add auth system and split backend into two-image CI/CD build

Backend: - password hashing via hashlib.scrypt - stateless HMAC-SHA256 tokens (7-day expiry) - POST /api/auth/login, /api/auth/register (admin), /api/auth/reset-password - admin user created from NAT20_ADMIN_USERNAME/PASSWORD on first startup - users table, campaign_shares table, created_by on campaigns - require_user dependency on all routes except auth - campaign sharing: GET/POST/DELETE /api/campaigns/{id}/shares Frontend: - AuthContext: user/token state, login/logout, global fetch Auth header - Login page, Users page (admin user management) - route protection, sidebar user info/sign out Docker/CI: - split backend/Dockerfile into thin app-only image - backend/Dockerfile.deps builds the heavy WhisperX/PyTorch base - CI builds deps only when requirements.txt changes - docker compose pull now fetches ~100KB app layer instead of 3.5GB
2026-07-30 12:05:56 +12:00
parent 990276366d
commit 5081ba00f6
16 changed files with 800 additions and 114 deletions
--- a/backend/app/routers/auth.py
+++ b/backend/app/routers/auth.py
@@ -0,0 +1,75 @@
+from fastapi import APIRouter, Depends, HTTPException, Header
+from typing import Optional
+
+from .. import database as db
+from ..auth import authenticate, get_user_from_token, hash_password, ensure_admin_exists
+
+router = APIRouter(prefix="/api/auth", tags=["auth"])
+
+
+def require_user(authorization: Optional[str] = Header(None)):
+    if not authorization or not authorization.startswith("Bearer "):
+        raise HTTPException(401, "Not authenticated")
+    user = get_user_from_token(authorization[7:])
+    if not user:
+        raise HTTPException(401, "Invalid or expired token")
+    return user
+
+
+def require_admin(user: dict = Depends(require_user)):
+    if not user["is_admin"]:
+        raise HTTPException(403, "Admin access required")
+    return user
+
+
+@router.post("/login")
+def login(body: dict):
+    username = body.get("username", "").strip()
+    password = body.get("password", "")
+    if not username or not password:
+        raise HTTPException(400, "Username and password are required")
+    result = authenticate(username, password)
+    if not result:
+        raise HTTPException(401, "Invalid username or password")
+    return result
+
+
+@router.post("/register")
+def register(body: dict, admin: dict = Depends(require_admin)):
+    username = body.get("username", "").strip()
+    password = body.get("password", "")
+    if not username or not password:
+        raise HTTPException(400, "Username and password are required")
+    if len(password) < 4:
+        raise HTTPException(400, "Password must be at least 4 characters")
+    existing = db.get_user_by_username(username)
+    if existing:
+        raise HTTPException(409, "Username already exists")
+    user = db.create_user(username, hash_password(password))
+    return {"id": user["id"], "username": user["username"]}
+
+
+@router.post("/reset-password")
+def reset_password(body: dict, admin: dict = Depends(require_admin)):
+    user_id = body.get("user_id", "").strip()
+    new_password = body.get("new_password", "")
+    if not user_id or not new_password:
+        raise HTTPException(400, "user_id and new_password are required")
+    if len(new_password) < 4:
+        raise HTTPException(400, "Password must be at least 4 characters")
+    user = db.get_user(user_id)
+    if not user:
+        raise HTTPException(404, "User not found")
+    db.update_user_password(user_id, hash_password(new_password))
+    return {"ok": True}
+
+
+@router.get("/me")
+def me(user: dict = Depends(require_user)):
+    user["is_admin"] = bool(user["is_admin"])
+    return user
+
+
+@router.get("/users")
+def list_users(admin: dict = Depends(require_admin)):
+    return db.list_users()
--- a/backend/app/routers/campaigns.py
+++ b/backend/app/routers/campaigns.py
@@ -1,36 +1,36 @@
-from fastapi import APIRouter, HTTPException
+from fastapi import APIRouter, Depends, HTTPException

 from .. import database as db
 from ..config import CAMPAIGN_SETTINGS, merge_campaign_settings_with_env
+from .auth import require_user, require_admin

 router = APIRouter(prefix="/api/campaigns", tags=["campaigns"])


@router.get("")
-def list_campaigns():
-    return db.list_campaigns()
+def list_campaigns(user: dict = Depends(require_user)):
+    return db.get_user_campaigns(user["id"])


@router.post("")
-def create_campaign(body: dict):
+def create_campaign(body: dict, user: dict = Depends(require_user)):
    name = body.get("name", "").strip()
    if not name:
        raise HTTPException(400, "Name is required")
    desc = body.get("description", "").strip()
-    return db.create_campaign(name, desc)
+    return db.create_campaign(name, desc, user["id"])


@router.get("/{campaign_id}")
-def get_campaign(campaign_id: str):
-    campaign = db.get_campaign(campaign_id)
-    if not campaign:
+def get_campaign(campaign_id: str, user: dict = Depends(require_user)):
+    if not db.can_access_campaign(user["id"], campaign_id):
        raise HTTPException(404, "Campaign not found")
-    return campaign
+    return db.get_campaign(campaign_id)


@router.put("/{campaign_id}")
-def update_campaign(campaign_id: str, body: dict):
-    if not db.get_campaign(campaign_id):
+def update_campaign(campaign_id: str, body: dict, user: dict = Depends(require_user)):
+    if not db.can_access_campaign(user["id"], campaign_id):
        raise HTTPException(404, "Campaign not found")
    updated = db.update_campaign(
        campaign_id,
@@ -41,26 +41,80 @@ def update_campaign(campaign_id: str, body: dict):


@router.delete("/{campaign_id}")
-def delete_campaign(campaign_id: str):
-    if not db.get_campaign(campaign_id):
+def delete_campaign(campaign_id: str, user: dict = Depends(require_user)):
+    campaign = db.get_campaign(campaign_id)
+    if not campaign:
        raise HTTPException(404, "Campaign not found")
+    if campaign.get("created_by") != user["id"] and not user.get("is_admin"):
+        raise HTTPException(403, "Only the campaign owner can delete it")
    db.delete_campaign(campaign_id)
    return {"ok": True}


+# ── Campaign settings ────────────────────────────────────────────────────
+
@router.get("/{campaign_id}/settings")
-def get_campaign_settings(campaign_id: str):
-    if not db.get_campaign(campaign_id):
+def get_campaign_settings(campaign_id: str, user: dict = Depends(require_user)):
+    if not db.can_access_campaign(user["id"], campaign_id):
        raise HTTPException(404, "Campaign not found")
    raw = db.get_campaign_settings(campaign_id)
    return merge_campaign_settings_with_env(raw)


@router.post("/{campaign_id}/settings")
-def update_campaign_settings(campaign_id: str, body: dict):
-    if not db.get_campaign(campaign_id):
+def update_campaign_settings(campaign_id: str, body: dict, user: dict = Depends(require_user)):
+    if not db.can_access_campaign(user["id"], campaign_id):
        raise HTTPException(404, "Campaign not found")
    clean = {k: str(v) for k, v in body.items() if k in CAMPAIGN_SETTINGS}
    db.update_campaign_settings(campaign_id, clean)
    raw = db.get_campaign_settings(campaign_id)
    return merge_campaign_settings_with_env(raw)
+
+
+# ── Sharing ───────────────────────────────────────────────────────────────
+
+@router.get("/{campaign_id}/shares")
+def list_shares(campaign_id: str, user: dict = Depends(require_user)):
+    campaign = db.get_campaign(campaign_id)
+    if not campaign:
+        raise HTTPException(404, "Campaign not found")
+    if campaign.get("created_by") != user["id"] and not user.get("is_admin"):
+        raise HTTPException(403, "Only the campaign owner can manage sharing")
+    return db.get_campaign_shares(campaign_id)
+
+
+@router.post("/{campaign_id}/shares")
+def add_share(campaign_id: str, body: dict, user: dict = Depends(require_user)):
+    campaign = db.get_campaign(campaign_id)
+    if not campaign:
+        raise HTTPException(404, "Campaign not found")
+    if campaign.get("created_by") != user["id"] and not user.get("is_admin"):
+        raise HTTPException(403, "Only the campaign owner can manage sharing")
+    target_username = body.get("username", "").strip()
+    if not target_username:
+        raise HTTPException(400, "username is required")
+    target = db.get_user_by_username(target_username)
+    if not target:
+        raise HTTPException(404, "User not found")
+    if target["id"] == campaign["created_by"]:
+        raise HTTPException(400, "Cannot share campaign with its owner")
+    role = body.get("role", "editor")
+    db.share_campaign(campaign_id, target["id"], role)
+    return {"ok": True}
+
+
+@router.delete("/{campaign_id}/shares")
+def remove_share(campaign_id: str, body: dict, user: dict = Depends(require_user)):
+    campaign = db.get_campaign(campaign_id)
+    if not campaign:
+        raise HTTPException(404, "Campaign not found")
+    if campaign.get("created_by") != user["id"] and not user.get("is_admin"):
+        raise HTTPException(403, "Only the campaign owner can manage sharing")
+    target_username = body.get("username", "").strip()
+    if not target_username:
+        raise HTTPException(400, "username is required")
+    target = db.get_user_by_username(target_username)
+    if not target:
+        raise HTTPException(404, "User not found")
+    db.unshare_campaign(campaign_id, target["id"])
+    return {"ok": True}