Initial commit: VoIdeaAI - voice-first AI idea assistant

2026-05-13 12:51:42 +03:00
commit 688d043dad
421 changed files with 47915 additions and 0 deletions
@@ -0,0 +1,271 @@
+"""Auth API routes for VoIdea."""
+
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, Request, status
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.dependencies import get_current_user, get_db
+from app.core.limiter import limiter
+from app.core.security import (
+    create_access_token,
+    create_refresh_token,
+    verify_password,
+    get_password_hash,
+)
+from app.integrations.oauth.yandex import exchange_code, get_authorize_url, get_user_info
+from app.models.user import User
+from app.schemas.auth import (
+    ForgotPasswordRequest,
+    LoginRequest,
+    OAuthCallbackRequest,
+    OAuthUrlResponse,
+    RefreshRequest,
+    RegisterRequest,
+    ResetPasswordRequest,
+    TokenResponse,
+    TwoFactorLoginRequest,
+    TwoFactorLoginResponse,
+    TwoFactorSetupResponse,
+    TwoFactorVerifyRequest,
+)
+from app.schemas.user import ChangePasswordRequest
+from app.services.auth_service import AuthService
+from app.services.password_reset_service import reset_password, send_reset_email
+from app.services.two_factor_service import (
+    generate_qr_base64,
+    generate_totp_secret,
+    get_totp_uri,
+    get_user_secret,
+    is_2fa_enabled,
+    is_2fa_globally_enabled,
+    set_2fa_enabled,
+    set_user_secret,
+    verify_totp,
+)
+
+router = APIRouter()
+
+
+@router.post("/register", response_model=TokenResponse, status_code=status.HTTP_201_CREATED)
+@limiter.limit("5/minute")
+async def register(request: Request, body: RegisterRequest, db: AsyncSession = Depends(get_db)):
+    service = AuthService(db)
+    try:
+        return await service.register(
+            body.email, body.password, body.display_name,
+            accepted_terms=body.accepted_terms,
+        )
+    except ValueError as e:
+        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail=str(e))
+
+
+@router.post("/login")
+@limiter.limit("10/minute")
+async def login(request: Request, body: LoginRequest, db: AsyncSession = Depends(get_db)):
+    from sqlalchemy import select
+    result = await db.execute(select(User).where(User.email == body.email))
+    user = result.scalar_one_or_none()
+    if not user or not verify_password(body.password, user.password_hash):
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Неверный email или пароль")
+
+    globally_enabled = await is_2fa_globally_enabled(db)
+    if globally_enabled and is_2fa_enabled(user):
+        from datetime import timedelta
+        temp_token = create_access_token(
+            data={"sub": str(user.id), "purpose": "2fa"},
+            expires_delta=timedelta(minutes=5),
+        )
+        return {"temp_token": temp_token, "message": "Требуется 2FA код"}
+
+    service = AuthService(db)
+    return await service.create_token_response(user)
+
+
+@router.post("/2fa/verify-login", response_model=TwoFactorLoginResponse)
+@limiter.limit("10/minute")
+async def verify_2fa_login(
+    request: Request,
+    body: TwoFactorLoginRequest,
+    db: AsyncSession = Depends(get_db),
+):
+    from jose import jwt, JWTError
+    from app.core.config import get_settings
+    settings = get_settings()
+
+    try:
+        payload = jwt.decode(
+            body.temp_token, settings.jwt_secret_key,
+            algorithms=[settings.jwt_algorithm],
+        )
+    except JWTError:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid temp token")
+
+    if payload.get("purpose") != "2fa":
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid token purpose")
+
+    from sqlalchemy import select
+    result = await db.execute(select(User).where(User.id == payload.get("sub")))
+    user = result.scalar_one_or_none()
+    if not user:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="User not found")
+
+    secret = get_user_secret(user)
+    if not secret or not verify_totp(secret, body.totp_code):
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Неверный 2FA код")
+
+    service = AuthService(db)
+    return await service.create_token_response(user)
+
+
+@router.post("/2fa/setup", response_model=TwoFactorSetupResponse)
+async def setup_2fa(
+    user: Annotated[User, Depends(get_current_user)],
+    db: AsyncSession = Depends(get_db),
+):
+    if is_2fa_enabled(user):
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="2FA уже включена")
+
+    secret = generate_totp_secret()
+    set_user_secret(user, secret)
+    await db.commit()
+
+    uri = get_totp_uri(secret, user.email)
+    qr = generate_qr_base64(uri)
+
+    return TwoFactorSetupResponse(secret=secret, uri=uri, qr_base64=qr)
+
+
+@router.post("/2fa/verify")
+async def verify_2fa(
+    body: TwoFactorVerifyRequest,
+    user: Annotated[User, Depends(get_current_user)],
+    db: AsyncSession = Depends(get_db),
+):
+    secret = get_user_secret(user)
+    if not secret:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="2FA не настроена")
+
+    if not verify_totp(secret, body.token):
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Неверный код")
+
+    set_2fa_enabled(user, True)
+    await db.commit()
+    return {"message": "2FA успешно включена"}
+
+
+@router.post("/2fa/disable")
+async def disable_2fa(
+    body: TwoFactorVerifyRequest,
+    user: Annotated[User, Depends(get_current_user)],
+    db: AsyncSession = Depends(get_db),
+):
+    secret = get_user_secret(user)
+    if not secret or not verify_totp(secret, body.token):
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Неверный код")
+
+    set_2fa_enabled(user, False)
+    await db.commit()
+    return {"message": "2FA отключена"}
+
+
+@router.post("/refresh", response_model=TokenResponse)
+@limiter.limit("10/minute")
+async def refresh(request: Request, body: RefreshRequest, db: AsyncSession = Depends(get_db)):
+    service = AuthService(db)
+    try:
+        return await service.refresh(body.refresh_token)
+    except ValueError as e:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail=str(e))
+
+
+@router.get("/oauth/yandex", response_model=OAuthUrlResponse)
+@limiter.limit("10/minute")
+async def oauth_yandex_url(request: Request):
+    url = await get_authorize_url()
+    return OAuthUrlResponse(url=url, provider="yandex")
+
+
+@router.post("/oauth/yandex/callback", response_model=TokenResponse)
+@limiter.limit("10/minute")
+async def oauth_yandex_callback(
+    request: Request,
+    body: OAuthCallbackRequest,
+    db: AsyncSession = Depends(get_db),
+):
+    token_result = await exchange_code(body.code)
+    if not token_result:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Failed to exchange authorization code",
+        )
+
+    user_info = await get_user_info(token_result.access_token)
+    if not user_info:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Failed to get user info from Yandex",
+        )
+
+    service = AuthService(db)
+    try:
+        return await service.oauth_or_register_login(
+            email=user_info.email,
+            oauth_provider="yandex",
+            oauth_id=user_info.id,
+            display_name=user_info.display_name,
+            avatar_url=user_info.avatar_url,
+        )
+    except ValueError as e:
+        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail=str(e))
+
+
+@router.post("/forgot-password")
+@limiter.limit("3/minute")
+async def forgot_password(
+    request: Request,
+    body: ForgotPasswordRequest,
+    db: AsyncSession = Depends(get_db),
+):
+    success, message = await send_reset_email(db, body.email)
+    if not success:
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail=message,
+        )
+    return {"message": message}
+
+
+@router.post("/reset-password")
+@limiter.limit("5/minute")
+async def reset_password_endpoint(
+    request: Request,
+    body: ResetPasswordRequest,
+    db: AsyncSession = Depends(get_db),
+):
+    success, message = await reset_password(db, body.token, body.new_password)
+    if not success:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=message,
+        )
+    return {"message": message}
+
+
+@router.post("/change-password")
+@limiter.limit("5/minute")
+async def change_password(
+    request: Request,
+    body: ChangePasswordRequest,
+    user: Annotated[User, Depends(get_current_user)],
+    db: AsyncSession = Depends(get_db),
+):
+    if not verify_password(body.current_password, user.password_hash):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Неверный текущий пароль",
+        )
+
+    user.password_hash = get_password_hash(body.new_password)
+    await db.commit()
+    return {"message": "Пароль успешно изменён"}