Cheng Zhou
129 lines
4.7 KiB
Python
129 lines
4.7 KiB
Python
from fastapi import APIRouter, Depends, HTTPException, status
|
|
from fastapi import File, UploadFile
|
|
from pydantic import BaseModel, EmailStr, Field
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
from pathlib import Path
|
|
import uuid
|
|
|
|
from app.core.security import create_access_token, verify_password
|
|
from app.core.deps import get_current_user, get_db_session
|
|
from app.crud import user as user_crud
|
|
from app.models.user import UserRole, UserStatus
|
|
from app.schemas.user import Token, UserRead, UserRegisterRequest, UserSelfUpdate, UserUpdate
|
|
from fastapi.responses import FileResponse
|
|
|
|
|
|
class LoginRequest(BaseModel):
|
|
email: EmailStr
|
|
password: str = Field(min_length=1)
|
|
|
|
|
|
router = APIRouter()
|
|
AVATAR_ROOT = Path(__file__).resolve().parent.parent.parent / "uploads" / "avatars"
|
|
AVATAR_ROOT.mkdir(parents=True, exist_ok=True)
|
|
|
|
|
|
@router.post("/register", status_code=status.HTTP_201_CREATED)
|
|
async def register(
|
|
payload: UserRegisterRequest,
|
|
db: AsyncSession = Depends(get_db_session),
|
|
):
|
|
if payload.role == UserRole.ADMIN.value:
|
|
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="不允许注册管理员账号")
|
|
existing = await user_crud.get_by_email(db, payload.email)
|
|
if existing:
|
|
raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="邮箱已注册")
|
|
await user_crud.create_pending_user(db, payload)
|
|
return {"message": "注册成功，等待管理员审核"}
|
|
|
|
|
|
@router.post("/login", response_model=Token)
|
|
async def login_for_access_token(
|
|
payload: LoginRequest, db: AsyncSession = Depends(get_db_session)
|
|
) -> Token:
|
|
db_user = await user_crud.get_by_email(db, payload.email)
|
|
if not db_user:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="账号不存在",
|
|
)
|
|
if not verify_password(payload.password, db_user.password_hash):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="密码错误",
|
|
)
|
|
if db_user.status != UserStatus.ACTIVE:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="账号未审核或不可用",
|
|
)
|
|
|
|
access_token = create_access_token(
|
|
user_id=str(db_user.id),
|
|
role=db_user.role.value if hasattr(db_user.role, "value") else db_user.role,
|
|
expires_minutes=None,
|
|
)
|
|
return Token(access_token=access_token, token_type="bearer")
|
|
|
|
|
|
@router.get("/me", response_model=UserRead)
|
|
async def read_me(current_user=Depends(get_current_user)) -> UserRead:
|
|
return current_user
|
|
|
|
|
|
@router.patch("/me", response_model=UserRead)
|
|
async def update_me(
|
|
payload: UserSelfUpdate,
|
|
current_user=Depends(get_current_user),
|
|
db: AsyncSession = Depends(get_db_session),
|
|
) -> UserRead:
|
|
if payload.password:
|
|
if not payload.current_password or not verify_password(payload.current_password, current_user.password_hash):
|
|
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="当前密码不正确")
|
|
update_data = {
|
|
"full_name": payload.full_name if payload.full_name is not None else current_user.full_name,
|
|
"department": payload.department if payload.department is not None else current_user.department,
|
|
"password": payload.password if payload.password else None,
|
|
"avatar_url": payload.avatar_url if payload.avatar_url is not None else current_user.avatar_url,
|
|
}
|
|
updated = await user_crud.update_user(db, current_user, UserUpdate(**update_data))
|
|
return updated
|
|
|
|
|
|
@router.post("/me/avatar", response_model=UserRead)
|
|
async def upload_avatar(
|
|
file: UploadFile = File(...),
|
|
current_user=Depends(get_current_user),
|
|
db: AsyncSession = Depends(get_db_session),
|
|
) -> UserRead:
|
|
AVATAR_ROOT.mkdir(parents=True, exist_ok=True)
|
|
user_dir = AVATAR_ROOT / str(current_user.id)
|
|
user_dir.mkdir(parents=True, exist_ok=True)
|
|
ext = Path(file.filename).suffix or ".png"
|
|
filename = f"{uuid.uuid4()}{ext}"
|
|
dest = user_dir / filename
|
|
content = await file.read()
|
|
dest.write_bytes(content)
|
|
# Optionally clean old files
|
|
for old in user_dir.iterdir():
|
|
if old.name != filename:
|
|
try:
|
|
old.unlink()
|
|
except OSError:
|
|
pass
|
|
rel_url = f"/api/v1/auth/avatar/{current_user.id}/{filename}"
|
|
updated = await user_crud.update_user(
|
|
db,
|
|
current_user,
|
|
UserUpdate(avatar_url=rel_url),
|
|
)
|
|
return updated
|
|
|
|
|
|
@router.get("/avatar/{user_id}/{filename}")
|
|
async def get_avatar(user_id: str, filename: str):
|
|
file_path = AVATAR_ROOT / user_id / filename
|
|
if not file_path.exists():
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Avatar not found")
|
|
return FileResponse(file_path)
|