新增用户注册功能

backend/app/api/v1/auth.py

@@ -1,40 +1,66 @@
 from fastapi import APIRouter, Depends, HTTPException, status
-from pydantic import BaseModel, Field
+from fastapi import File, UploadFile
+from pydantic import BaseModel, EmailStr, Field
 from sqlalchemy.ext.asyncio import AsyncSession
+from pathlib import Path
+import uuid
 
 from app.core.security import create_access_token, verify_password
 from app.core.deps import get_current_user, get_db_session
 from app.crud import user as user_crud
-from app.schemas.user import Token, UserRead
+from app.models.user import UserRole, UserStatus
+from app.schemas.user import Token, UserRead, UserRegisterRequest, UserSelfUpdate, UserUpdate
+from fastapi.responses import FileResponse
 
 
 class LoginRequest(BaseModel):
-    username: str = Field(min_length=1)
+    email: EmailStr
     password: str = Field(min_length=1)
 
 
 router = APIRouter()
+AVATAR_ROOT = Path(__file__).resolve().parent.parent.parent / "uploads" / "avatars"
+AVATAR_ROOT.mkdir(parents=True, exist_ok=True)
+
+
+@router.post("/register", status_code=status.HTTP_201_CREATED)
+async def register(
+    payload: UserRegisterRequest,
+    db: AsyncSession = Depends(get_db_session),
+):
+    if payload.role == UserRole.ADMIN.value:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="不允许注册管理员账号")
+    existing = await user_crud.get_by_email(db, payload.email)
+    if existing:
+        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="邮箱已注册")
+    await user_crud.create_pending_user(db, payload)
+    return {"message": "注册成功，等待管理员审核"}
 
 
 @router.post("/login", response_model=Token)
 async def login_for_access_token(
     payload: LoginRequest, db: AsyncSession = Depends(get_db_session)
 ) -> Token:
-    db_user = await user_crud.get_by_username(db, payload.username)
-    if not db_user or not verify_password(payload.password, db_user.hashed_password):
+    db_user = await user_crud.get_by_email(db, payload.email)
+    if not db_user:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
-            detail="Incorrect username or password",
+            detail="账号不存在",
         )
-    if not db_user.is_active:
+    if not verify_password(payload.password, db_user.password_hash):
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
-            detail="Inactive user",
+            detail="密码错误",
+        )
+    if db_user.status != UserStatus.ACTIVE:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="账号未审核或不可用",
         )
 
     access_token = create_access_token(
         user_id=str(db_user.id),
-        role=db_user.role,
+        role=db_user.role.value if hasattr(db_user.role, "value") else db_user.role,
         expires_minutes=None,
     )
     return Token(access_token=access_token, token_type="bearer")
@@ -43,3 +69,60 @@ async def login_for_access_token(
 @router.get("/me", response_model=UserRead)
 async def read_me(current_user=Depends(get_current_user)) -> UserRead:
     return current_user
+
+
+@router.patch("/me", response_model=UserRead)
+async def update_me(
+    payload: UserSelfUpdate,
+    current_user=Depends(get_current_user),
+    db: AsyncSession = Depends(get_db_session),
+) -> UserRead:
+    if payload.password:
+        if not payload.current_password or not verify_password(payload.current_password, current_user.password_hash):
+            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="当前密码不正确")
+    update_data = {
+        "full_name": payload.full_name if payload.full_name is not None else current_user.full_name,
+        "department": payload.department if payload.department is not None else current_user.department,
+        "password": payload.password if payload.password else None,
+        "avatar_url": payload.avatar_url if payload.avatar_url is not None else current_user.avatar_url,
+    }
+    updated = await user_crud.update_user(db, current_user, UserUpdate(**update_data))
+    return updated
+
+
+@router.post("/me/avatar", response_model=UserRead)
+async def upload_avatar(
+    file: UploadFile = File(...),
+    current_user=Depends(get_current_user),
+    db: AsyncSession = Depends(get_db_session),
+) -> UserRead:
+    AVATAR_ROOT.mkdir(parents=True, exist_ok=True)
+    user_dir = AVATAR_ROOT / str(current_user.id)
+    user_dir.mkdir(parents=True, exist_ok=True)
+    ext = Path(file.filename).suffix or ".png"
+    filename = f"{uuid.uuid4()}{ext}"
+    dest = user_dir / filename
+    content = await file.read()
+    dest.write_bytes(content)
+    # Optionally clean old files
+    for old in user_dir.iterdir():
+        if old.name != filename:
+            try:
+                old.unlink()
+            except OSError:
+                pass
+    rel_url = f"/api/v1/auth/avatar/{current_user.id}/{filename}"
+    updated = await user_crud.update_user(
+        db,
+        current_user,
+        UserUpdate(avatar_url=rel_url),
+    )
+    return updated
+
+
+@router.get("/avatar/{user_id}/{filename}")
+async def get_avatar(user_id: str, filename: str):
+    file_path = AVATAR_ROOT / user_id / filename
+    if not file_path.exists():
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Avatar not found")
+    return FileResponse(file_path)