85 lines
2.5 KiB
Python
85 lines
2.5 KiB
Python
from fastapi import APIRouter, Depends, HTTPException, Request, status
|
|
from sqlalchemy import func, select
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.core.database.session import get_session
|
|
from app.models import User
|
|
from app.schemas.auth_sch import LoginIn
|
|
from app.utils.business_logger import log_business_event
|
|
from app.utils.hashing import verify_password
|
|
from app.utils.token_manager import create_access_token
|
|
|
|
|
|
router = APIRouter(prefix="/v1/auth", tags=["Auth"])
|
|
|
|
|
|
@router.post("/login", status_code=status.HTTP_200_OK)
|
|
async def login(
|
|
data: LoginIn,
|
|
request: Request,
|
|
session: AsyncSession = Depends(get_session),
|
|
):
|
|
email = data.email.strip().lower()
|
|
trace_id = getattr(request.state, "traceId", None)
|
|
result = await session.execute(select(User).where(func.lower(User.email) == email))
|
|
user = result.scalar_one_or_none()
|
|
|
|
if user is None:
|
|
log_business_event(
|
|
"auth_login_failed",
|
|
trace_id=trace_id,
|
|
email=email,
|
|
reason="user_not_found",
|
|
)
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail={"message": "Invalid email or password"},
|
|
)
|
|
|
|
if not verify_password(data.password, user.hashed_password):
|
|
log_business_event(
|
|
"auth_login_failed",
|
|
trace_id=trace_id,
|
|
email=email,
|
|
reason="invalid_password",
|
|
)
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail={"message": "Invalid email or password"},
|
|
)
|
|
|
|
if not user.is_active:
|
|
log_business_event(
|
|
"auth_login_blocked",
|
|
trace_id=trace_id,
|
|
user_id=str(user.id),
|
|
email=user.email,
|
|
reason="user_inactive",
|
|
)
|
|
raise HTTPException(
|
|
status_code=status.HTTP_423_LOCKED,
|
|
detail={"message": "User account is deactivated"},
|
|
)
|
|
|
|
token, expires_in = create_access_token(sub=str(user.id), role=user.role.value)
|
|
log_business_event(
|
|
"auth_login_succeeded",
|
|
trace_id=trace_id,
|
|
user_id=str(user.id),
|
|
email=user.email,
|
|
role=user.role.value,
|
|
)
|
|
|
|
return {
|
|
"accessToken": token,
|
|
"expiresIn": expires_in,
|
|
"user": {
|
|
"id": str(user.id),
|
|
"email": user.email,
|
|
"fullName": user.full_name,
|
|
"role": user.role.value,
|
|
"isActive": user.is_active,
|
|
"createdAt": user.created_at.isoformat(),
|
|
},
|
|
}
|