5081ba00f6
Some checks failed
Build and Push / build (push) Failing after 17s
Backend:
- password hashing via hashlib.scrypt
- stateless HMAC-SHA256 tokens (7-day expiry)
- POST /api/auth/login, /api/auth/register (admin), /api/auth/reset-password
- admin user created from NAT20_ADMIN_USERNAME/PASSWORD on first startup
- users table, campaign_shares table, created_by on campaigns
- require_user dependency on all routes except auth
- campaign sharing: GET/POST/DELETE /api/campaigns/{id}/shares
Frontend:
- AuthContext: user/token state, login/logout, global fetch Auth header
- Login page, Users page (admin user management)
- route protection, sidebar user info/sign out
Docker/CI:
- split backend/Dockerfile into thin app-only image
- backend/Dockerfile.deps builds the heavy WhisperX/PyTorch base
- CI builds deps only when requirements.txt changes
- docker compose pull now fetches ~100KB app layer instead of 3.5GB
76 lines
2.6 KiB
Python
76 lines
2.6 KiB
Python
from fastapi import APIRouter, Depends, HTTPException, Header
|
|
from typing import Optional
|
|
|
|
from .. import database as db
|
|
from ..auth import authenticate, get_user_from_token, hash_password, ensure_admin_exists
|
|
|
|
router = APIRouter(prefix="/api/auth", tags=["auth"])
|
|
|
|
|
|
def require_user(authorization: Optional[str] = Header(None)):
|
|
if not authorization or not authorization.startswith("Bearer "):
|
|
raise HTTPException(401, "Not authenticated")
|
|
user = get_user_from_token(authorization[7:])
|
|
if not user:
|
|
raise HTTPException(401, "Invalid or expired token")
|
|
return user
|
|
|
|
|
|
def require_admin(user: dict = Depends(require_user)):
|
|
if not user["is_admin"]:
|
|
raise HTTPException(403, "Admin access required")
|
|
return user
|
|
|
|
|
|
@router.post("/login")
|
|
def login(body: dict):
|
|
username = body.get("username", "").strip()
|
|
password = body.get("password", "")
|
|
if not username or not password:
|
|
raise HTTPException(400, "Username and password are required")
|
|
result = authenticate(username, password)
|
|
if not result:
|
|
raise HTTPException(401, "Invalid username or password")
|
|
return result
|
|
|
|
|
|
@router.post("/register")
|
|
def register(body: dict, admin: dict = Depends(require_admin)):
|
|
username = body.get("username", "").strip()
|
|
password = body.get("password", "")
|
|
if not username or not password:
|
|
raise HTTPException(400, "Username and password are required")
|
|
if len(password) < 4:
|
|
raise HTTPException(400, "Password must be at least 4 characters")
|
|
existing = db.get_user_by_username(username)
|
|
if existing:
|
|
raise HTTPException(409, "Username already exists")
|
|
user = db.create_user(username, hash_password(password))
|
|
return {"id": user["id"], "username": user["username"]}
|
|
|
|
|
|
@router.post("/reset-password")
|
|
def reset_password(body: dict, admin: dict = Depends(require_admin)):
|
|
user_id = body.get("user_id", "").strip()
|
|
new_password = body.get("new_password", "")
|
|
if not user_id or not new_password:
|
|
raise HTTPException(400, "user_id and new_password are required")
|
|
if len(new_password) < 4:
|
|
raise HTTPException(400, "Password must be at least 4 characters")
|
|
user = db.get_user(user_id)
|
|
if not user:
|
|
raise HTTPException(404, "User not found")
|
|
db.update_user_password(user_id, hash_password(new_password))
|
|
return {"ok": True}
|
|
|
|
|
|
@router.get("/me")
|
|
def me(user: dict = Depends(require_user)):
|
|
user["is_admin"] = bool(user["is_admin"])
|
|
return user
|
|
|
|
|
|
@router.get("/users")
|
|
def list_users(admin: dict = Depends(require_admin)):
|
|
return db.list_users()
|