Add auth router

app/routers/auth.py

@@ -0,0 +1,40 @@
+"""Authentication routes: register and login."""
+from fastapi import APIRouter, Depends, HTTPException
+from pydantic import BaseModel
+from sqlalchemy.orm import Session
+
+from .. import models, schemas, security
+from ..database import get_db
+
+router = APIRouter(prefix="/auth", tags=["auth"])
+
+
+class LoginRequest(BaseModel):
+    username: str
+    password: str
+
+
+@router.post("/register", response_model=schemas.Token, status_code=201)
+def register(body: schemas.UserCreate, db: Session = Depends(get_db)):
+    if db.query(models.User).filter(models.User.username == body.username).first():
+        raise HTTPException(409, "Username already taken")
+    if db.query(models.User).filter(models.User.email == body.email).first():
+        raise HTTPException(409, "Email already registered")
+
+    user = models.User(
+        username=body.username,
+        email=body.email,
+        hashed_password=security.hash_password(body.password),
+    )
+    db.add(user)
+    db.commit()
+    db.refresh(user)
+    return schemas.Token(access_token=security.create_access_token(user.id), user=user)
+
+
+@router.post("/login", response_model=schemas.Token)
+def login(body: LoginRequest, db: Session = Depends(get_db)):
+    user = db.query(models.User).filter(models.User.username == body.username).first()
+    if user is None or not security.verify_password(body.password, user.hashed_password):
+        raise HTTPException(401, "Invalid username or password")
+    return schemas.Token(access_token=security.create_access_token(user.id), user=user)