Update auth/routes.py

auth/routes.py

@@ -1,16 +1,15 @@
 from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.orm import Session
+from sqlalchemy.exc import IntegrityError
 from datetime import datetime
 
 from auth.database import get_db
 from auth.models import User
-
 from auth.schemas import (
     SignupSchema,
     LoginSchema,
     TokenSchema,
 )
-
 from auth.security import (
     hash_password,
     verify_password,
@@ -18,46 +17,76 @@ from auth.security import (
     decode_token,
 )
 
-router = APIRouter(prefix="/api/auth", tags=["Authentication"])
-
-
-# =========================================================
-# SAFE USER SERIALIZER (avoids leaking password_hash)
-# =========================================================
-def serialize_user(user: User) -> dict:
-    return {
-        "id": str(user.id),
-        "email": user.email,
-        "username": user.username,
-        "created_at": user.created_at.isoformat()
-        if user.created_at else None,
-    }
+router = APIRouter(
+    prefix="/api/auth",
+    tags=["Authentication"],
+)
 
 
 # =========================================================
 # SIGNUP
 # =========================================================
-@router.post("/signup")
-def signup(data: SignupSchema, db: Session = Depends(get_db)):
+
+@router.post("/signup", status_code=201)
+def signup(
+    data: SignupSchema,
+    db: Session = Depends(get_db),
+):
 
     try:
-        # normalize email (prevents duplicate edge cases)
-        email = data.email.lower().strip()
 
-        existing = db.query(User).filter(User.email == email).first()
+        # =================================================
+        # NORMALIZATION
+        # =================================================
 
-        if existing:
+        email = data.email.strip().lower()
+        username = data.username.strip()
+
+        # =================================================
+        # EXISTING EMAIL CHECK
+        # =================================================
+
+        existing_email = (
+            db.query(User)
+            .filter(User.email == email)
+            .first()
+        )
+
+        if existing_email:
             raise HTTPException(
-                status_code=status.HTTP_400_BAD_REQUEST,
+                status_code=status.HTTP_409_CONFLICT,
                 detail="Email already registered",
             )
 
-        # IMPORTANT: enforce bcrypt-safe hashing
+        # =================================================
+        # EXISTING USERNAME CHECK
+        # =================================================
+
+        existing_username = (
+            db.query(User)
+            .filter(User.username == username)
+            .first()
+        )
+
+        if existing_username:
+            raise HTTPException(
+                status_code=status.HTTP_409_CONFLICT,
+                detail="Username already taken",
+            )
+
+        # =================================================
+        # HASH PASSWORD
+        # =================================================
+
         password_hash = hash_password(data.password)
 
+        # =================================================
+        # CREATE USER
+        # =================================================
+
         user = User(
             email=email,
-            username=data.username,
+            username=username,
             password_hash=password_hash,
             created_at=datetime.utcnow(),
         )
@@ -66,18 +95,60 @@ def signup(data: SignupSchema, db: Session = Depends(get_db)):
         db.commit()
         db.refresh(user)
 
-        token = create_access_token({"sub": str(user.id)})
+        # =================================================
+        # CREATE JWT
+        # =================================================
+
+        token = create_access_token(
+            {
+                "sub": str(user.id),
+                "email": user.email,
+            }
+        )
 
         return {
             "status": "success",
-            "user": serialize_user(user),
+            "message": "Account created successfully",
             "token": token,
+            "user": {
+                "id": str(user.id),
+                "email": user.email,
+                "username": user.username,
+                "created_at": (
+                    user.created_at.isoformat()
+                    if user.created_at
+                    else None
+                ),
+            },
         }
 
     except HTTPException:
         raise
+
+    except IntegrityError as e:
+
+        db.rollback()
+
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="User already exists",
+        )
+
+    except ValueError as e:
+
+        db.rollback()
+
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=str(e),
+        )
+
     except Exception as e:
+
         db.rollback()
+
+        print("SIGNUP ERROR:", str(e))
+
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
             detail=f"Signup failed: {str(e)}",
@@ -87,38 +158,70 @@ def signup(data: SignupSchema, db: Session = Depends(get_db)):
 # =========================================================
 # LOGIN
 # =========================================================
+
 @router.post("/login")
-def login(data: LoginSchema, db: Session = Depends(get_db)):
+def login(
+    data: LoginSchema,
+    db: Session = Depends(get_db),
+):
 
     try:
-        email = data.email.lower().strip()
 
-        user = db.query(User).filter(User.email == email).first()
+        email = data.email.strip().lower()
+
+        user = (
+            db.query(User)
+            .filter(User.email == email)
+            .first()
+        )
 
         if not user:
+
             raise HTTPException(
                 status_code=status.HTTP_401_UNAUTHORIZED,
-                detail="Invalid credentials",
+                detail="Invalid email or password",
             )
 
-        # bcrypt-safe verification
-        if not verify_password(data.password, user.password_hash):
+        if not verify_password(
+            data.password,
+            user.password_hash,
+        ):
+
             raise HTTPException(
                 status_code=status.HTTP_401_UNAUTHORIZED,
-                detail="Invalid credentials",
+                detail="Invalid email or password",
             )
 
-        token = create_access_token({"sub": str(user.id)})
+        token = create_access_token(
+            {
+                "sub": str(user.id),
+                "email": user.email,
+            }
+        )
 
         return {
             "status": "success",
-            "user": serialize_user(user),
+            "message": "Login successful",
             "token": token,
+            "user": {
+                "id": str(user.id),
+                "email": user.email,
+                "username": user.username,
+                "created_at": (
+                    user.created_at.isoformat()
+                    if user.created_at
+                    else None
+                ),
+            },
         }
 
     except HTTPException:
         raise
+
     except Exception as e:
+
+        print("LOGIN ERROR:", str(e))
+
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
             detail=f"Login failed: {str(e)}",
@@ -128,13 +231,18 @@ def login(data: LoginSchema, db: Session = Depends(get_db)):
 # =========================================================
 # VERIFY TOKEN
 # =========================================================
+
 @router.post("/verify")
-def verify_token(data: TokenSchema):
+def verify_token(
+    data: TokenSchema,
+):
 
     try:
+
         payload = decode_token(data.token)
 
         if not payload:
+
             raise HTTPException(
                 status_code=status.HTTP_401_UNAUTHORIZED,
                 detail="Invalid token",
@@ -147,38 +255,59 @@ def verify_token(data: TokenSchema):
 
     except HTTPException:
         raise
-    except Exception:
+
+    except Exception as e:
+
+        print("VERIFY ERROR:", str(e))
+
         raise HTTPException(
-            status_code=status.HTTP_401_UNAUTHORIZED,
-            detail="Token verification failed",
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Token verification failed: {str(e)}",
         )
 
 
 # =========================================================
 # REFRESH TOKEN
 # =========================================================
+
 @router.post("/refresh")
-def refresh_token(data: TokenSchema, db: Session = Depends(get_db)):
+def refresh_token(
+    data: TokenSchema,
+    db: Session = Depends(get_db),
+):
 
     try:
+
         payload = decode_token(data.token)
 
         user_id = payload.get("sub")
+
         if not user_id:
+
             raise HTTPException(
                 status_code=status.HTTP_401_UNAUTHORIZED,
                 detail="Invalid token payload",
             )
 
-        user = db.query(User).filter(User.id == user_id).first()
+        user = (
+            db.query(User)
+            .filter(User.id == user_id)
+            .first()
+        )
 
         if not user:
+
             raise HTTPException(
                 status_code=status.HTTP_404_NOT_FOUND,
                 detail="User not found",
             )
 
-        new_token = create_access_token({"sub": str(user.id)})
+        new_token = create_access_token(
+            {
+                "sub": str(user.id),
+                "email": user.email,
+            }
+        )
 
         return {
             "status": "success",
@@ -187,19 +316,25 @@ def refresh_token(data: TokenSchema, db: Session = Depends(get_db)):
 
     except HTTPException:
         raise
-    except Exception:
+
+    except Exception as e:
+
+        print("REFRESH ERROR:", str(e))
+
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-            detail="Token refresh failed",
+            detail=f"Refresh failed: {str(e)}",
         )
 
 
 # =========================================================
-# LOGOUT (JWT = CLIENT-SIDE INVALIDATION MODEL)
+# LOGOUT
 # =========================================================
+
 @router.post("/logout")
 def logout():
+
     return {
         "status": "success",
-        "message": "Token should be discarded client-side",
+        "message": "Logout successful",
     }