Add local auth: AuthProvider, mailer, sessions, /api/v1/auth

Pluggable AuthProvider interface with a local (email+password) implementation, and a Mailer interface (ConsoleMailer for dev, SMTPMailer for operators). The auth service owns registration, login, opaque session issuance, email verification, and password reset (which revokes prior sessions). Endpoints under /api/v1/auth; sessions are returned as a Bearer token and set as an HttpOnly cookie. Replaces the temporary X-User-Id shim: get_current_user now resolves a real session (Bearer or cookie). The open user-bootstrap endpoint is gone (registration replaces it). App logging is configured so the ConsoleMailer's verification/reset links are visible to self-hosters. Verified end-to-end on the deploy target, including the email-verification flow. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Justin Paul <justin@jpaul.me>
2026-06-06 10:51:51 -04:00
parent 5123c85397
commit 00bfe8bfca
15 changed files with 497 additions and 31 deletions
@@ -1,33 +1,48 @@
-"""Shared API dependencies."""
+"""Shared API dependencies: DB session, the authenticated user, and the mailer."""

-import uuid
 from typing import Annotated

-from fastapi import Depends, Header, HTTPException, status
+from fastapi import Depends, HTTPException, Request, status
 from sqlalchemy.ext.asyncio import AsyncSession

+from app.core.config import get_settings
 from app.core.db import get_session
+from app.integrations.mailer.base import Mailer
+from app.integrations.mailer.console import ConsoleMailer
+from app.integrations.mailer.smtp import SMTPMailer
 from app.models.user import User
-from app.services.user_service import get_user
+from app.services import auth_service

 SessionDep = Annotated[AsyncSession, Depends(get_session)]


-async def get_current_user(
-    session: SessionDep,
-    x_user_id: Annotated[uuid.UUID | None, Header()] = None,
-) -> User:
-    """TEMPORARY pre-auth shim: identifies the caller via the ``X-User-Id``
-    header. Replaced by the AuthProvider (sessions/tokens) in the auth slice.
-    The assistant principal will also be minted here, scoped to its user."""
-    if x_user_id is None:
-        raise HTTPException(
-            status.HTTP_401_UNAUTHORIZED, "X-User-Id header required (pre-auth)"
-        )
-    user = await get_user(session, x_user_id)
+def extract_session_token(request: Request) -> str | None:
+    """Bearer header (API clients) takes precedence over the session cookie
+    (browser)."""
+    authorization = request.headers.get("authorization")
+    if authorization and authorization.lower().startswith("bearer "):
+        return authorization[7:].strip()
+    return request.cookies.get(get_settings().cookie_name)
+
+
+async def get_current_user(request: Request, session: SessionDep) -> User:
+    raw_token = extract_session_token(request)
+    if raw_token is None:
+        raise HTTPException(status.HTTP_401_UNAUTHORIZED, "authentication required")
+    user = await auth_service.resolve_session_user(session, raw_token=raw_token)
    if user is None:
-        raise HTTPException(status.HTTP_401_UNAUTHORIZED, "unknown user")
+        raise HTTPException(status.HTTP_401_UNAUTHORIZED, "invalid or expired session")
    return user


 CurrentUser = Annotated[User, Depends(get_current_user)]
+
+
+def get_mailer() -> Mailer:
+    settings = get_settings()
+    if settings.mailer == "smtp" and settings.smtp_host:
+        return SMTPMailer(settings)
+    return ConsoleMailer()
+
+
+MailerDep = Annotated[Mailer, Depends(get_mailer)]
@@ -2,9 +2,10 @@

 from fastapi import APIRouter

-from app.api.v1 import persons, trees, users
+from app.api.v1 import auth, persons, trees, users

 api_router = APIRouter(prefix="/api/v1")
+api_router.include_router(auth.router)
 api_router.include_router(users.router)
 api_router.include_router(trees.router)
 api_router.include_router(persons.router)
@@ -0,0 +1,81 @@
+from fastapi import APIRouter, HTTPException, Request, Response, status
+
+from app.api.deps import MailerDep, SessionDep, extract_session_token
+from app.core.config import get_settings
+from app.schemas.auth import (
+    LoginRequest,
+    PasswordResetConfirm,
+    PasswordResetRequest,
+    RegisterRequest,
+    SessionRead,
+    TokenRequest,
+)
+from app.schemas.user import UserRead
+from app.services import auth_service
+
+router = APIRouter(prefix="/auth", tags=["auth"])
+
+
+def _set_session_cookie(response: Response, token: str) -> None:
+    settings = get_settings()
+    response.set_cookie(
+        settings.cookie_name,
+        token,
+        max_age=settings.session_ttl_days * 86400,
+        httponly=True,
+        secure=settings.cookie_secure,
+        samesite="lax",
+    )
+
+
+@router.post("/register", response_model=SessionRead, status_code=status.HTTP_201_CREATED)
+async def register(
+    data: RegisterRequest, session: SessionDep, mailer: MailerDep, response: Response
+) -> SessionRead:
+    user, token, expires_at = await auth_service.register(
+        session,
+        mailer,
+        email=data.email,
+        password=data.password,
+        display_name=data.display_name,
+    )
+    _set_session_cookie(response, token)
+    return SessionRead(user=UserRead.model_validate(user), token=token, expires_at=expires_at)
+
+
+@router.post("/login", response_model=SessionRead)
+async def login(data: LoginRequest, session: SessionDep, response: Response) -> SessionRead:
+    result = await auth_service.login(session, email=data.email, password=data.password)
+    if result is None:
+        raise HTTPException(status.HTTP_401_UNAUTHORIZED, "invalid credentials")
+    user, token, expires_at = result
+    _set_session_cookie(response, token)
+    return SessionRead(user=UserRead.model_validate(user), token=token, expires_at=expires_at)
+
+
+@router.post("/logout", status_code=status.HTTP_204_NO_CONTENT)
+async def logout(request: Request, session: SessionDep, response: Response) -> None:
+    raw_token = extract_session_token(request)
+    if raw_token:
+        await auth_service.logout(session, raw_token=raw_token)
+    response.delete_cookie(get_settings().cookie_name)
+
+
+@router.post("/verify-email", status_code=status.HTTP_204_NO_CONTENT)
+async def verify_email(data: TokenRequest, session: SessionDep) -> None:
+    await auth_service.verify_email(session, raw_token=data.token)
+
+
+@router.post("/request-password-reset", status_code=status.HTTP_202_ACCEPTED)
+async def request_password_reset(
+    data: PasswordResetRequest, session: SessionDep, mailer: MailerDep
+) -> dict:
+    await auth_service.request_password_reset(session, mailer, email=data.email)
+    return {"status": "accepted"}
+
+
+@router.post("/reset-password", status_code=status.HTTP_204_NO_CONTENT)
+async def reset_password(data: PasswordResetConfirm, session: SessionDep) -> None:
+    await auth_service.reset_password(
+        session, raw_token=data.token, new_password=data.new_password
+    )
@@ -1,21 +1,11 @@
-from fastapi import APIRouter, status
+from fastapi import APIRouter

-from app.api.deps import CurrentUser, SessionDep
-from app.schemas.user import UserCreate, UserRead
-from app.services import user_service
+from app.api.deps import CurrentUser
+from app.schemas.user import UserRead

 router = APIRouter(prefix="/users", tags=["users"])


-@router.post("", response_model=UserRead, status_code=status.HTTP_201_CREATED)
-async def create_user(data: UserCreate, session: SessionDep) -> UserRead:
-    # Open dev bootstrap until the auth slice; lets us create tree owners.
-    user = await user_service.create_user(
-        session, email=data.email, display_name=data.display_name
-    )
-    return UserRead.model_validate(user)
-
-
@router.get("/me", response_model=UserRead)
 async def read_me(current: CurrentUser) -> UserRead:
    return UserRead.model_validate(current)