581 lines
17 KiB
Python
581 lines
17 KiB
Python
from fastapi import APIRouter, Depends, HTTPException, status, Request
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
from sqlalchemy import select
|
|
from pydantic import BaseModel, EmailStr, Field
|
|
from datetime import datetime, timedelta
|
|
from typing import Optional
|
|
import uuid
|
|
|
|
from database import get_session, User, RefreshToken, LoginAttempt
|
|
from security.auth import (
|
|
hash_password,
|
|
verify_password,
|
|
validate_password_strength,
|
|
create_access_token,
|
|
create_refresh_token,
|
|
decode_token,
|
|
generate_verification_token,
|
|
generate_reset_token,
|
|
hash_token,
|
|
)
|
|
from services.email_service import AuthEmailService
|
|
from core.dependencies import get_current_user
|
|
from config import settings
|
|
from datetime import datetime
|
|
import logging
|
|
|
|
logger = logging.getLogger(__name__)
|
|
router = APIRouter(prefix="/auth", tags=["Authentication"])
|
|
|
|
|
|
|
|
class RegisterRequest(BaseModel):
|
|
email: EmailStr
|
|
password: str = Field(..., min_length=8)
|
|
nom: str = Field(..., min_length=2, max_length=100)
|
|
prenom: str = Field(..., min_length=2, max_length=100)
|
|
|
|
|
|
class LoginRequest(BaseModel):
|
|
email: EmailStr
|
|
password: str
|
|
|
|
|
|
class TokenResponse(BaseModel):
|
|
access_token: str
|
|
refresh_token: str
|
|
token_type: str = "bearer"
|
|
expires_in: int = 86400 # 30 minutes en secondes
|
|
|
|
|
|
class RefreshTokenRequest(BaseModel):
|
|
refresh_token: str
|
|
|
|
|
|
class ForgotPasswordRequest(BaseModel):
|
|
email: EmailStr
|
|
|
|
|
|
class ResetPasswordRequest(BaseModel):
|
|
token: str
|
|
new_password: str = Field(..., min_length=8)
|
|
|
|
|
|
class VerifyEmailRequest(BaseModel):
|
|
token: str
|
|
|
|
|
|
class ResendVerificationRequest(BaseModel):
|
|
email: EmailStr
|
|
|
|
|
|
|
|
|
|
async def log_login_attempt(
|
|
session: AsyncSession,
|
|
email: str,
|
|
ip: str,
|
|
user_agent: str,
|
|
success: bool,
|
|
failure_reason: Optional[str] = None,
|
|
):
|
|
"""Enregistre une tentative de connexion"""
|
|
attempt = LoginAttempt(
|
|
email=email,
|
|
ip_address=ip,
|
|
user_agent=user_agent,
|
|
success=success,
|
|
failure_reason=failure_reason,
|
|
timestamp=datetime.now(),
|
|
)
|
|
session.add(attempt)
|
|
await session.commit()
|
|
|
|
|
|
async def check_rate_limit(
|
|
session: AsyncSession, email: str, ip: str
|
|
) -> tuple[bool, str]:
|
|
"""
|
|
Vérifie si l'utilisateur/IP est rate limité
|
|
|
|
Returns:
|
|
(is_allowed, error_message)
|
|
"""
|
|
time_window = datetime.now() - timedelta(minutes=15)
|
|
|
|
result = await session.execute(
|
|
select(LoginAttempt).where(
|
|
LoginAttempt.email == email,
|
|
LoginAttempt.success == False,
|
|
LoginAttempt.timestamp >= time_window,
|
|
)
|
|
)
|
|
failed_attempts = result.scalars().all()
|
|
|
|
if len(failed_attempts) >= 5:
|
|
return False, "Trop de tentatives échouées. Réessayez dans 15 minutes."
|
|
|
|
return True, ""
|
|
|
|
|
|
|
|
|
|
@router.post("/register", status_code=status.HTTP_201_CREATED)
|
|
async def register(
|
|
data: RegisterRequest,
|
|
request: Request,
|
|
session: AsyncSession = Depends(get_session),
|
|
):
|
|
"""
|
|
📝 Inscription d'un nouvel utilisateur
|
|
|
|
- Valide le mot de passe
|
|
- Crée le compte (non vérifié)
|
|
- Envoie email de vérification
|
|
"""
|
|
result = await session.execute(select(User).where(User.email == data.email))
|
|
existing_user = result.scalar_one_or_none()
|
|
|
|
if existing_user:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST, detail="Cet email est déjà utilisé"
|
|
)
|
|
|
|
is_valid, error_msg = validate_password_strength(data.password)
|
|
if not is_valid:
|
|
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=error_msg)
|
|
|
|
verification_token = generate_verification_token()
|
|
|
|
new_user = User(
|
|
id=str(uuid.uuid4()),
|
|
email=data.email.lower(),
|
|
hashed_password=hash_password(data.password),
|
|
nom=data.nom,
|
|
prenom=data.prenom,
|
|
is_verified=False,
|
|
verification_token=verification_token,
|
|
verification_token_expires=datetime.now() + timedelta(hours=24),
|
|
created_at=datetime.now(),
|
|
)
|
|
|
|
session.add(new_user)
|
|
await session.commit()
|
|
|
|
base_url = str(request.base_url).rstrip("/")
|
|
email_sent = AuthEmailService.send_verification_email(
|
|
data.email, verification_token, base_url
|
|
)
|
|
|
|
if not email_sent:
|
|
logger.warning(f"Échec envoi email vérification pour {data.email}")
|
|
|
|
logger.info(f"✅ Nouvel utilisateur inscrit: {data.email} (ID: {new_user.id})")
|
|
|
|
return {
|
|
"success": True,
|
|
"message": "Inscription réussie ! Consultez votre email pour vérifier votre compte.",
|
|
"user_id": new_user.id,
|
|
"email": data.email,
|
|
}
|
|
|
|
|
|
@router.get("/verify-email")
|
|
async def verify_email_get(token: str, session: AsyncSession = Depends(get_session)):
|
|
"""
|
|
✅ Vérification de l'email via lien cliquable (GET)
|
|
Utilisé quand l'utilisateur clique sur le lien dans l'email
|
|
"""
|
|
result = await session.execute(select(User).where(User.verification_token == token))
|
|
user = result.scalar_one_or_none()
|
|
|
|
if not user:
|
|
return {
|
|
"success": False,
|
|
"message": "Token de vérification invalide ou déjà utilisé.",
|
|
}
|
|
|
|
if user.verification_token_expires < datetime.now():
|
|
return {
|
|
"success": False,
|
|
"message": "Token expiré. Veuillez demander un nouvel email de vérification.",
|
|
"expired": True,
|
|
}
|
|
|
|
user.is_verified = True
|
|
user.verification_token = None
|
|
user.verification_token_expires = None
|
|
await session.commit()
|
|
|
|
logger.info(f"✅ Email vérifié: {user.email}")
|
|
|
|
return {
|
|
"success": True,
|
|
"message": "✅ Email vérifié avec succès ! Vous pouvez maintenant vous connecter.",
|
|
"email": user.email,
|
|
}
|
|
|
|
|
|
@router.post("/verify-email")
|
|
async def verify_email_post(
|
|
data: VerifyEmailRequest, session: AsyncSession = Depends(get_session)
|
|
):
|
|
"""
|
|
✅ Vérification de l'email via API (POST)
|
|
Utilisé pour les appels programmatiques depuis le frontend
|
|
"""
|
|
result = await session.execute(
|
|
select(User).where(User.verification_token == data.token)
|
|
)
|
|
user = result.scalar_one_or_none()
|
|
|
|
if not user:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail="Token de vérification invalide",
|
|
)
|
|
|
|
if user.verification_token_expires < datetime.now():
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail="Token expiré. Demandez un nouvel email de vérification.",
|
|
)
|
|
|
|
user.is_verified = True
|
|
user.verification_token = None
|
|
user.verification_token_expires = None
|
|
await session.commit()
|
|
|
|
logger.info(f"✅ Email vérifié: {user.email}")
|
|
|
|
return {
|
|
"success": True,
|
|
"message": "Email vérifié avec succès ! Vous pouvez maintenant vous connecter.",
|
|
}
|
|
|
|
|
|
@router.post("/resend-verification")
|
|
async def resend_verification(
|
|
data: ResendVerificationRequest,
|
|
request: Request,
|
|
session: AsyncSession = Depends(get_session),
|
|
):
|
|
"""
|
|
🔄 Renvoyer l'email de vérification
|
|
"""
|
|
result = await session.execute(select(User).where(User.email == data.email.lower()))
|
|
user = result.scalar_one_or_none()
|
|
|
|
if not user:
|
|
return {
|
|
"success": True,
|
|
"message": "Si cet email existe, un nouveau lien de vérification a été envoyé.",
|
|
}
|
|
|
|
if user.is_verified:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST, detail="Ce compte est déjà vérifié"
|
|
)
|
|
|
|
verification_token = generate_verification_token()
|
|
user.verification_token = verification_token
|
|
user.verification_token_expires = datetime.now() + timedelta(hours=24)
|
|
await session.commit()
|
|
|
|
base_url = str(request.base_url).rstrip("/")
|
|
AuthEmailService.send_verification_email(user.email, verification_token, base_url)
|
|
|
|
return {"success": True, "message": "Un nouveau lien de vérification a été envoyé."}
|
|
|
|
|
|
@router.post("/login", response_model=TokenResponse)
|
|
async def login(
|
|
data: LoginRequest, request: Request, session: AsyncSession = Depends(get_session)
|
|
):
|
|
"""
|
|
🔐 Connexion utilisateur
|
|
|
|
Retourne access_token (30min) et refresh_token (7 jours)
|
|
"""
|
|
ip = request.client.host if request.client else "unknown"
|
|
user_agent = request.headers.get("user-agent", "unknown")
|
|
|
|
is_allowed, error_msg = await check_rate_limit(session, data.email.lower(), ip)
|
|
if not is_allowed:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_429_TOO_MANY_REQUESTS, detail=error_msg
|
|
)
|
|
|
|
result = await session.execute(select(User).where(User.email == data.email.lower()))
|
|
user = result.scalar_one_or_none()
|
|
|
|
if not user or not verify_password(data.password, user.hashed_password):
|
|
await log_login_attempt(
|
|
session,
|
|
data.email.lower(),
|
|
ip,
|
|
user_agent,
|
|
False,
|
|
"Identifiants incorrects",
|
|
)
|
|
|
|
if user:
|
|
user.failed_login_attempts += 1
|
|
|
|
if user.failed_login_attempts >= 5:
|
|
user.locked_until = datetime.now() + timedelta(minutes=15)
|
|
await session.commit()
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail="Compte verrouillé suite à trop de tentatives. Réessayez dans 15 minutes.",
|
|
)
|
|
|
|
await session.commit()
|
|
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Email ou mot de passe incorrect",
|
|
)
|
|
|
|
if not user.is_active:
|
|
await log_login_attempt(
|
|
session, data.email.lower(), ip, user_agent, False, "Compte désactivé"
|
|
)
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN, detail="Compte désactivé"
|
|
)
|
|
|
|
if not user.is_verified:
|
|
await log_login_attempt(
|
|
session, data.email.lower(), ip, user_agent, False, "Email non vérifié"
|
|
)
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail="Email non vérifié. Consultez votre boîte de réception.",
|
|
)
|
|
|
|
if user.locked_until and user.locked_until > datetime.now():
|
|
await log_login_attempt(
|
|
session, data.email.lower(), ip, user_agent, False, "Compte verrouillé"
|
|
)
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail="Compte temporairement verrouillé",
|
|
)
|
|
|
|
|
|
user.failed_login_attempts = 0
|
|
user.locked_until = None
|
|
user.last_login = datetime.now()
|
|
|
|
access_token = create_access_token(
|
|
{"sub": user.id, "email": user.email, "role": user.role}
|
|
)
|
|
refresh_token_jwt = create_refresh_token(user.id)
|
|
|
|
refresh_token_record = RefreshToken(
|
|
id=str(uuid.uuid4()),
|
|
user_id=user.id,
|
|
token_hash=hash_token(refresh_token_jwt),
|
|
device_info=user_agent[:500],
|
|
ip_address=ip,
|
|
expires_at=datetime.now() + timedelta(days=7),
|
|
created_at=datetime.now(),
|
|
)
|
|
|
|
session.add(refresh_token_record)
|
|
await session.commit()
|
|
|
|
await log_login_attempt(session, data.email.lower(), ip, user_agent, True)
|
|
|
|
logger.info(f"✅ Connexion réussie: {user.email}")
|
|
|
|
return TokenResponse(
|
|
access_token=access_token,
|
|
refresh_token=refresh_token_jwt,
|
|
expires_in=86400, # 30 minutes
|
|
)
|
|
|
|
|
|
@router.post("/refresh", response_model=TokenResponse)
|
|
async def refresh_access_token(
|
|
data: RefreshTokenRequest, session: AsyncSession = Depends(get_session)
|
|
):
|
|
"""
|
|
🔄 Renouvellement du access_token via refresh_token
|
|
"""
|
|
payload = decode_token(data.refresh_token)
|
|
if not payload or payload.get("type") != "refresh":
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED, detail="Refresh token invalide"
|
|
)
|
|
|
|
user_id = payload.get("sub")
|
|
token_hash = hash_token(data.refresh_token)
|
|
|
|
result = await session.execute(
|
|
select(RefreshToken).where(
|
|
RefreshToken.user_id == user_id,
|
|
RefreshToken.token_hash == token_hash,
|
|
RefreshToken.is_revoked == False,
|
|
)
|
|
)
|
|
token_record = result.scalar_one_or_none()
|
|
|
|
if not token_record:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Refresh token révoqué ou introuvable",
|
|
)
|
|
|
|
if token_record.expires_at < datetime.now():
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED, detail="Refresh token expiré"
|
|
)
|
|
|
|
result = await session.execute(select(User).where(User.id == user_id))
|
|
user = result.scalar_one_or_none()
|
|
|
|
if not user or not user.is_active:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Utilisateur introuvable ou désactivé",
|
|
)
|
|
|
|
new_access_token = create_access_token(
|
|
{"sub": user.id, "email": user.email, "role": user.role}
|
|
)
|
|
|
|
logger.info(f"🔄 Token rafraîchi: {user.email}")
|
|
|
|
return TokenResponse(
|
|
access_token=new_access_token,
|
|
refresh_token=data.refresh_token, # Refresh token reste le même
|
|
expires_in=86400,
|
|
)
|
|
|
|
|
|
@router.post("/forgot-password")
|
|
async def forgot_password(
|
|
data: ForgotPasswordRequest,
|
|
request: Request,
|
|
session: AsyncSession = Depends(get_session),
|
|
):
|
|
"""
|
|
🔑 Demande de réinitialisation de mot de passe
|
|
"""
|
|
result = await session.execute(select(User).where(User.email == data.email.lower()))
|
|
user = result.scalar_one_or_none()
|
|
|
|
if not user:
|
|
return {
|
|
"success": True,
|
|
"message": "Si cet email existe, un lien de réinitialisation a été envoyé.",
|
|
}
|
|
|
|
reset_token = generate_reset_token()
|
|
user.reset_token = reset_token
|
|
user.reset_token_expires = datetime.now() + timedelta(hours=1)
|
|
await session.commit()
|
|
|
|
frontend_url = (
|
|
settings.frontend_url
|
|
if hasattr(settings, "frontend_url")
|
|
else str(request.base_url).rstrip("/")
|
|
)
|
|
AuthEmailService.send_password_reset_email(user.email, reset_token, frontend_url)
|
|
|
|
logger.info(f"📧 Reset password demandé: {user.email}")
|
|
|
|
return {
|
|
"success": True,
|
|
"message": "Si cet email existe, un lien de réinitialisation a été envoyé.",
|
|
}
|
|
|
|
|
|
@router.post("/reset-password")
|
|
async def reset_password(
|
|
data: ResetPasswordRequest, session: AsyncSession = Depends(get_session)
|
|
):
|
|
"""
|
|
🔐 Réinitialisation du mot de passe avec token
|
|
"""
|
|
result = await session.execute(select(User).where(User.reset_token == data.token))
|
|
user = result.scalar_one_or_none()
|
|
|
|
if not user:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail="Token de réinitialisation invalide",
|
|
)
|
|
|
|
if user.reset_token_expires < datetime.now():
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail="Token expiré. Demandez un nouveau lien de réinitialisation.",
|
|
)
|
|
|
|
is_valid, error_msg = validate_password_strength(data.new_password)
|
|
if not is_valid:
|
|
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=error_msg)
|
|
|
|
user.hashed_password = hash_password(data.new_password)
|
|
user.reset_token = None
|
|
user.reset_token_expires = None
|
|
user.failed_login_attempts = 0
|
|
user.locked_until = None
|
|
await session.commit()
|
|
|
|
AuthEmailService.send_password_changed_notification(user.email)
|
|
|
|
logger.info(f"🔐 Mot de passe réinitialisé: {user.email}")
|
|
|
|
return {
|
|
"success": True,
|
|
"message": "Mot de passe réinitialisé avec succès. Vous pouvez maintenant vous connecter.",
|
|
}
|
|
|
|
|
|
@router.post("/logout")
|
|
async def logout(
|
|
data: RefreshTokenRequest,
|
|
session: AsyncSession = Depends(get_session),
|
|
user: User = Depends(get_current_user),
|
|
):
|
|
"""
|
|
🚪 Déconnexion (révocation du refresh token)
|
|
"""
|
|
token_hash = hash_token(data.refresh_token)
|
|
|
|
result = await session.execute(
|
|
select(RefreshToken).where(
|
|
RefreshToken.user_id == user.id, RefreshToken.token_hash == token_hash
|
|
)
|
|
)
|
|
token_record = result.scalar_one_or_none()
|
|
|
|
if token_record:
|
|
token_record.is_revoked = True
|
|
token_record.revoked_at = datetime.now()
|
|
await session.commit()
|
|
|
|
logger.info(f"👋 Déconnexion: {user.email}")
|
|
|
|
return {"success": True, "message": "Déconnexion réussie"}
|
|
|
|
|
|
@router.get("/me")
|
|
async def get_current_user_info(user: User = Depends(get_current_user)):
|
|
"""
|
|
👤 Récupération du profil utilisateur
|
|
"""
|
|
return {
|
|
"id": user.id,
|
|
"email": user.email,
|
|
"nom": user.nom,
|
|
"prenom": user.prenom,
|
|
"role": user.role,
|
|
"is_verified": user.is_verified,
|
|
"created_at": user.created_at.isoformat(),
|
|
"last_login": user.last_login.isoformat() if user.last_login else None,
|
|
}
|