weibo_signin/backend/auth_service/app/main.py

"""
Weibo-HotSign Authentication Service
Main FastAPI application entry point
"""

from fastapi import FastAPI, Depends, HTTPException, status, Security
from fastapi.middleware.cors import CORSMiddleware
from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
from sqlalchemy.ext.asyncio import AsyncSession
from sqlalchemy import select
import uvicorn
import os
import logging

from shared.models import get_db, User
from shared.config import shared_settings
from auth_service.app.models.database import create_tables
from auth_service.app.schemas.user import (
    UserCreate, UserLogin, UserResponse, Token, TokenData,
    RefreshTokenRequest, AuthResponse, WxLoginRequest,
)
from auth_service.app.services.auth_service import AuthService
from auth_service.app.utils.security import (
    verify_password, create_access_token, decode_access_token,
    create_refresh_token, verify_refresh_token, revoke_refresh_token,
)

# Configure logger
logger = logging.getLogger(__name__)

# Initialize FastAPI app
app = FastAPI(
    title="Weibo-HotSign Authentication Service",
    description="Handles user authentication and authorization for Weibo-HotSign system",
    version="1.0.0",
    docs_url="/docs",
    redoc_url="/redoc"
)

# CORS middleware configuration
app.add_middleware(
    CORSMiddleware,
    allow_origins=["http://localhost:3000", "http://localhost:80"],
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)

# Security scheme for JWT
security = HTTPBearer()

async def get_current_user(
    credentials: HTTPAuthorizationCredentials = Security(security),
    db: AsyncSession = Depends(get_db)
) -> UserResponse:
    """
    Dependency to get current user from JWT token
    """
    token = credentials.credentials
    payload = decode_access_token(token)
    
    if payload is None:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid or expired token",
            headers={"WWW-Authenticate": "Bearer"},
        )
    
    user_id = payload.get("sub")
    if not user_id:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid token payload",
            headers={"WWW-Authenticate": "Bearer"},
        )
    
    auth_service = AuthService(db)
    user = await auth_service.get_user_by_id(user_id)
    
    if user is None:
        raise HTTPException(
            status_code=status.HTTP_404_NOT_FOUND,
            detail="User not found",
        )
    
    if not user.is_active:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="User account is deactivated",
        )
    
    return UserResponse.from_orm(user)

@app.on_event("startup")
async def startup_event():
    """Initialize database tables on startup"""
    # 表已通过 create_sqlite_db.py 创建，无需重复创建
    # await create_tables()
    pass

@app.get("/")
async def root():
    return {
        "service": "Weibo-HotSign Authentication Service",
        "status": "running",
        "version": "1.0.0"
    }

@app.get("/health")
async def health_check():
    return {"status": "healthy"}

@app.post("/auth/register", response_model=AuthResponse, status_code=status.HTTP_201_CREATED)
async def register_user(user_data: UserCreate, db: AsyncSession = Depends(get_db)):
    """
    Register a new user account and return tokens
    """
    auth_service = AuthService(db)
    
    # Check if user already exists - optimized with single query
    email_user, username_user = await auth_service.check_user_exists(user_data.email, user_data.username)
    
    if email_user:
        raise HTTPException(
            status_code=status.HTTP_409_CONFLICT,
            detail="User with this email already exists"
        )
    
    if username_user:
        raise HTTPException(
            status_code=status.HTTP_409_CONFLICT,
            detail="Username already taken"
        )
    
    # Create new user
    try:
        user = await auth_service.create_user(user_data)
        
        # Create tokens for auto-login
        access_token = create_access_token(data={"sub": str(user.id), "username": user.username})
        refresh_token = await create_refresh_token(str(user.id))
        
        return AuthResponse(
            access_token=access_token,
            refresh_token=refresh_token,
            token_type="bearer",
            expires_in=3600,
            user=UserResponse.from_orm(user)
        )
    except Exception as e:
        raise HTTPException(
            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
            detail=f"Failed to create user: {str(e)}"
        )

@app.post("/auth/login", response_model=AuthResponse)
async def login_user(login_data: UserLogin, db: AsyncSession = Depends(get_db)):
    """
    Authenticate user and return JWT token with user info
    """
    auth_service = AuthService(db)
    
    # Find user by email
    user = await auth_service.get_user_by_email(login_data.email)
    if not user:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid email or password"
        )
    
    # Verify password
    if not verify_password(login_data.password, user.hashed_password):
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid email or password"
        )
    
    # Check if user is active
    if not user.is_active:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="User account is deactivated"
        )
    
    # Create access token
    access_token = create_access_token(data={"sub": str(user.id), "username": user.username})
    
    # Create refresh token (stored in Redis)
    refresh_token = await create_refresh_token(str(user.id))
    
    return AuthResponse(
        access_token=access_token,
        refresh_token=refresh_token,
        token_type="bearer",
        expires_in=3600,
        user=UserResponse.from_orm(user)
    )

@app.post("/auth/refresh", response_model=Token)
async def refresh_token(body: RefreshTokenRequest, db: AsyncSession = Depends(get_db)):
    """
    Exchange a valid refresh token for a new access + refresh token pair (Token Rotation).
    The old refresh token is revoked immediately.
    """
    # Verify the incoming refresh token
    user_id = await verify_refresh_token(body.refresh_token)
    if user_id is None:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid or expired refresh token",
        )

    # Ensure the user still exists and is active
    auth_service = AuthService(db)
    user = await auth_service.get_user_by_id(user_id)
    if user is None or not user.is_active:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="User not found or deactivated",
        )

    # Revoke old token, issue new pair
    await revoke_refresh_token(body.refresh_token)
    new_access = create_access_token(data={"sub": str(user.id), "username": user.username})
    new_refresh = await create_refresh_token(str(user.id))

    return Token(
        access_token=new_access,
        refresh_token=new_refresh,
        token_type="bearer",
        expires_in=3600,
    )

@app.get("/auth/me", response_model=UserResponse)
async def get_current_user_info(current_user: UserResponse = Depends(get_current_user)):
    """
    Get current user information
    """
    return current_user


@app.post("/auth/wx-login", response_model=AuthResponse)
async def wx_login(body: WxLoginRequest, db: AsyncSession = Depends(get_db)):
    """
    微信小程序登录。

    流程：
    1. 用 code 调微信 code2Session 接口换取 openid
    2. 查找是否已有该 openid 的用户
    3. 没有则自动注册，有则直接登录
    4. 返回 JWT token
    """
    import httpx

    appid = shared_settings.WX_APPID
    secret = shared_settings.WX_SECRET

    if not appid or not secret:
        raise HTTPException(
            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
            detail="微信小程序未配置 APPID 和 SECRET",
        )

    # Step 1: code 换 openid
    async with httpx.AsyncClient(timeout=10) as client:
        resp = await client.get(
            "https://api.weixin.qq.com/sns/jscode2session",
            params={
                "appid": appid,
                "secret": secret,
                "js_code": body.code,
                "grant_type": "authorization_code",
            },
        )
        wx_data = resp.json()

    openid = wx_data.get("openid")
    if not openid:
        errcode = wx_data.get("errcode", "unknown")
        errmsg = wx_data.get("errmsg", "未知错误")
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail=f"微信登录失败: {errmsg} (errcode={errcode})",
        )

    # Step 2: 查找已有用户
    result = await db.execute(select(User).where(User.wx_openid == openid))
    user = result.scalar_one_or_none()

    if user:
        # 已有用户 — 更新昵称头像（如果传了）
        if body.nickname and body.nickname != user.wx_nickname:
            user.wx_nickname = body.nickname
        if body.avatar_url and body.avatar_url != user.wx_avatar:
            user.wx_avatar = body.avatar_url
        await db.commit()
        await db.refresh(user)
    else:
        # Step 3: 自动注册
        import uuid
        nickname = body.nickname or f"wx_{openid[:8]}"
        # 生成唯一 username（避免冲突）
        username = f"wx_{openid[:12]}"
        user = User(
            id=str(uuid.uuid4()),
            username=username,
            wx_openid=openid,
            wx_nickname=nickname,
            wx_avatar=body.avatar_url,
            is_active=True,
        )
        db.add(user)
        await db.commit()
        await db.refresh(user)
        logger.info(f"微信用户自动注册: openid={openid[:16]}..., username={username}")

    if not user.is_active:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="账号已被禁用",
        )

    # Step 4: 签发 token
    access_token = create_access_token(
        data={"sub": str(user.id), "username": user.username}
    )
    refresh_token = await create_refresh_token(str(user.id))

    return AuthResponse(
        access_token=access_token,
        refresh_token=refresh_token,
        token_type="bearer",
        expires_in=3600,
        user=UserResponse.from_orm(user),
    )