.user_id)
    return MessageResponse(message="Password changed successfully. Please log in again.")


# ──────────────────────────────────────────────
# Profile
# ──────────────────────────────────────────────

@router.get(

    "/profile",

    response_model=UserProfile,

    summary="Get the current user's profile",

)
def get_profile(current_user: User = Depends(get_current_user)) -> User:
    return current_user


@router.patch(

    "/profile",

    response_model=UserProfile,

    summary="Update profile fields (name, coach_personality)",

)
def update_profile(

    updates: UpdateProfileRequest,

    current_user: User = Depends(get_current_user),

    db: Session = Depends(get_db),

) -> User:
    """Update allowed profile fields. Only non-None fields are applied."""
    if updates.name is not None:
        current_user.name = updates.name
    if updates.coach_personality is not None:
        current_user.coach_personality = updates.coach_personality

    db.commit()
    db.refresh(current_user)
    return current_user