Initial commit

backend/app/routers/auth.py

@@ -0,0 +1,114 @@
+from fastapi import APIRouter, HTTPException, status, Depends
+from fastapi.security import OAuth2PasswordRequestForm
+
+from ..db import (
+    verify_user_password,
+    create_user_if_missing,
+    set_last_login,
+    get_user_by_username,
+    set_user_password,
+)
+from ..runtime import get_runtime_settings
+from ..clients.jellyfin import JellyfinClient
+from ..clients.jellyseerr import JellyseerrClient
+from ..security import create_access_token
+from ..auth import get_current_user
+
+router = APIRouter(prefix="/auth", tags=["auth"])
+
+
+@router.post("/login")
+async def login(form_data: OAuth2PasswordRequestForm = Depends()) -> dict:
+    user = verify_user_password(form_data.username, form_data.password)
+    if not user:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid credentials")
+    if user.get("is_blocked"):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="User is blocked")
+    token = create_access_token(user["username"], user["role"])
+    set_last_login(user["username"])
+    return {
+        "access_token": token,
+        "token_type": "bearer",
+        "user": {"username": user["username"], "role": user["role"]},
+    }
+
+
+@router.post("/jellyfin/login")
+async def jellyfin_login(form_data: OAuth2PasswordRequestForm = Depends()) -> dict:
+    runtime = get_runtime_settings()
+    client = JellyfinClient(runtime.jellyfin_base_url, runtime.jellyfin_api_key)
+    if not client.configured():
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Jellyfin not configured")
+    try:
+        response = await client.authenticate_by_name(form_data.username, form_data.password)
+    except Exception as exc:
+        raise HTTPException(status_code=status.HTTP_502_BAD_GATEWAY, detail=str(exc)) from exc
+    if not isinstance(response, dict) or not response.get("User"):
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid Jellyfin credentials")
+    create_user_if_missing(form_data.username, "jellyfin-user", role="user", auth_provider="jellyfin")
+    user = get_user_by_username(form_data.username)
+    if user and user.get("is_blocked"):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="User is blocked")
+    try:
+        users = await client.get_users()
+        if isinstance(users, list):
+            for user in users:
+                if not isinstance(user, dict):
+                    continue
+                name = user.get("Name")
+                if isinstance(name, str) and name:
+                    create_user_if_missing(name, "jellyfin-user", role="user", auth_provider="jellyfin")
+    except Exception:
+        pass
+    token = create_access_token(form_data.username, "user")
+    set_last_login(form_data.username)
+    return {"access_token": token, "token_type": "bearer", "user": {"username": form_data.username, "role": "user"}}
+
+
+@router.post("/jellyseerr/login")
+async def jellyseerr_login(form_data: OAuth2PasswordRequestForm = Depends()) -> dict:
+    runtime = get_runtime_settings()
+    client = JellyseerrClient(runtime.jellyseerr_base_url, runtime.jellyseerr_api_key)
+    if not client.configured():
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Jellyseerr not configured")
+    payload = {"email": form_data.username, "password": form_data.password}
+    try:
+        response = await client.post("/api/v1/auth/login", payload=payload)
+    except Exception as exc:
+        raise HTTPException(status_code=status.HTTP_502_BAD_GATEWAY, detail=str(exc)) from exc
+    if not isinstance(response, dict):
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid Jellyseerr credentials")
+    create_user_if_missing(form_data.username, "jellyseerr-user", role="user", auth_provider="jellyseerr")
+    user = get_user_by_username(form_data.username)
+    if user and user.get("is_blocked"):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="User is blocked")
+    token = create_access_token(form_data.username, "user")
+    set_last_login(form_data.username)
+    return {"access_token": token, "token_type": "bearer", "user": {"username": form_data.username, "role": "user"}}
+
+
+@router.get("/me")
+async def me(current_user: dict = Depends(get_current_user)) -> dict:
+    return current_user
+
+
+@router.post("/password")
+async def change_password(payload: dict, current_user: dict = Depends(get_current_user)) -> dict:
+    if current_user.get("auth_provider") != "local":
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Password changes are only available for local users.",
+        )
+    current_password = payload.get("current_password") if isinstance(payload, dict) else None
+    new_password = payload.get("new_password") if isinstance(payload, dict) else None
+    if not isinstance(current_password, str) or not isinstance(new_password, str):
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Invalid payload")
+    if len(new_password.strip()) < 8:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST, detail="Password must be at least 8 characters."
+        )
+    user = verify_user_password(current_user["username"], current_password)
+    if not user:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Current password is incorrect")
+    set_user_password(current_user["username"], new_password.strip())
+    return {"status": "ok"}