chore(home): mirror from kalinamall (9883e6a) with papatramp URLs

backend/app/api/v1/auth.py

@@ -0,0 +1,90 @@
+from fastapi import APIRouter, Depends, HTTPException, Request
+from fastapi.responses import JSONResponse, Response
+from pydantic import BaseModel
+from sqlalchemy import func, select
+from sqlalchemy.orm import Session
+
+from app.auth.jwt_auth import CurrentUser, create_access_token, get_current_user
+from app.auth.stream_cookie import clear_stream_auth_cookie, set_stream_auth_cookie
+from app.config import get_settings
+from app.database import get_db
+from app.services.login_rate_limit import (
+    ensure_login_allowed,
+    record_login_failure,
+    record_login_success,
+)
+from app.services.user_auth import authenticate_user
+
+router = APIRouter(prefix="/auth", tags=["auth"])
+
+
+class LoginRequest(BaseModel):
+    username: str
+    password: str
+
+
+class TokenResponse(BaseModel):
+    access_token: str
+    token_type: str = "bearer"
+    username: str
+    role: str
+
+
+class MeResponse(BaseModel):
+    username: str
+    role: str
+
+
+@router.post("/login", response_model=TokenResponse)
+def login(body: LoginRequest, request: Request, db: Session = Depends(get_db)) -> JSONResponse:
+    settings = get_settings()
+    if not settings.sac_admin_password and not _has_any_user(db):
+        raise HTTPException(
+            status_code=503,
+            detail="SAC UI users are not configured (run alembic upgrade and set SAC_ADMIN_PASSWORD for bootstrap)",
+        )
+
+    ip_address = ensure_login_allowed(db, request)
+
+    user = authenticate_user(db, body.username, body.password)
+    if user is None:
+        record_login_failure(db, ip_address=ip_address, username=body.username)
+        db.commit()
+        raise HTTPException(status_code=401, detail="Invalid username or password")
+
+    record_login_success(db, ip_address=ip_address, username=user.username)
+    db.commit()
+
+    token = create_access_token(user.username, user.role)
+    payload = TokenResponse(
+        access_token=token,
+        username=user.username,
+        role=user.role,
+    )
+    response = JSONResponse(content=payload.model_dump())
+    set_stream_auth_cookie(response, token, settings)
+    return response
+
+
+@router.post("/logout", status_code=204)
+def logout() -> Response:
+    settings = get_settings()
+    response = Response(status_code=204)
+    clear_stream_auth_cookie(response, settings)
+    return response
+
+
+@router.get("/me", response_model=MeResponse)
+def me(current_user: CurrentUser = Depends(get_current_user)) -> MeResponse:
+    return MeResponse(username=current_user.username, role=current_user.role)
+
+
+def _has_any_user(db: Session) -> bool:
+    from app.models.user import User
+
+    try:
+        count = db.scalar(select(func.count()).select_from(User)) or 0
+        return count > 0
+    except Exception:
+        db.rollback()
+        return False