Nexus/server/api/auth.py

"""Nexus — Auth API Routes (Login / TOTP / JWT / Refresh / Logout)
Presentation layer — receives HTTP requests, delegates to AuthService.

A2: TOTP endpoints now require JWT authentication via get_current_admin.
"""

from typing import Optional
from fastapi import APIRouter, Depends, HTTPException, Request
from pydantic import BaseModel, Field
from sqlalchemy.ext.asyncio import AsyncSession

from server.api.dependencies import get_auth_service, get_db
from server.api.auth_jwt import get_current_admin
from server.application.services.auth_service import AuthService
from server.domain.models import Admin

router = APIRouter(prefix="/api/auth", tags=["auth"])


# ── Request Models ──

class LoginRequest(BaseModel):
    username: str = Field(..., min_length=1, max_length=100)
    password: str = Field(..., min_length=1, max_length=255)
    totp_code: Optional[str] = Field(None, min_length=6, max_length=6)


class RefreshRequest(BaseModel):
    refresh_token: str = Field(..., min_length=1)


class LogoutRequest(BaseModel):
    refresh_token: Optional[str] = None


class TotpSetupRequest(BaseModel):
    admin_id: int


class TotpVerifyRequest(BaseModel):
    admin_id: int
    totp_code: str = Field(..., min_length=6, max_length=6)


# ── Public Routes (no JWT required) ──

@router.post("/login")
async def login(
    request: Request,
    payload: LoginRequest,
    service: AuthService = Depends(get_auth_service),
):
    """Authenticate admin user (password + optional TOTP) → return JWT tokens"""
    ip_address = request.client.host if request.client else "unknown"
    result = await service.login(
        username=payload.username,
        password=payload.password,
        ip_address=ip_address,
        totp_code=payload.totp_code,
    )
    if not result["success"]:
        status_code = 401
        if result.get("reason") == "account_locked":
            status_code = 429
        elif result.get("reason") == "totp_required":
            status_code = 202  # Accepted but needs TOTP
        raise HTTPException(status_code=status_code, detail=result.get("message", "Login failed"))
    return result


@router.post("/refresh")
async def refresh_token(
    payload: RefreshRequest,
    service: AuthService = Depends(get_auth_service),
):
    """Exchange refresh token for new access + refresh token pair"""
    result = await service.refresh_token(payload.refresh_token)
    if not result["success"]:
        raise HTTPException(status_code=401, detail=result.get("message", "Invalid refresh token"))
    return result


@router.post("/logout")
async def logout(
    payload: LogoutRequest,
    service: AuthService = Depends(get_auth_service),
):
    """Invalidate refresh token (client should also discard access token)"""
    if payload.refresh_token:
        result = await service.logout_by_token(payload.refresh_token)
    else:
        return {"success": True, "message": "已登出"}
    return result


# ── Protected Routes (JWT required) ──

@router.post("/totp/setup")
async def setup_totp(
    payload: TotpSetupRequest,
    admin: Admin = Depends(get_current_admin),
    service: AuthService = Depends(get_auth_service),
):
    """Generate TOTP secret for admin user (requires JWT auth)

    A2: JWT authentication required — admin can only setup TOTP for themselves.
    """
    # Security: only allow setting up TOTP for the authenticated admin
    if payload.admin_id != admin.id:
        raise HTTPException(status_code=403, detail="Can only setup TOTP for yourself")

    result = await service.setup_totp(admin.id)
    if not result["success"]:
        raise HTTPException(status_code=400, detail=result.get("reason", "Setup failed"))
    return result


@router.post("/totp/enable")
async def enable_totp(
    payload: TotpVerifyRequest,
    admin: Admin = Depends(get_current_admin),
    service: AuthService = Depends(get_auth_service),
):
    """Enable TOTP after verification (requires JWT auth)

    A2: JWT authentication required — admin can only enable TOTP for themselves.
    """
    if payload.admin_id != admin.id:
        raise HTTPException(status_code=403, detail="Can only enable TOTP for yourself")

    result = await service.enable_totp(admin.id, payload.totp_code)
    if not result["success"]:
        raise HTTPException(status_code=400, detail=result.get("message", "Enable failed"))
    return result


@router.post("/totp/disable")
async def disable_totp(
    payload: TotpSetupRequest,
    admin: Admin = Depends(get_current_admin),
    service: AuthService = Depends(get_auth_service),
):
    """Disable TOTP for admin user (requires JWT auth)

    A2: JWT authentication required — admin can only disable TOTP for themselves.
    """
    if payload.admin_id != admin.id:
        raise HTTPException(status_code=403, detail="Can only disable TOTP for yourself")

    result = await service.disable_totp(admin.id)
    return result


@router.get("/me")
async def get_me(
    admin: Admin = Depends(get_current_admin),
    db: AsyncSession = Depends(get_db),
):
    """Get current authenticated admin info (JWT required)"""
    # Include system_name from settings for frontend branding
    system_name = None
    try:
        from server.infrastructure.database.setting_repo import SettingRepositoryImpl
        repo = SettingRepositoryImpl(db)
        system_name = await repo.get("system_name")
    except Exception:
        pass

    return {
        "id": admin.id,
        "username": admin.username,
        "email": admin.email,
        "totp_enabled": admin.totp_enabled,
        "is_active": admin.is_active,
        "last_login": str(admin.last_login) if admin.last_login else None,
        "system_name": system_name,
    }