meijiaka-zy/python-api/app/api/v1/auth.py

"""
认证模块 API
============

采用"手机号 + JWT + 单设备登录"的认证方案。

核心接口：
- /login: 手机号验证码登录（签发双 Token + SSE 踢人）
- /refresh: Refresh Token 轮换（换取新 Token 对）
- /logout: 登出（删除设备记录）
- /send-code: 发送短信验证码
- /me: 获取当前用户信息
"""

from __future__ import annotations

from fastapi import APIRouter, Depends, HTTPException, Request, status

from app.api.deps import get_current_user
from app.crud import user as user_crud
from app.db.session import AsyncSession, get_db
from app.models.user import User
from app.schemas.auth import (
    CheckPasswordResponse,
    MobileLoginRequest,
    PasswordLoginRequest,
    RefreshTokenRequest,
    ResetPasswordRequest,
    SendSmsCodeRequest,
    SetPasswordRequest,
    TokenResponse,
)
from app.schemas.common import ApiResponse, success_response
from app.schemas.user import UpdateNicknameRequest, UserProfileResponse
from app.services.auth_service import (
    login_with_password,
    login_with_sms,
    logout,
    refresh_access_token,
    reset_password_with_sms,
    send_sms_code,
)

router = APIRouter()


@router.post("/send-code", response_model=ApiResponse[dict])
async def send_code(
    request: SendSmsCodeRequest,
    db: AsyncSession = Depends(get_db),
):
    """
    发送短信验证码

    开发阶段验证码直接打印到日志，生产环境接入短信服务商。
    每个手机号每日最多发送 10 次。
    """
    # 校验用户是否存在
    user = await user_crud.get_by_mobile(db, mobile=request.mobile)
    if user is None:
        raise HTTPException(
            status_code=status.HTTP_404_NOT_FOUND,
            detail="用户不存在",
        )

    try:
        await send_sms_code(request.mobile)
    except ValueError as e:
        raise HTTPException(
            status_code=status.HTTP_429_TOO_MANY_REQUESTS,
            detail=str(e),
        )
    return success_response(
        data={"expire_minutes": 5},
        message="验证码已发送",
    )


@router.post("/login", response_model=ApiResponse[TokenResponse])
async def login(
    request: MobileLoginRequest,
    db: AsyncSession = Depends(get_db),
    http_request: Request = None,
):
    """
    手机号验证码登录

    流程：
    1. 校验验证码
    2. 获取或创建用户
    3. 踢掉旧设备（SSE 推送）
    4. 创建/覆盖设备记录
    5. 签发双 Token（Access + Refresh）
    """
    # 获取客户端 IP（优先从 Nginx 转发头读取真实公网 IP）
    client_ip = None
    if http_request:
        xff = http_request.headers.get("x-forwarded-for")
        if xff:
            client_ip = xff.split(",")[0].strip()
        else:
            xri = http_request.headers.get("x-real-ip")
            client_ip = xri or (http_request.client.host if http_request.client else None)

    try:
        result = await login_with_sms(
            db,
            mobile=request.mobile,
            code=request.code,
            device_id=request.device_id,
            device_name=request.device_name,
            os_info=request.os_info,
            app_version=request.app_version,
            ip=client_ip,
        )
    except ValueError as e:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail=str(e),
        )

    return success_response(
        data=TokenResponse(
            access_token=result["access_token"],
            refresh_token=result["refresh_token"],
            user=result["user"],
        ),
        message="登录成功",
    )


@router.post("/login-password", response_model=ApiResponse[TokenResponse])
async def login_password(
    request: PasswordLoginRequest,
    db: AsyncSession = Depends(get_db),
    http_request: Request = None,
):
    """
    手机号密码登录

    流程与验证码登录一致，只是校验方式改为密码。
    """
    client_ip = None
    if http_request:
        xff = http_request.headers.get("x-forwarded-for")
        if xff:
            client_ip = xff.split(",")[0].strip()
        else:
            xri = http_request.headers.get("x-real-ip")
            client_ip = xri or (http_request.client.host if http_request.client else None)

    try:
        result = await login_with_password(
            db,
            mobile=request.mobile,
            password=request.password,
            device_id=request.device_id,
            device_name=request.device_name,
            os_info=request.os_info,
            app_version=request.app_version,
            ip=client_ip,
        )
    except ValueError as e:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail=str(e),
        )

    return success_response(
        data=TokenResponse(
            access_token=result["access_token"],
            refresh_token=result["refresh_token"],
            user=result["user"],
        ),
        message="登录成功",
    )


@router.get("/has-password", response_model=ApiResponse[CheckPasswordResponse])
async def check_has_password(
    current_user: User = Depends(get_current_user),
):
    """检查当前用户是否已设置密码"""
    return success_response(
        data=CheckPasswordResponse(has_password=bool(current_user.password_hash)),
        message="查询成功",
    )


@router.post("/set-password", response_model=ApiResponse[dict])
async def set_password(
    request: SetPasswordRequest,
    current_user: User = Depends(get_current_user),
    db: AsyncSession = Depends(get_db),
):
    """
    设置或修改密码

    - 首次设置密码：old_password 可不传
    - 修改密码：必须传 old_password 校验
    """
    from app.core.security import hash_password, verify_password

    user = await user_crud.get(db, id=current_user.id)
    if user is None:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="用户不存在")

    # 如果已有密码，必须提供旧密码
    if user.password_hash:
        if not request.old_password:
            raise HTTPException(
                status_code=status.HTTP_400_BAD_REQUEST,
                detail="修改密码需要提供旧密码",
            )
        if not verify_password(request.old_password, user.password_hash):
            raise HTTPException(
                status_code=status.HTTP_400_BAD_REQUEST,
                detail="旧密码错误",
            )

    # 更新密码
    new_hash = hash_password(request.new_password)
    await user_crud.update_password(db, user_id=user.id, password_hash=new_hash)

    return success_response(data={}, message="密码设置成功")


@router.post("/reset-password", response_model=ApiResponse[dict])
async def reset_password(
    request: ResetPasswordRequest,
    db: AsyncSession = Depends(get_db),
):
    """
    短信验证码重置密码

    无需登录，通过短信验证码验证身份后直接重置密码。
    """
    try:
        await reset_password_with_sms(
            db,
            mobile=request.mobile,
            code=request.code,
            new_password=request.new_password,
        )
    except ValueError as e:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail=str(e),
        )

    return success_response(data={}, message="密码重置成功")


@router.post("/refresh", response_model=ApiResponse[dict])
async def refresh_token(
    request: RefreshTokenRequest,
    db: AsyncSession = Depends(get_db),
):
    """
    用 Refresh Token 换取新的 Token 对（Token 轮换）

    每次刷新都会生成全新的 Access Token 和 Refresh Token，
    同时更新设备记录中的 refresh_token_hash。
    """
    try:
        result = await refresh_access_token(db, refresh_token=request.refresh_token)
    except ValueError as e:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail=str(e),
            headers={"WWW-Authenticate": "Bearer"},
        )

    return success_response(
        data={
            "access_token": result["access_token"],
            "refresh_token": result["refresh_token"],
        },
        message="Token 刷新成功",
    )


@router.post("/logout", response_model=ApiResponse[dict])
async def do_logout(
    current_user: User = Depends(get_current_user),
    db: AsyncSession = Depends(get_db),
):
    """
    用户登出

    删除设备记录，注销 SSE 连接，使当前设备的 Token 失效。
    """
    await logout(db, user_id=current_user.id)

    return success_response(
        data={},
        message="登出成功",
    )


@router.get("/me", response_model=ApiResponse[UserProfileResponse])
async def get_me(
    current_user: User = Depends(get_current_user),
):
    """获取当前登录用户信息"""
    return success_response(
        data=UserProfileResponse(
            id=current_user.id,
            mobile=current_user.mobile,
            nickname=current_user.nickname,
            avatar=current_user.avatar_url or "",
            status=current_user.status,
            source=current_user.source,
            last_login_at=current_user.last_login_at,
            created_at=current_user.created_at,
        )
    )


@router.patch("/me", response_model=ApiResponse[UserProfileResponse])
async def update_me(
    request: UpdateNicknameRequest,
    current_user: User = Depends(get_current_user),
    db: AsyncSession = Depends(get_db),
):
    """修改当前用户信息（仅支持修改昵称）"""
    # current_user 来自 get_current_user 的会话，和当前 db 不是同一个会话
    # 需要重新查询到当前会话中才能正确提交
    user = await user_crud.get(db, id=current_user.id)
    if user is None:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="用户不存在")
    user.nickname = request.nickname.strip()
    await db.commit()
    await db.refresh(user)

    return success_response(
        data=UserProfileResponse(
            id=user.id,
            mobile=user.mobile,
            nickname=user.nickname,
            avatar=user.avatar_url or "",
            status=user.status,
            source=user.source,
            last_login_at=user.last_login_at,
            created_at=user.created_at,
        ),
        message="昵称修改成功",
    )