Update auth/routes.py

auth/routes.py

@@ -1,184 +1,148 @@
-"""
-auth/routes.py
-Enterprise Authentication Router
-Basyx Whisper V10.1
-"""
-
-from datetime import timedelta
-
 from fastapi import APIRouter, Depends, HTTPException, status
+from fastapi.security import OAuth2PasswordRequestForm
 from sqlalchemy.orm import Session
+from datetime import timedelta
+
+from auth.database import SessionLocal
+from auth.models import User
 
-from database import get_db
-from models import User
-from security import (
+from auth.security import (
     hash_password,
     verify_password,
     create_access_token,
     ACCESS_TOKEN_EXPIRE_MINUTES,
 )
 
-router = APIRouter(prefix="/api/auth", tags=["Auth"])
-
+import logging
 
-# ==========================================================
-# REQUEST SCHEMAS (inline to avoid dependency fragmentation)
-# ==========================================================
+logger = logging.getLogger("auth.routes")
 
-from pydantic import BaseModel, EmailStr, Field
+router = APIRouter(prefix="/api/auth", tags=["Authentication"])
 
 
-class SignupRequest(BaseModel):
-    email: EmailStr
-    username: str = Field(min_length=3, max_length=50)
-    password: str = Field(min_length=8, max_length=72)
+# =========================================================
+# DB SESSION DEPENDENCY
+# =========================================================
 
+def get_db():
+    db = SessionLocal()
+    try:
+        yield db
+    finally:
+        db.close()
 
-class LoginRequest(BaseModel):
-    email: EmailStr
-    password: str = Field(min_length=1, max_length=72)
 
-
-# ==========================================================
-# HELPERS
-# ==========================================================
-
-def get_user_by_email(db: Session, email: str):
-    return db.query(User).filter(User.email == email.lower()).first()
-
-
-# ==========================================================
+# =========================================================
 # SIGNUP
-# ==========================================================
+# =========================================================
+
+@router.post("/signup")
+def signup(
+    username: str,
+    password: str,
+    db: Session = Depends(get_db),
+):
+    """
+    Creates a new user account.
+    """
+
+    if not username or not password:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Username and password are required",
+        )
 
-@router.post("/signup", status_code=201)
-def signup(payload: SignupRequest, db: Session = Depends(get_db)):
-    email = payload.email.lower().strip()
+    # Check existing user
+    existing = db.query(User).filter(User.username == username).first()
 
-    # ---- duplicate check
-    existing = get_user_by_email(db, email)
     if existing:
         raise HTTPException(
             status_code=status.HTTP_409_CONFLICT,
-            detail="Account already exists",
+            detail="Username already exists",
         )
 
-    # ---- security: bcrypt safe boundary enforcement
-    password = payload.password
-    if len(password.encode("utf-8")) > 72:
-        raise HTTPException(
-            status_code=400,
-            detail="Password exceeds bcrypt 72-byte limit",
+    try:
+        new_user = User(
+            username=username,
+            password_hash=hash_password(password),
         )
 
-    # ---- create user
-    user = User(
-        email=email,
-        username=payload.username.strip(),
-        password_hash=hash_password(password),
-        is_active=True,
-        is_verified=False,
-    )
+        db.add(new_user)
+        db.commit()
+        db.refresh(new_user)
 
-    db.add(user)
-    db.commit()
-    db.refresh(user)
+        token = create_access_token(
+            data={"sub": str(new_user.id)}
+        )
 
-    return {
-        "status": "created",
-        "user": user.to_dict(),
-    }
+        return {
+            "message": "User created successfully",
+            "access_token": token,
+            "token_type": "bearer",
+            "user_id": new_user.id,
+        }
 
+    except Exception as e:
+        db.rollback()
+        logger.exception("Signup failed")
+        raise HTTPException(
+            status_code=500,
+            detail="Internal authentication error",
+        )
 
-# ==========================================================
+
+# =========================================================
 # LOGIN
-# ==========================================================
+# =========================================================
 
 @router.post("/login")
-def login(payload: LoginRequest, db: Session = Depends(get_db)):
-    email = payload.email.lower().strip()
-
-    user = get_user_by_email(db, email)
+def login(
+    form_data: OAuth2PasswordRequestForm = Depends(),
+    db: Session = Depends(get_db),
+):
+    """
+    OAuth2 compatible login endpoint.
+    """
+
+    user = db.query(User).filter(
+        User.username == form_data.username
+    ).first()
 
-    # generic response (prevents enumeration)
     if not user:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="Invalid credentials",
         )
 
-    # verify password safely
-    if not verify_password(payload.password, user.password_hash):
+    if not verify_password(form_data.password, user.password_hash):
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="Invalid credentials",
         )
 
-    if not user.is_active:
-        raise HTTPException(
-            status_code=status.HTTP_403_FORBIDDEN,
-            detail="Account disabled",
-        )
-
     token = create_access_token(
-        data={
-            "sub": str(user.id),
-            "email": user.email,
-        },
+        data={"sub": str(user.id)},
         expires_delta=timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES),
     )
 
     return {
         "access_token": token,
         "token_type": "bearer",
-        "user": user.to_dict(),
+        "user_id": user.id,
     }
 
 
-# ==========================================================
-# ME (TOKEN VALIDATION ENTRYPOINT)
-# ==========================================================
-
-from fastapi import Header
-from security import decode_token
-
+# =========================================================
+# GET CURRENT USER (DEBUG / INTERNAL USE)
+# =========================================================
 
 @router.get("/me")
-def me(authorization: str = Header(None), db: Session = Depends(get_db)):
-    if not authorization or not authorization.startswith("Bearer "):
-        raise HTTPException(
-            status_code=401,
-            detail="Missing token",
-        )
-
-    token = authorization.split(" ")[1]
-
-    payload = decode_token(token)
-    if not payload:
-        raise HTTPException(
-            status_code=401,
-            detail="Invalid token",
-        )
-
-    user_id = payload.get("sub")
-    user = db.query(User).filter(User.id == user_id).first()
-
-    if not user:
-        raise HTTPException(
-            status_code=404,
-            detail="User not found",
-        )
-
-    return user.to_dict()
-
-
-# ==========================================================
-# HEALTH CHECK (AUTH MODULE)
-# ==========================================================
-
-@router.get("/health")
-def auth_health():
-    return {
-        "status": "auth_online",
-        "module": "Basyx Auth V10.1",
-    }
+def me(
+    db: Session = Depends(get_db),
+    token_data=Depends(lambda: None),  # placeholder if you wire get_current_user later
+):
+    """
+    Optional endpoint (safe stub).
+    Extend with get_current_user from security.py if needed.
+    """
+    return {"status": "auth module active"}