324 lines
9.7 KiB
Python
324 lines
9.7 KiB
Python
import random
|
|
import secrets
|
|
import string
|
|
from datetime import datetime, timedelta, timezone
|
|
|
|
from fastapi import APIRouter, Depends, HTTPException, status
|
|
from google.oauth2 import id_token
|
|
from google.auth.transport import requests as google_requests
|
|
from sqlalchemy.orm import Session, selectinload
|
|
|
|
from app.config import settings
|
|
from app.database import get_db
|
|
from app.dependencies import get_current_user
|
|
from app.models.email_verification_token import EmailVerificationToken
|
|
from app.models.user import User
|
|
from app.models.user_profile import UserProfile
|
|
from app.schemas.auth import (
|
|
ForgotPasswordRequest,
|
|
ResetPasswordRequest,
|
|
SendVerificationRequest,
|
|
VerifyEmailRequest,
|
|
)
|
|
from app.schemas.user import (
|
|
GoogleLoginRequest,
|
|
LoginRequest,
|
|
LoginResponse,
|
|
UserCreate,
|
|
UserDetailResponse,
|
|
UserResponse,
|
|
)
|
|
from app.security import create_access_token, hash_password, verify_password
|
|
from app.services.auth_service import forgot_password, reset_password
|
|
from app.services.email_service import send_verification_email
|
|
|
|
router = APIRouter(prefix="/auth", tags=["auth"])
|
|
|
|
|
|
def _generate_verification_token() -> str:
|
|
return secrets.token_urlsafe(48)
|
|
|
|
|
|
@router.post("/login", response_model=LoginResponse)
|
|
def login(data: LoginRequest, db: Session = Depends(get_db)):
|
|
user = db.query(User).options(selectinload(User.profile)).filter(
|
|
(User.email == data.login) | (User.username == data.login),
|
|
User.deleted_at.is_(None),
|
|
).first()
|
|
|
|
if not user or not verify_password(data.password, user.password):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail={"message": "Kredensial autentikasi tidak ada atau tidak valid."},
|
|
)
|
|
|
|
if user.email_verified_at is None:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail={"message": "Email belum diverifikasi. Silakan verifikasi email terlebih dahulu."},
|
|
)
|
|
|
|
access_token = create_access_token({"sub": user.id})
|
|
return LoginResponse(
|
|
access_token=access_token,
|
|
user=user,
|
|
)
|
|
|
|
|
|
@router.post("/register", response_model=UserResponse, status_code=status.HTTP_201_CREATED)
|
|
def register(data: UserCreate, db: Session = Depends(get_db)):
|
|
existing = db.query(User).filter(
|
|
(User.email == data.email) | (User.username == data.username)
|
|
).first()
|
|
if existing:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_409_CONFLICT,
|
|
detail={"message": "Email atau username sudah terdaftar."},
|
|
)
|
|
|
|
user = User(
|
|
email=data.email,
|
|
username=data.username,
|
|
password=hash_password(data.password),
|
|
status="INACTIVE",
|
|
)
|
|
db.add(user)
|
|
db.flush()
|
|
|
|
try:
|
|
profile_data = {
|
|
"user_id": user.id,
|
|
"full_name": data.full_name,
|
|
}
|
|
if data.phone is not None:
|
|
profile_data["phone"] = data.phone
|
|
if data.address is not None:
|
|
profile_data["address"] = data.address
|
|
if data.pob is not None:
|
|
profile_data["pob"] = data.pob
|
|
if data.dob is not None:
|
|
profile_data["dob"] = data.dob
|
|
profile = UserProfile(**profile_data)
|
|
db.add(profile)
|
|
|
|
raw_token = _generate_verification_token()
|
|
hashed_token = hash_password(raw_token)
|
|
verif_token = EmailVerificationToken(
|
|
user_id=user.id,
|
|
token=hashed_token,
|
|
expires_at=datetime.now(timezone.utc) + timedelta(hours=24),
|
|
)
|
|
db.add(verif_token)
|
|
db.commit()
|
|
except:
|
|
db.rollback()
|
|
raise
|
|
|
|
verify_url = f"{settings.FRONTEND_URL}/auth/verify-email?token={raw_token}"
|
|
try:
|
|
send_verification_email(user.email, verify_url)
|
|
except Exception:
|
|
pass
|
|
|
|
db.refresh(user)
|
|
return user
|
|
|
|
|
|
@router.post("/google-login", response_model=LoginResponse)
|
|
def google_login(data: GoogleLoginRequest, db: Session = Depends(get_db)):
|
|
try:
|
|
idinfo = id_token.verify_oauth2_token(
|
|
data.credential,
|
|
google_requests.Request(),
|
|
settings.GOOGLE_CLIENT_ID,
|
|
)
|
|
except Exception:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail={"message": "Kredensial Google tidak valid atau telah kedaluwarsa."},
|
|
)
|
|
|
|
email = idinfo.get("email")
|
|
name = idinfo.get("name", "")
|
|
|
|
if not email:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail={"message": "Tidak dapat mengambil email dari akun Google."},
|
|
)
|
|
|
|
user = db.query(User).options(selectinload(User.profile)).filter(
|
|
User.email == email,
|
|
User.deleted_at.is_(None),
|
|
).first()
|
|
|
|
if not user:
|
|
base_username = email.split("@")[0]
|
|
username = base_username
|
|
suffix = 1
|
|
while db.query(User).filter(User.username == username).first():
|
|
suffix += 1
|
|
username = f"{base_username}{suffix}"
|
|
|
|
random_password = "".join(random.choices(string.ascii_letters + string.digits, k=32))
|
|
|
|
user = User(
|
|
email=email,
|
|
username=username,
|
|
password=hash_password(random_password),
|
|
email_verified_at=datetime.now(timezone.utc),
|
|
status="ONBOARDING",
|
|
)
|
|
db.add(user)
|
|
db.flush()
|
|
|
|
profile = UserProfile(
|
|
user_id=user.id,
|
|
full_name=name,
|
|
)
|
|
db.add(profile)
|
|
db.commit()
|
|
db.refresh(user)
|
|
else:
|
|
if user.email_verified_at is None:
|
|
user.email_verified_at = datetime.now(timezone.utc)
|
|
if not user.profile:
|
|
profile = UserProfile(
|
|
user_id=user.id,
|
|
full_name=name,
|
|
)
|
|
db.add(profile)
|
|
elif user.profile.full_name != name:
|
|
user.profile.full_name = name
|
|
db.commit()
|
|
db.refresh(user)
|
|
|
|
access_token = create_access_token({"sub": user.id})
|
|
return LoginResponse(
|
|
access_token=access_token,
|
|
user=user,
|
|
)
|
|
|
|
|
|
@router.post("/verify-email")
|
|
def verify_email(data: VerifyEmailRequest, db: Session = Depends(get_db)):
|
|
now = datetime.now(timezone.utc)
|
|
|
|
tokens = db.query(EmailVerificationToken).filter(
|
|
EmailVerificationToken.used_at.is_(None),
|
|
).all()
|
|
|
|
matched = None
|
|
for t in tokens:
|
|
if verify_password(data.token, t.token):
|
|
matched = t
|
|
break
|
|
|
|
if not matched:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail={"message": "Token tidak valid atau sudah kedaluwarsa."},
|
|
)
|
|
|
|
if matched.expires_at.replace(tzinfo=timezone.utc) < now:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail={"message": "Token tidak valid atau sudah kedaluwarsa."},
|
|
)
|
|
|
|
matched.used_at = now
|
|
user = db.query(User).filter(User.id == matched.user_id).first()
|
|
if not user:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail={"message": "Token tidak valid atau sudah kedaluwarsa."},
|
|
)
|
|
|
|
user.email_verified_at = now
|
|
user.status = "ONBOARDING"
|
|
|
|
db.query(EmailVerificationToken).filter(
|
|
EmailVerificationToken.user_id == user.id,
|
|
EmailVerificationToken.used_at.is_(None),
|
|
).update({"used_at": now})
|
|
|
|
db.commit()
|
|
|
|
return {"message": "Email berhasil diverifikasi. Silakan masuk ke akun Anda."}
|
|
|
|
|
|
@router.post("/send-verification")
|
|
def send_verification(data: SendVerificationRequest, db: Session = Depends(get_db)):
|
|
user = db.query(User).filter(
|
|
User.email == data.email,
|
|
User.deleted_at.is_(None),
|
|
).first()
|
|
|
|
if not user:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_404_NOT_FOUND,
|
|
detail={"message": "Email tidak ditemukan."},
|
|
)
|
|
|
|
if user.email_verified_at is not None:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail={"message": "Email sudah diverifikasi."},
|
|
)
|
|
|
|
now = datetime.now(timezone.utc)
|
|
|
|
active_token = db.query(EmailVerificationToken).filter(
|
|
EmailVerificationToken.user_id == user.id,
|
|
EmailVerificationToken.used_at.is_(None),
|
|
EmailVerificationToken.expires_at > now,
|
|
).first()
|
|
|
|
if active_token:
|
|
return {"message": "Link verifikasi sudah dikirim ke email Anda dan masih aktif."}
|
|
|
|
db.query(EmailVerificationToken).filter(
|
|
EmailVerificationToken.user_id == user.id,
|
|
EmailVerificationToken.used_at.is_(None),
|
|
).update({"used_at": now})
|
|
|
|
raw_token = _generate_verification_token()
|
|
hashed_token = hash_password(raw_token)
|
|
|
|
verif_token = EmailVerificationToken(
|
|
user_id=user.id,
|
|
token=hashed_token,
|
|
expires_at=now + timedelta(hours=24),
|
|
)
|
|
db.add(verif_token)
|
|
db.commit()
|
|
|
|
verify_url = f"{settings.FRONTEND_URL}/auth/verify-email?token={raw_token}"
|
|
try:
|
|
send_verification_email(user.email, verify_url)
|
|
except Exception:
|
|
pass
|
|
|
|
return {"message": "Link verifikasi telah dikirim ke email Anda."}
|
|
|
|
|
|
@router.get("/me", response_model=UserDetailResponse)
|
|
def get_me(
|
|
current_user: User = Depends(get_current_user),
|
|
db: Session = Depends(get_db),
|
|
):
|
|
user = db.query(User).options(selectinload(User.profile)).filter(
|
|
User.id == current_user.id
|
|
).first()
|
|
return user
|
|
|
|
|
|
@router.post("/forgot-password")
|
|
def forgot_password_endpoint(data: ForgotPasswordRequest, db: Session = Depends(get_db)):
|
|
return forgot_password(db, data.email)
|
|
|
|
|
|
@router.post("/reset-password")
|
|
def reset_password_endpoint(data: ResetPasswordRequest, db: Session = Depends(get_db)):
|
|
return reset_password(db, data.token, data.password)
|