Upload app.py

app.py

@@ -244,6 +244,16 @@ def init_db():
                 FOREIGN KEY(user_id) REFERENCES users(id)
             )
         """)
+        db.execute("""
+            CREATE TABLE IF NOT EXISTS email_verifications (
+                token TEXT PRIMARY KEY,
+                user_id TEXT NOT NULL,
+                created_at INTEGER NOT NULL,
+                expires_at INTEGER NOT NULL,
+                used INTEGER DEFAULT 0,
+                FOREIGN KEY(user_id) REFERENCES users(id)
+            )
+        """)
         db.execute("""
             CREATE TABLE IF NOT EXISTS projects (
                 id TEXT PRIMARY KEY,
@@ -350,6 +360,7 @@ def init_db():
         db.execute("ALTER TABLE users ADD COLUMN id_card TEXT") if not _column_exists(db,'users','id_card') else None
         db.execute("ALTER TABLE users ADD COLUMN id_status TEXT DEFAULT 'none'") if not _column_exists(db,'users','id_status') else None
         db.execute("ALTER TABLE users ADD COLUMN active INTEGER DEFAULT 1") if not _column_exists(db,'users','active') else None
+        db.execute("ALTER TABLE users ADD COLUMN email_verified INTEGER DEFAULT 0") if not _column_exists(db,'users','email_verified') else None
         db.execute("CREATE INDEX IF NOT EXISTS idx_interests_project ON interests(project_id)")
         db.execute("CREATE INDEX IF NOT EXISTS idx_files_project ON project_files(project_id)")
         db.execute("CREATE INDEX IF NOT EXISTS idx_appt_project ON appointments(project_id)")
@@ -380,6 +391,25 @@ def create_session(db, user_id: str) -> str:
     return token
 
 
+def send_verification_email(db, background_tasks: BackgroundTasks, user_id: str, name: str, email: str):
+    token = secrets.token_urlsafe(32)
+    now = int(time.time())
+    db.execute(
+        "INSERT INTO email_verifications (token,user_id,created_at,expires_at) VALUES (?,?,?,?)",
+        (token, user_id, now, now + 86400),  # صالح 24 ساعة
+    )
+    link = f"{SITE_URL}/verify-email.html?token={token}"
+    html = email_html(
+        "أكّد إيميلك",
+        f"أهلاً {name}،",
+        ["شكرًا إنك عملت حساب على نيّة. خطوة واحدة باقية بس عشان تفعّل حسابك.",
+         "دوس على الزرار تحت عشان تأكّد إيميلك وتدخل حسابك على طول. الرابط صالح لمدة 24 ساعة.",
+         "لو ملطلبتش تسجيل حساب على نيّة، تجاهل الرسالة دي ببساطة."],
+        "تأكيد الإيميل والدخول", link,
+    )
+    background_tasks.add_task(send_email, email, "أكّد إيميلك — نيّة", html)
+
+
 def current_user(authorization: Optional[str]) -> dict:
     if not authorization or not authorization.startswith("Bearer "):
         raise HTTPException(401, "لازم تسجل دخول")
@@ -436,6 +466,14 @@ class ResetPasswordIn(BaseModel):
     new_password: str = Field(min_length=6, max_length=100)
 
 
+class VerifyEmailIn(BaseModel):
+    token: str
+
+
+class ResendVerifyIn(BaseModel):
+    email: EmailStr
+
+
 class ProjectIn(BaseModel):
     name: str = Field(min_length=1, max_length=200)
     sector: str
@@ -503,7 +541,7 @@ def row_to_public_user(row: sqlite3.Row) -> dict:
 
 
 @app.post("/api/auth/signup")
-def signup(body: SignupIn, request: Request):
+def signup(body: SignupIn, request: Request, background_tasks: BackgroundTasks):
     rate_limit(request, "signup", max_calls=5, window_sec=3600)
     if body.role not in ("owner", "investor", "both", "broker"):
         raise HTTPException(400, "نوع الحساب لازم يكون owner أو investor أو both")
@@ -515,13 +553,13 @@ def signup(body: SignupIn, request: Request):
             raise HTTPException(409, "الإيميل ده مسجل قبل كده")
         db.execute(
             "INSERT INTO users (id,name,email,phone,password_hash,salt,role,created_at,bio,owner_field,"
-            "investor_budget_min,investor_budget_max,investor_sectors) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)",
+            "investor_budget_min,investor_budget_max,investor_sectors,email_verified) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,0)",
             (uid, body.name, body.email, body.phone, h, salt, body.role, int(time.time()), body.bio,
              body.owner_field, body.investor_budget_min, body.investor_budget_max, body.investor_sectors),
         )
-        token = create_session(db, uid)
-        row = db.execute("SELECT * FROM users WHERE id=?", (uid,)).fetchone()
-    return {"token": token, "user": row_to_public_user(row)}
+        send_verification_email(db, background_tasks, uid, body.name, body.email)
+    return {"needsVerification": True, "email": body.email,
+            "message": "اتبعت رسالة تأكيد لإيميلك. افتح الرابط اللي فيها عشان تفعّل حسابك وتدخل على طول."}
 
 
 @app.post("/api/auth/login")
@@ -533,10 +571,39 @@ def login(body: LoginIn, request: Request):
             raise HTTPException(401, "الإيميل أو الباسورد غلط")
         if not row["active"]:
             raise HTTPException(403, "الحساب ده معطّل. لو ده غلط، تواصل معانا")
+        if "email_verified" in row.keys() and not row["email_verified"]:
+            raise HTTPException(403, "لازم تأكّد إيميلك الأول. اتبعتلك رسالة فيها رابط التفعيل — لو مش لاقيها استخدم زرار إعادة الإرسال")
         token = create_session(db, row["id"])
     return {"token": token, "user": row_to_public_user(row)}
 
 
+@app.post("/api/auth/verify-email")
+def verify_email(body: VerifyEmailIn):
+    with get_db() as db:
+        row = db.execute(
+            "SELECT * FROM email_verifications WHERE token=? AND used=0", (body.token,)
+        ).fetchone()
+        if not row or row["expires_at"] < time.time():
+            raise HTTPException(400, "رابط التأكيد غير صالح أو منتهي — اطلب رابط جديد")
+        db.execute("UPDATE email_verifications SET used=1 WHERE token=?", (body.token,))
+        db.execute("UPDATE users SET email_verified=1 WHERE id=?", (row["user_id"],))
+        user = db.execute("SELECT * FROM users WHERE id=?", (row["user_id"],)).fetchone()
+        if not user["active"]:
+            raise HTTPException(403, "الحساب ده معطّل. لو ده غلط، تواصل معانا")
+        token = create_session(db, user["id"])
+    return {"token": token, "user": row_to_public_user(user)}
+
+
+@app.post("/api/auth/resend-verification")
+def resend_verification(body: ResendVerifyIn, request: Request, background_tasks: BackgroundTasks):
+    rate_limit(request, "resend_verification", max_calls=4, window_sec=900)
+    with get_db() as db:
+        user = db.execute("SELECT id,name,email_verified FROM users WHERE email=?", (body.email,)).fetchone()
+        if user and not user["email_verified"]:
+            send_verification_email(db, background_tasks, user["id"], user["name"], body.email)
+    return {"ok": True, "message": "لو الإيميل مسجل ومش مفعّل، هيوصلك رابط تأكيد جديد"}
+
+
 @app.post("/api/auth/forgot-password")
 def forgot_password(body: ForgotPasswordIn, request: Request, background_tasks: BackgroundTasks):
     rate_limit(request, "forgot_password", max_calls=4, window_sec=900)