Akiba So
72428dc075
Bug fixes (Flutter): - Wrap multi-statement DB writes (insert/update/delete note, deleteDocument, deletePageData, OCR FTS merge, migrations) in transactions to prevent data loss on interruption and a read-modify-write FTS race. - Fix PdfDocument leaks on exception (try/finally dispose) and preserve image aspect ratio when stamping images onto PDF pages. - Guard file-picker against empty selection (was .single -> crash). - Fix eraser ConcurrentModificationError and unmodifiable-list crash on PDF pages; capture page synchronously on save to stop wrong-page data loss. - Fix Riverpod DB-not-ready races, broken pull-to-refresh, settings load race, and search N+1; transform stored annotations on PDF page rotation. - Normalize pen pressure for devices without a pressure range. - PPT: single source of truth for slide strokes so ink displays and exports. UI/UX: - Material 3 typography, theme-aware colors (dark-mode fixes), hover cursors and right-click/visible actions on desktop, keyboard shortcuts (undo/redo/ save/find), toolbar overflow handling, friendlier empty states, semantic OCR status badges, relative timestamps, 1-based page indicators, large-deck PPT navigation, and a scratchpad-scope label in split view. Server (optional backend): - Persist JWT secret (was per-process random), block path traversal in storage, fix CORS '*'+credentials, add OCR job ownership checks, last-writer-wins sync guard, constant-time login, and split out heavy OCR deps so the API/tests run without them. CI: Gitea workflows for format+analyze+test (Linux, system sqlite) and a Windows release build; pristine `flutter analyze`, all Flutter and server tests green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
79 lines
2.4 KiB
Python
79 lines
2.4 KiB
Python
"""Auth router for BadNote."""
|
|
|
|
from datetime import datetime, timezone
|
|
from uuid import uuid4
|
|
|
|
from fastapi import APIRouter, Depends, HTTPException, status
|
|
|
|
from ..auth import (
|
|
create_access_token,
|
|
dummy_verify,
|
|
get_current_user,
|
|
hash_password,
|
|
verify_password,
|
|
)
|
|
from ..database import get_db
|
|
from ..models import TokenResponse, UserCreate, UserLogin
|
|
|
|
router = APIRouter()
|
|
|
|
|
|
@router.post("/register", response_model=TokenResponse, status_code=status.HTTP_201_CREATED)
|
|
async def register(body: UserCreate) -> TokenResponse:
|
|
"""Register a new user."""
|
|
db = await get_db()
|
|
existing = await db.execute(
|
|
"SELECT id FROM users WHERE username = ?", (body.username,)
|
|
)
|
|
if await existing.fetchone() is not None:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_409_CONFLICT,
|
|
detail="Username already taken",
|
|
)
|
|
|
|
user_id = str(uuid4())
|
|
now = datetime.now(timezone.utc).isoformat()
|
|
await db.execute(
|
|
"INSERT INTO users (id, username, password_hash, created_at) VALUES (?, ?, ?, ?)",
|
|
(user_id, body.username, hash_password(body.password), now),
|
|
)
|
|
await db.commit()
|
|
|
|
token = create_access_token(user_id)
|
|
return TokenResponse(token=token, user_id=user_id)
|
|
|
|
|
|
@router.post("/login", response_model=TokenResponse)
|
|
async def login(body: UserLogin) -> TokenResponse:
|
|
"""Authenticate and return a token."""
|
|
db = await get_db()
|
|
row = await (
|
|
await db.execute(
|
|
"SELECT id, password_hash FROM users WHERE username = ?", (body.username,)
|
|
)
|
|
).fetchone()
|
|
|
|
if row is None:
|
|
# Spend comparable time hashing so timing does not reveal whether the
|
|
# username exists.
|
|
dummy_verify()
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Invalid username or password",
|
|
)
|
|
if not verify_password(body.password, row["password_hash"]):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Invalid username or password",
|
|
)
|
|
|
|
token = create_access_token(row["id"])
|
|
return TokenResponse(token=token, user_id=row["id"])
|
|
|
|
|
|
@router.post("/refresh", response_model=TokenResponse)
|
|
async def refresh(user_id: str = Depends(get_current_user)) -> TokenResponse:
|
|
"""Refresh an existing valid token."""
|
|
token = create_access_token(user_id)
|
|
return TokenResponse(token=token, user_id=user_id)
|