Admin mode. Data driven content sections. Bugfixes.

backend/app/api/auth.py

@@ -0,0 +1,112 @@
+"""Auth router: login, google OAuth, and current user info."""
+
+from fastapi import APIRouter, Depends, HTTPException, status
+from pydantic import BaseModel
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.auth import (
+    create_access_token,
+    get_current_user,
+    verify_google_id_token,
+)
+from app.config import settings
+from app.database import get_session
+from app.user_models import User
+
+router = APIRouter()
+
+
+# ── Request/Response schemas ─────────────────────────────────
+
+class LoginRequest(BaseModel):
+    username: str
+    password: str
+
+
+class GoogleLoginRequest(BaseModel):
+    id_token: str
+
+
+class TokenResponse(BaseModel):
+    access_token: str
+    token_type: str = "bearer"
+
+
+class UserInfoResponse(BaseModel):
+    id: int
+    email: str
+    display_name: str
+    avatar_url: str | None
+    auth_provider: str
+    is_admin: bool
+
+    model_config = {"from_attributes": True}
+
+
+# ── Routes ───────────────────────────────────────────────────
+
+@router.post("/login", response_model=TokenResponse)
+async def login(payload: LoginRequest):
+    """Bootstrap admin login (plaintext credentials from env vars)."""
+    if not settings.ADMIN_USERNAME or not settings.ADMIN_PASSWORD:
+        raise HTTPException(status_code=status.HTTP_503_SERVICE_UNAVAILABLE, detail="Bootstrap admin not configured")
+
+    if payload.username != settings.ADMIN_USERNAME or payload.password != settings.ADMIN_PASSWORD:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid credentials")
+
+    # This is handled in the auth router to keep it self-contained
+    from app.database import async_session
+
+    async with async_session() as session:
+        # Find or create the bootstrap admin user
+        result = await session.execute(
+            select(User).where(
+                User.email == f"{settings.ADMIN_USERNAME}@local",
+                User.auth_provider == "local",
+            )
+        )
+        user = result.scalar_one_or_none()
+        if user is None:
+            user = User(
+                email=f"{settings.ADMIN_USERNAME}@local",
+                display_name=settings.ADMIN_USERNAME,
+                auth_provider="local",
+                is_admin=True,
+            )
+            session.add(user)
+            await session.commit()
+            await session.refresh(user)
+
+    token = create_access_token(user.id, user.is_admin)
+    return TokenResponse(access_token=token)
+
+
+@router.post("/google", response_model=TokenResponse)
+async def login_with_google(payload: GoogleLoginRequest, session: AsyncSession = Depends(get_session)):
+    """Google OAuth sign-in. Accepts an ID token, verifies it, upserts user, returns JWT."""
+    info = await verify_google_id_token(payload.id_token)
+
+    result = await session.execute(select(User).where(User.email == info["email"]))
+    user = result.scalar_one_or_none()
+
+    if user is None:
+        user = User(
+            email=info["email"],
+            display_name=info["name"],
+            avatar_url=info["picture"] or None,
+            auth_provider="google",
+            is_admin=False,
+        )
+        session.add(user)
+        await session.commit()
+        await session.refresh(user)
+
+    token = create_access_token(user.id, user.is_admin)
+    return TokenResponse(access_token=token)
+
+
+@router.get("/me", response_model=UserInfoResponse)
+async def me(current_user: User = Depends(get_current_user)):
+    """Return current user info."""
+    return current_user