diff --git a/backend/.env.example b/backend/.env.example new file mode 100644 index 0000000..cc0bd94 --- /dev/null +++ b/backend/.env.example @@ -0,0 +1,20 @@ +# Database (async driver) +DATABASE_URL=postgresql+asyncpg://agp_user:agp_password@localhost:5432/agp_db + +# Redis +REDIS_URL=redis://localhost:6379/0 + +# JWT +SECRET_KEY=change-me-to-a-secure-random-string +ALGORITHM=HS256 +ACCESS_TOKEN_EXPIRE_MINUTES=30 + +# App +APP_NAME=AGP Backend +APP_VERSION=0.1.0 +DEBUG=true +CORS_ORIGINS=http://localhost:8080,http://localhost:3000 + +# File uploads +UPLOAD_DIR=uploads +MAX_UPLOAD_SIZE_MB=100 diff --git a/backend/.gitignore b/backend/.gitignore new file mode 100644 index 0000000..fc36f7d --- /dev/null +++ b/backend/.gitignore @@ -0,0 +1,4 @@ +.env +__pycache__/ +*.pyc +.venv/ diff --git a/backend/__init__.py b/backend/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/backend/alembic.ini b/backend/alembic.ini new file mode 100644 index 0000000..47488b0 --- /dev/null +++ b/backend/alembic.ini @@ -0,0 +1,42 @@ +# Alembic configuration file. +# Run: alembic upgrade head (to apply migrations) +# Run: alembic revision --autogenerate -m "description" (to generate migration) + +[alembic] +script_location = alembic +prepend_sys_path = . +sqlalchemy.url = postgresql+asyncpg://agp_user:agp_password@localhost:5432/agp_db + +[loggers] +keys = root,sqlalchemy,alembic + +[handlers] +keys = console + +[formatters] +keys = generic + +[logger_root] +level = WARN +handlers = console +qualname = + +[logger_sqlalchemy] +level = WARN +handlers = +qualname = sqlalchemy.engine + +[logger_alembic] +level = INFO +handlers = +qualname = alembic + +[handler_console] +class = StreamHandler +args = (sys.stderr,) +level = NOTSET +formatter = generic + +[formatter_generic] +format = %(levelname)-5.5s [%(name)s] %(message)s +datefmt = %H:%M:%S diff --git a/backend/alembic/env.py b/backend/alembic/env.py new file mode 100644 index 0000000..d9411ca --- /dev/null +++ b/backend/alembic/env.py @@ -0,0 +1,65 @@ +"""Alembic environment configuration.""" + +import asyncio +from logging.config import fileConfig + +from alembic import context +from sqlalchemy.ext.asyncio import create_async_engine + +from app.config import settings +from app.database import Base +from app.models import user, session, world, asset # noqa: F401 + +# this is the Alembic Config object, which provides +# access to the values within the .ini file in use. +config = context.config + +# Interpret the config file for Python logging. +# This line sets up loggers basically. +if config.config_file_name is not None: + fileConfig(config.config_file_name) + +# add your model's MetaData object here +# for 'autogenerate' support +target_metadata = Base.metadata + + +def run_migrations_offline() -> None: + """Run migrations in 'offline' mode.""" + url = settings.DATABASE_URL + context.configure( + url=url, + target_metadata=target_metadata, + literal_binds=True, + dialect_opts={"paramstyle": "named"}, + ) + + with context.begin_transaction(): + context.run_migrations() + + +def do_run_migrations(connection): + context.configure(connection=connection, target_metadata=target_metadata) + with context.begin_transaction(): + context.run_migrations() + + +async def run_async_migrations(): + """Run migrations in 'online' mode with async engine.""" + connectable = create_async_engine(settings.DATABASE_URL, echo=False) + + async with connectable.connect() as connection: + await connection.run_sync(do_run_migrations) + + await connectable.dispose() + + +def run_migrations_online() -> None: + """Run migrations in 'online' mode.""" + asyncio.run(run_async_migrations()) + + +if context.is_offline_mode(): + run_migrations_offline() +else: + run_migrations_online() diff --git a/backend/alembic/script.py.mako b/backend/alembic/script.py.mako new file mode 100644 index 0000000..d5a44c8 --- /dev/null +++ b/backend/alembic/script.py.mako @@ -0,0 +1,27 @@ +"""${message} + +Revision ID: ${up_revision} +Revises: ${down_revision | comma,n} +Create Date: ${create_date} +""" +from typing import Sequence, Union + +from alembic import op +import sqlalchemy as sa +${imports if imports else ""} + +# revision identifiers, used by Alembic. +revision: str = ${repr(up_revision)} +down_revision: Union[str, None] = ${repr(down_revision)} +branch_labels: Union[str, Sequence[str], None] = ${repr(branch_labels)} +depends_on: Union[str, Sequence[str], None] = ${repr(depends_on)} + + +def upgrade() -> None: + """Upgrade database schema.""" + ${upgrades if upgrades else "pass"} + + +def downgrade() -> None: + """Downgrade database schema.""" + ${downgrades if downgrades else "pass"} diff --git a/backend/alembic/versions/0001_initial.py b/backend/alembic/versions/0001_initial.py new file mode 100644 index 0000000..a764b9a --- /dev/null +++ b/backend/alembic/versions/0001_initial.py @@ -0,0 +1,126 @@ +"""initial schema + +Revision ID: 0001_initial +Revises: +Create Date: 2024-01-01 00:00:00.000000 +""" +from typing import Sequence, Union + +from alembic import op +import sqlalchemy as sa +from sqlalchemy.dialects import postgresql + +# revision identifiers, used by Alembic. +revision: str = "0001_initial" +down_revision: Union[str, None] = None +branch_labels: Union[str, Sequence[str], None] = None +depends_on: Union[str, Sequence[str], None] = None + + +def upgrade() -> None: + """Upgrade database schema.""" + # Create ENUM types + world_visibility = postgresql.ENUM( + "public", "private", "friends_only", name="world_visibility" + ) + world_visibility.create(op.get_bind(), checkfirst=True) + + asset_type = postgresql.ENUM( + "image", "audio", "video", "document", "model_3d", "other", name="asset_type" + ) + asset_type.create(op.get_bind(), checkfirst=True) + + # Create users table + op.create_table( + "users", + sa.Column("id", sa.Integer(), primary_key=True), + sa.Column("username", sa.String(length=50), nullable=False), + sa.Column("email", sa.String(length=120), nullable=False), + sa.Column("hashed_password", sa.String(length=255), nullable=False), + sa.Column("is_active", sa.Boolean(), nullable=True), + sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now()), + sa.Column("updated_at", sa.DateTime(timezone=True), nullable=True), + ) + op.create_index(op.f("ix_users_email"), "users", ["email"], unique=True) + op.create_index(op.f("ix_users_id"), "users", ["id"], unique=False) + op.create_index(op.f("ix_users_username"), "users", ["username"], unique=True) + + # Create sessions table + op.create_table( + "sessions", + sa.Column("id", sa.String(length=36), primary_key=True), + sa.Column("user_id", sa.Integer(), nullable=False), + sa.Column("token", sa.String(), nullable=False), + sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False), + sa.Column("is_active", sa.Boolean(), nullable=True), + sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now()), + sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now()), + sa.ForeignKeyConstraint(["user_id"], ["users.id"], ondelete="CASCADE"), + ) + op.create_index(op.f("ix_sessions_token"), "sessions", ["token"], unique=True) + + # Create worlds table + op.create_table( + "worlds", + sa.Column("id", sa.Integer(), primary_key=True), + sa.Column("name", sa.String(length=255), nullable=False), + sa.Column("description", sa.Text(), nullable=True), + sa.Column("owner_id", sa.Integer(), nullable=False), + sa.Column( + "visibility", + postgresql.ENUM( + "public", "private", "friends_only", name="world_visibility" + ), + nullable=True, + ), + sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now()), + sa.Column("updated_at", sa.DateTime(timezone=True), nullable=True), + sa.ForeignKeyConstraint(["owner_id"], ["users.id"]), + ) + op.create_index(op.f("ix_worlds_id"), "worlds", ["id"], unique=False) + + # Create assets table + op.create_table( + "assets", + sa.Column("id", sa.Integer(), primary_key=True), + sa.Column("name", sa.String(length=255), nullable=False), + sa.Column("description", sa.Text(), nullable=True), + sa.Column( + "asset_type", + postgresql.ENUM( + "image", "audio", "video", "document", "model_3d", "other", + name="asset_type", + ), + nullable=False, + ), + sa.Column("file_path", sa.String(length=512), nullable=False), + sa.Column("file_size", sa.Integer(), nullable=True), + sa.Column("mime_type", sa.String(length=128), nullable=True), + sa.Column("metadata_json", sa.Text(), nullable=True), + sa.Column("world_id", sa.Integer(), nullable=True), + sa.Column("owner_id", sa.Integer(), nullable=False), + sa.Column("is_public", sa.Boolean(), nullable=False), + sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now()), + sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now()), + sa.ForeignKeyConstraint(["owner_id"], ["users.id"]), + sa.ForeignKeyConstraint(["world_id"], ["worlds.id"]), + ) + op.create_index(op.f("ix_assets_id"), "assets", ["id"], unique=False) + + +def downgrade() -> None: + """Downgrade database schema.""" + op.drop_index(op.f("ix_assets_id"), table_name="assets") + op.drop_table("assets") + op.drop_index(op.f("ix_worlds_id"), table_name="worlds") + op.drop_table("worlds") + op.drop_index(op.f("ix_sessions_token"), table_name="sessions") + op.drop_table("sessions") + op.drop_index(op.f("ix_users_username"), table_name="users") + op.drop_index(op.f("ix_users_id"), table_name="users") + op.drop_index(op.f("ix_users_email"), table_name="users") + op.drop_table("users") + + # Drop ENUM types + postgresql.ENUM(name="asset_type").drop(op.get_bind(), checkfirst=True) + postgresql.ENUM(name="world_visibility").drop(op.get_bind(), checkfirst=True) diff --git a/backend/app/__init__.py b/backend/app/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/backend/app/config.py b/backend/app/config.py new file mode 100644 index 0000000..af23b68 --- /dev/null +++ b/backend/app/config.py @@ -0,0 +1,52 @@ +"""Application configuration via pydantic-settings.""" + +from functools import lru_cache + +from pydantic_settings import BaseSettings, SettingsConfigDict + + +class Settings(BaseSettings): + # App + APP_NAME: str = "AGP Backend" + APP_VERSION: str = "0.1.0" + DEBUG: bool = True + + # Database (async) + DATABASE_URL: str = "postgresql+asyncpg://agp_user:agp_password@localhost:5432/agp_db" + + # Redis + REDIS_URL: str = "redis://localhost:6379/0" + + # JWT / Auth + # NOTE: production must override SECRET_KEY with a secure random value + # (e.g. `python -c "import secrets; print(secrets.token_urlsafe(32))"`) + SECRET_KEY: str = "change-me-to-a-secure-random-string" + ALGORITHM: str = "HS256" + ACCESS_TOKEN_EXPIRE_MINUTES: int = 30 + + # CORS + CORS_ORIGINS: str = "http://localhost:8080,http://localhost:3000" + + # File uploads + UPLOAD_DIR: str = "uploads" + MAX_UPLOAD_SIZE_MB: int = 100 + + model_config = SettingsConfigDict( + env_file=".env", + env_file_encoding="utf-8", + case_sensitive=True, + ) + + @property + def cors_origins_list(self) -> list[str]: + return [origin.strip() for origin in self.CORS_ORIGINS.split(",")] + + +@lru_cache() +def get_settings() -> Settings: + """Return cached settings instance.""" + return Settings() + + +# Convenience singleton +settings = get_settings() diff --git a/backend/app/database.py b/backend/app/database.py new file mode 100644 index 0000000..9d917b2 --- /dev/null +++ b/backend/app/database.py @@ -0,0 +1,42 @@ +"""Async database engine and session factory.""" + +from sqlalchemy.ext.asyncio import ( + AsyncSession, + async_sessionmaker, + create_async_engine, +) +from sqlalchemy.orm import DeclarativeBase + +from app.config import settings + +engine = create_async_engine( + settings.DATABASE_URL, + echo=settings.DEBUG, + pool_size=10, + max_overflow=20, +) + +async_session_factory = async_sessionmaker( + engine, + class_=AsyncSession, + expire_on_commit=False, +) + + +class Base(DeclarativeBase): + pass + + +async def get_db() -> AsyncSession: + """Dependency that yields an async database session. + + Handlers are responsible for committing or rolling back their own + transactions. This avoids the double-commit problem where the + session is committed both here and in the handler. + """ + async with async_session_factory() as session: + try: + yield session + except Exception: + await session.rollback() + raise diff --git a/backend/app/dependencies.py b/backend/app/dependencies.py new file mode 100644 index 0000000..f388f5d --- /dev/null +++ b/backend/app/dependencies.py @@ -0,0 +1,55 @@ +"""Shared FastAPI dependencies, including JWT-based auth.""" + +from typing import Annotated + +from fastapi import Depends, HTTPException, status +from fastapi.security import OAuth2PasswordBearer +from jose import JWTError, jwt +from sqlalchemy import select +from sqlalchemy.ext.asyncio import AsyncSession + +from app.config import settings +from app.database import get_db +from app.models.user import User + +oauth2_scheme = OAuth2PasswordBearer(tokenUrl="/api/auth/login") + + +async def get_current_user( + token: Annotated[str, Depends(oauth2_scheme)], + db: Annotated[AsyncSession, Depends(get_db)], +) -> User: + """Resolve the JWT bearer token to a User, or raise 401.""" + credentials_exception = HTTPException( + status_code=status.HTTP_401_UNAUTHORIZED, + detail="Could not validate credentials", + headers={"WWW-Authenticate": "Bearer"}, + ) + try: + payload = jwt.decode( + token, settings.SECRET_KEY, algorithms=[settings.ALGORITHM] + ) + user_id: str | None = payload.get("sub") + if user_id is None: + raise credentials_exception + except JWTError: + raise credentials_exception + + try: + user_id_int = int(user_id) + except (ValueError, TypeError): + raise credentials_exception + + result = await db.execute(select(User).where(User.id == user_id_int)) + user = result.scalar_one_or_none() + if user is None: + raise credentials_exception + if not user.is_active: + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, + detail="User account is inactive", + ) + return user + + +CurrentUser = Annotated[User, Depends(get_current_user)] diff --git a/backend/app/main.py b/backend/app/main.py new file mode 100644 index 0000000..1260c12 --- /dev/null +++ b/backend/app/main.py @@ -0,0 +1,46 @@ +"""FastAPI application entry point.""" + +from contextlib import asynccontextmanager + +from fastapi import FastAPI +from fastapi.middleware.cors import CORSMiddleware + +from app.config import settings +from app.routers import auth, users, worlds, assets + + +@asynccontextmanager +async def lifespan(app: FastAPI): + """Application lifespan: startup and shutdown events.""" + # Startup: initialize database, connect to Redis, etc. + yield + # Shutdown: close connections, cleanup + + +app = FastAPI( + title=settings.APP_NAME, + version=settings.APP_VERSION, + description="Agentic Game Platform - Backend API", + lifespan=lifespan, +) + +# CORS +app.add_middleware( + CORSMiddleware, + allow_origins=settings.cors_origins_list, + allow_credentials=True, + allow_methods=["*"], + allow_headers=["*"], +) + +# Include routers +app.include_router(auth.router, prefix="/api/auth", tags=["auth"]) +app.include_router(users.router, prefix="/api/users", tags=["users"]) +app.include_router(worlds.router, prefix="/api/worlds", tags=["worlds"]) +app.include_router(assets.router, prefix="/api/assets", tags=["assets"]) + + +@app.get("/api/health") +async def health_check(): + """Simple health check endpoint.""" + return {"status": "ok", "app": settings.APP_NAME} diff --git a/backend/app/models/__init__.py b/backend/app/models/__init__.py new file mode 100644 index 0000000..96e2dc3 --- /dev/null +++ b/backend/app/models/__init__.py @@ -0,0 +1,6 @@ +from app.models.user import User +from app.models.session import Session +from app.models.world import World +from app.models.asset import Asset + +__all__ = ["User", "Session", "World", "Asset"] diff --git a/backend/app/models/asset.py b/backend/app/models/asset.py new file mode 100644 index 0000000..2955515 --- /dev/null +++ b/backend/app/models/asset.py @@ -0,0 +1,40 @@ +from sqlalchemy import Column, Integer, String, ForeignKey, Text, DateTime, Boolean +from sqlalchemy.dialects.postgresql import ENUM +from sqlalchemy.orm import relationship +from sqlalchemy.sql import func +import enum + +from app.database import Base + + +class AssetType(str, enum.Enum): + IMAGE = "image" + AUDIO = "audio" + VIDEO = "video" + DOCUMENT = "document" + MODEL_3D = "model_3d" + OTHER = "other" + + +class Asset(Base): + __tablename__ = "assets" + + id = Column(Integer, primary_key=True, index=True) + name = Column(String(255), nullable=False) + description = Column(Text, nullable=True) + asset_type = Column( + ENUM(AssetType, name="asset_type", create_type=False), + nullable=False, + ) + file_path = Column(String(512), nullable=False) + file_size = Column(Integer, nullable=True) + mime_type = Column(String(128), nullable=True) + metadata_json = Column(Text, nullable=True) + world_id = Column(Integer, ForeignKey("worlds.id"), nullable=True) + owner_id = Column(Integer, ForeignKey("users.id"), nullable=False) + is_public = Column(Boolean, default=False, nullable=False) + created_at = Column(DateTime(timezone=True), server_default=func.now()) + updated_at = Column(DateTime(timezone=True), server_default=func.now(), onupdate=func.now()) + + owner = relationship("User", back_populates="assets") + world = relationship("World", back_populates="assets") diff --git a/backend/app/models/session.py b/backend/app/models/session.py new file mode 100644 index 0000000..7a7d33a --- /dev/null +++ b/backend/app/models/session.py @@ -0,0 +1,20 @@ +import uuid + +from sqlalchemy import Column, Integer, String, DateTime, ForeignKey, Boolean +from sqlalchemy.orm import relationship +from sqlalchemy.sql import func +from app.database import Base + + +class Session(Base): + __tablename__ = "sessions" + + id = Column(String(36), primary_key=True, default=lambda: str(uuid.uuid4())) + user_id = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False) + token = Column(String, unique=True, index=True, nullable=False) + expires_at = Column(DateTime(timezone=True), nullable=False) + is_active = Column(Boolean, default=True) + created_at = Column(DateTime(timezone=True), server_default=func.now()) + updated_at = Column(DateTime(timezone=True), server_default=func.now(), onupdate=func.now()) + + user = relationship("User", back_populates="sessions") diff --git a/backend/app/models/user.py b/backend/app/models/user.py new file mode 100644 index 0000000..ff48caa --- /dev/null +++ b/backend/app/models/user.py @@ -0,0 +1,21 @@ +from sqlalchemy import Column, Integer, String, Boolean, DateTime +from sqlalchemy.orm import relationship +from sqlalchemy.sql import func + +from app.database import Base + + +class User(Base): + __tablename__ = "users" + + id = Column(Integer, primary_key=True, index=True) + username = Column(String(50), unique=True, index=True, nullable=False) + email = Column(String(120), unique=True, index=True, nullable=False) + hashed_password = Column(String(255), nullable=False) + is_active = Column(Boolean, default=True) + created_at = Column(DateTime(timezone=True), server_default=func.now()) + updated_at = Column(DateTime(timezone=True), onupdate=func.now()) + + sessions = relationship("Session", back_populates="user", cascade="all, delete-orphan") + worlds = relationship("World", back_populates="owner") + assets = relationship("Asset", back_populates="owner") diff --git a/backend/app/models/world.py b/backend/app/models/world.py new file mode 100644 index 0000000..d10e896 --- /dev/null +++ b/backend/app/models/world.py @@ -0,0 +1,31 @@ +from sqlalchemy import Column, Integer, String, Text, DateTime, ForeignKey +from sqlalchemy.dialects.postgresql import ENUM +from sqlalchemy.orm import relationship +from sqlalchemy.sql import func +import enum + +from app.database import Base + + +class WorldVisibility(enum.Enum): + PUBLIC = "public" + PRIVATE = "private" + FRIENDS_ONLY = "friends_only" + + +class World(Base): + __tablename__ = "worlds" + + id = Column(Integer, primary_key=True, index=True) + name = Column(String(255), nullable=False) + description = Column(Text, nullable=True) + owner_id = Column(Integer, ForeignKey("users.id"), nullable=False) + visibility = Column( + ENUM(WorldVisibility, name="world_visibility", create_type=False), + default=WorldVisibility.PUBLIC, + ) + created_at = Column(DateTime(timezone=True), server_default=func.now()) + updated_at = Column(DateTime(timezone=True), onupdate=func.now()) + + owner = relationship("User", back_populates="worlds") + assets = relationship("Asset", back_populates="world", cascade="all, delete-orphan") diff --git a/backend/app/routers/__init__.py b/backend/app/routers/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/backend/app/routers/assets.py b/backend/app/routers/assets.py new file mode 100644 index 0000000..af9c2be --- /dev/null +++ b/backend/app/routers/assets.py @@ -0,0 +1,209 @@ +"""Asset management router.""" + +import os +from pathlib import Path +from typing import Optional + +from fastapi import APIRouter, Depends, HTTPException, UploadFile, File, Query +from sqlalchemy import select +from sqlalchemy.ext.asyncio import AsyncSession + +from app.config import settings +from app.database import get_db +from app.dependencies import CurrentUser +from app.models.asset import Asset, AssetType +from app.models.world import World +from pydantic import BaseModel, Field + +router = APIRouter() + + +# --- Pydantic schemas --- + +class AssetCreate(BaseModel): + """Schema for creating an asset reference.""" + name: str = Field(..., min_length=1, max_length=255) + description: Optional[str] = None + asset_type: AssetType + world_id: Optional[int] = None + + +class AssetResponse(BaseModel): + """Schema for asset responses.""" + id: int + name: str + description: Optional[str] + asset_type: AssetType + file_path: str + file_size: Optional[int] + mime_type: Optional[str] + world_id: Optional[int] + owner_id: int + is_public: bool + created_at: str + updated_at: str + + model_config = {"from_attributes": True} + + +class AssetUpdate(BaseModel): + """Schema for updating an asset.""" + name: Optional[str] = None + description: Optional[str] = None + is_public: Optional[bool] = None + + +# --- Helpers --- + +def _sanitize_filename(filename: str) -> str: + """Strip path components and unsafe characters from a filename.""" + # Remove any directory components (path traversal protection). + base = os.path.basename(filename.replace("\\", "/")) + # Keep only safe characters. + safe = "".join(c for c in base if c.isalnum() or c in "._-") + return safe or "file" + + +# --- Endpoints --- + +@router.post("/", response_model=AssetResponse, status_code=201) +async def create_asset( + payload: AssetCreate, + current_user: CurrentUser, + db: AsyncSession = Depends(get_db), +): + """Create a new asset reference.""" + # Verify world ownership if world_id is provided + if payload.world_id is not None: + world = await db.get(World, payload.world_id) + if world is None: + raise HTTPException(status_code=404, detail="World not found") + if world.owner_id != current_user.id: + raise HTTPException(status_code=403, detail="Not owner of this world") + + asset = Asset( + name=payload.name, + description=payload.description, + asset_type=payload.asset_type, + file_path="", # Will be set after upload + owner_id=current_user.id, + world_id=payload.world_id, + is_public=False, + ) + db.add(asset) + await db.commit() + await db.refresh(asset) + return asset + + +@router.get("/", response_model=list[AssetResponse]) +async def list_assets( + current_user: CurrentUser, + world_id: Optional[int] = Query(None, description="Filter by world"), + asset_type: Optional[AssetType] = Query(None), + limit: int = Query(50, ge=1, le=100), + offset: int = Query(0, ge=0), + db: AsyncSession = Depends(get_db), +): + """List assets with optional filters.""" + stmt = select(Asset).where(Asset.owner_id == current_user.id) + + if world_id is not None: + stmt = stmt.where(Asset.world_id == world_id) + if asset_type is not None: + stmt = stmt.where(Asset.asset_type == asset_type) + + stmt = stmt.order_by(Asset.created_at.desc()).limit(limit).offset(offset) + result = await db.execute(stmt) + assets = result.scalars().all() + return assets + + +@router.get("/{asset_id}", response_model=AssetResponse) +async def get_asset( + asset_id: int, + current_user: CurrentUser, + db: AsyncSession = Depends(get_db), +): + """Get a single asset by ID.""" + asset = await db.get(Asset, asset_id) + if asset is None or asset.owner_id != current_user.id: + raise HTTPException(status_code=404, detail="Asset not found") + return asset + + +@router.patch("/{asset_id}", response_model=AssetResponse) +async def update_asset( + asset_id: int, + payload: AssetUpdate, + current_user: CurrentUser, + db: AsyncSession = Depends(get_db), +): + """Update an asset.""" + asset = await db.get(Asset, asset_id) + if asset is None or asset.owner_id != current_user.id: + raise HTTPException(status_code=404, detail="Asset not found") + + update_data = payload.model_dump(exclude_unset=True) + for field, value in update_data.items(): + setattr(asset, field, value) + + await db.commit() + await db.refresh(asset) + return asset + + +@router.delete("/{asset_id}", status_code=204) +async def delete_asset( + asset_id: int, + current_user: CurrentUser, + db: AsyncSession = Depends(get_db), +): + """Delete an asset.""" + asset = await db.get(Asset, asset_id) + if asset is None or asset.owner_id != current_user.id: + raise HTTPException(status_code=404, detail="Asset not found") + + await db.delete(asset) + await db.commit() + + +@router.post("/{asset_id}/upload", response_model=AssetResponse) +async def upload_asset_file( + asset_id: int, + current_user: CurrentUser, + file: UploadFile = File(...), + db: AsyncSession = Depends(get_db), +): + """Upload a file for an existing asset.""" + asset = await db.get(Asset, asset_id) + if asset is None or asset.owner_id != current_user.id: + raise HTTPException(status_code=404, detail="Asset not found") + + # Sanitize filename to prevent path traversal. + safe_filename = _sanitize_filename(file.filename or f"asset_{asset_id}") + + # Validate file size against configured maximum. + max_bytes = settings.MAX_UPLOAD_SIZE_MB * 1024 * 1024 + content = await file.read() + file_size = len(content) + if file_size > max_bytes: + raise HTTPException( + status_code=413, + detail=f"File size {file_size} exceeds maximum allowed size {max_bytes} bytes", + ) + + # Write the file to the upload directory. + upload_dir = Path(settings.UPLOAD_DIR) + upload_dir.mkdir(parents=True, exist_ok=True) + stored_name = f"{asset_id}_{safe_filename}" + file_path = upload_dir / stored_name + file_path.write_bytes(content) + + asset.file_path = str(file_path) + asset.mime_type = file.content_type + asset.file_size = file_size + + await db.commit() + await db.refresh(asset) + return asset diff --git a/backend/app/routers/auth.py b/backend/app/routers/auth.py new file mode 100644 index 0000000..5059174 --- /dev/null +++ b/backend/app/routers/auth.py @@ -0,0 +1,131 @@ +"""Authentication router - login, register, token refresh.""" + +from datetime import datetime, timedelta, timezone + +from fastapi import APIRouter, Depends, HTTPException, status +from fastapi.security import OAuth2PasswordRequestForm +from pydantic import BaseModel, EmailStr + +from jose import jwt +from passlib.context import CryptContext + +from app.config import settings +from app.database import get_db +from app.dependencies import CurrentUser +from app.models.user import User +from sqlalchemy.ext.asyncio import AsyncSession +from sqlalchemy import select + +pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto") + +router = APIRouter() + + +# --- Pydantic schemas --- + +class TokenResponse(BaseModel): + access_token: str + token_type: str = "bearer" + + +class RegisterRequest(BaseModel): + username: str + email: EmailStr + password: str + + +class UserResponse(BaseModel): + id: int + username: str + email: str + is_active: bool + created_at: datetime | None = None + + model_config = {"from_attributes": True} + + +# --- Helpers --- + +def _create_access_token(data: dict) -> str: + to_encode = data.copy() + expire = datetime.now(timezone.utc) + timedelta( + minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES + ) + to_encode.update({"exp": expire}) + return jwt.encode(to_encode, settings.SECRET_KEY, algorithm=settings.ALGORITHM) + + +def verify_password(plain_password: str, hashed_password: str) -> bool: + """Verify a plain password against a hash.""" + return pwd_context.verify(plain_password, hashed_password) + + +def hash_password(password: str) -> str: + """Hash a password.""" + return pwd_context.hash(password) + + +# --- Endpoints --- + +@router.post("/register", response_model=TokenResponse, status_code=status.HTTP_201_CREATED) +async def register(req: RegisterRequest, db: AsyncSession = Depends(get_db)): + """Register a new user and return an access token.""" + # Check if username already exists + result = await db.execute(select(User).where(User.username == req.username)) + if result.scalar_one_or_none(): + raise HTTPException( + status_code=status.HTTP_409_CONFLICT, + detail="Username already registered", + ) + + # Check if email already exists + result = await db.execute(select(User).where(User.email == req.email)) + if result.scalar_one_or_none(): + raise HTTPException( + status_code=status.HTTP_409_CONFLICT, + detail="Email already registered", + ) + + user = User( + username=req.username, + email=req.email, + hashed_password=hash_password(req.password), + ) + db.add(user) + await db.commit() + await db.refresh(user) + + access_token = _create_access_token({"sub": str(user.id)}) + return TokenResponse(access_token=access_token) + + +@router.post("/login", response_model=TokenResponse) +async def login(form: OAuth2PasswordRequestForm = Depends(), db: AsyncSession = Depends(get_db)): + """Authenticate user and return an access token. + + Accepts form-encoded credentials (username/password) as expected by + OAuth2PasswordBearer, so the Swagger UI "Authorize" flow works correctly. + """ + result = await db.execute(select(User).where(User.username == form.username)) + user = result.scalar_one_or_none() + + if not user or not verify_password(form.password, user.hashed_password): + raise HTTPException( + status_code=status.HTTP_401_UNAUTHORIZED, + detail="Incorrect username or password", + ) + + if not user.is_active: + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, + detail="User account is inactive", + ) + + access_token = _create_access_token({"sub": str(user.id)}) + return TokenResponse(access_token=access_token) + + +@router.get("/me", response_model=UserResponse) +async def get_current_user(current_user: CurrentUser): + """Get current user profile from the JWT token.""" + return current_user diff --git a/backend/app/routers/users.py b/backend/app/routers/users.py new file mode 100644 index 0000000..6ba19b5 --- /dev/null +++ b/backend/app/routers/users.py @@ -0,0 +1,106 @@ +"""User management router.""" + +from typing import Annotated + +from fastapi import APIRouter, Depends, HTTPException, status +from pydantic import BaseModel, EmailStr +from sqlalchemy import select +from sqlalchemy.ext.asyncio import AsyncSession + +from app.database import get_db +from app.dependencies import CurrentUser +from app.models.user import User + +router = APIRouter() + + +# ─── Pydantic schemas ──────────────────────────────────────────────────────── + +class UserResponse(BaseModel): + id: int + username: str + email: str + is_active: bool + + model_config = {"from_attributes": True} + + +class UserUpdate(BaseModel): + email: EmailStr | None = None + is_active: bool | None = None + + +# ─── Endpoints ─────────────────────────────────────────────────────────────── + +@router.get("/me", response_model=UserResponse) +async def get_current_user_profile( + current_user: CurrentUser, +): + """Get the currently authenticated user's profile.""" + return current_user + + +@router.get("/{user_id}", response_model=UserResponse) +async def get_user( + user_id: int, + current_user: CurrentUser, + db: Annotated[AsyncSession, Depends(get_db)], +): + """Get a user by ID. Only the owner can view their own profile.""" + result = await db.execute(select(User).where(User.id == user_id)) + user = result.scalar_one_or_none() + if not user: + raise HTTPException(status_code=404, detail="User not found") + + # Only the owner may view their own profile. + if user.id != current_user.id: + raise HTTPException(status_code=403, detail="Not authorized to view this user") + + return user + + +@router.patch("/{user_id}", response_model=UserResponse) +async def update_user( + user_id: int, + user_update: UserUpdate, + current_user: CurrentUser, + db: Annotated[AsyncSession, Depends(get_db)], +): + """Update a user. Only the owner can update their own account.""" + result = await db.execute(select(User).where(User.id == user_id)) + user = result.scalar_one_or_none() + if not user: + raise HTTPException(status_code=404, detail="User not found") + + # Only the owner may update their own account. + if user.id != current_user.id: + raise HTTPException(status_code=403, detail="Not authorized to update this user") + + if user_update.email is not None: + user.email = user_update.email + if user_update.is_active is not None: + user.is_active = user_update.is_active + + await db.commit() + await db.refresh(user) + return user + + +@router.delete("/{user_id}", status_code=status.HTTP_204_NO_CONTENT) +async def delete_user( + user_id: int, + current_user: CurrentUser, + db: Annotated[AsyncSession, Depends(get_db)], +): + """Delete a user. Only the owner can delete their own account.""" + result = await db.execute(select(User).where(User.id == user_id)) + user = result.scalar_one_or_none() + if not user: + raise HTTPException(status_code=404, detail="User not found") + + # Only the owner may delete their own account. + if user.id != current_user.id: + raise HTTPException(status_code=403, detail="Not authorized to delete this user") + + await db.delete(user) + await db.commit() diff --git a/backend/app/routers/worlds.py b/backend/app/routers/worlds.py new file mode 100644 index 0000000..7f3aadd --- /dev/null +++ b/backend/app/routers/worlds.py @@ -0,0 +1,168 @@ +"""Worlds router - CRUD for game worlds.""" + +from typing import Annotated + +from fastapi import APIRouter, Depends, HTTPException, Query +from pydantic import BaseModel, Field +from sqlalchemy import select +from sqlalchemy.ext.asyncio import AsyncSession +from sqlalchemy.orm import selectinload + +from app.database import get_db +from app.dependencies import CurrentUser +from app.models.world import World, WorldVisibility + +router = APIRouter() + +DbDep = Annotated[AsyncSession, Depends(get_db)] + + +# --- Pydantic schemas --- + +class WorldCreate(BaseModel): + """Schema for creating a world.""" + name: str = Field(..., min_length=1, max_length=255) + description: str | None = None + visibility: WorldVisibility = WorldVisibility.PUBLIC + + +class WorldUpdate(BaseModel): + """Schema for updating a world.""" + name: str | None = Field(None, min_length=1, max_length=255) + description: str | None = None + visibility: WorldVisibility | None = None + + +class WorldResponse(BaseModel): + """Schema for world responses.""" + id: int + name: str + description: str | None + visibility: WorldVisibility + owner_id: int + created_at: str | None = None + + model_config = {"from_attributes": True} + + +# --- Endpoints --- + +@router.get("/", response_model=list[WorldResponse]) +async def list_worlds( + current_user: CurrentUser, + db: DbDep, + skip: int = Query(0, ge=0), + limit: int = Query(50, ge=1, le=100), + visibility: WorldVisibility | None = None, +): + """List worlds visible to the current user. + + PUBLIC worlds are visible to everyone. + PRIVATE/FRIENDS_ONLY worlds are visible to their owner. + """ + query = select(World).options(selectinload(World.owner)) + + # Filter by visibility if specified + if visibility: + query = query.where(World.visibility == visibility) + if visibility != WorldVisibility.PUBLIC: + # Requesting a non-public visibility explicitly must not bypass + # ownership — otherwise any authenticated user could list every + # PRIVATE/FRIENDS_ONLY world in the system just by passing the + # filter, defeating the point of the check below. + query = query.where(World.owner_id == current_user.id) + else: + # Show PUBLIC worlds + owner's own worlds + query = query.where( + (World.visibility == WorldVisibility.PUBLIC) + | (World.owner_id == current_user.id) + ) + + query = query.offset(skip).limit(limit).order_by(World.created_at.desc()) + result = await db.execute(query) + worlds = result.scalars().all() + return worlds + + +@router.get("/{world_id}", response_model=WorldResponse) +async def get_world( + world_id: int, + current_user: CurrentUser, + db: DbDep, +): + """Get a single world by ID, respecting visibility.""" + result = await db.execute( + select(World).where(World.id == world_id).options(selectinload(World.owner)) + ) + world = result.scalar_one_or_none() + if not world: + raise HTTPException(status_code=404, detail="World not found") + + # Allow access if world is PUBLIC or owned by current user + if world.visibility != WorldVisibility.PUBLIC and world.owner_id != current_user.id: + raise HTTPException(status_code=404, detail="World not found") + + return world + + +@router.post("/", response_model=WorldResponse, status_code=201) +async def create_world( + world_data: WorldCreate, + current_user: CurrentUser, + db: DbDep, +): + """Create a new world.""" + world = World( + name=world_data.name, + description=world_data.description, + owner_id=current_user.id, + visibility=world_data.visibility, + ) + db.add(world) + await db.commit() + await db.refresh(world) + return world + + +@router.put("/{world_id}", response_model=WorldResponse) +async def update_world( + world_id: int, + world_data: WorldUpdate, + current_user: CurrentUser, + db: DbDep, +): + """Update an existing world.""" + result = await db.execute(select(World).where(World.id == world_id)) + world = result.scalar_one_or_none() + if not world: + raise HTTPException(status_code=404, detail="World not found") + + if world.owner_id != current_user.id: + raise HTTPException(status_code=403, detail="Not owner of this world") + + update_data = world_data.model_dump(exclude_unset=True) + for field, value in update_data.items(): + setattr(world, field, value) + + await db.commit() + await db.refresh(world) + return world + + +@router.delete("/{world_id}", status_code=204) +async def delete_world( + world_id: int, + current_user: CurrentUser, + db: DbDep, +): + """Delete a world.""" + result = await db.execute(select(World).where(World.id == world_id)) + world = result.scalar_one_or_none() + if not world: + raise HTTPException(status_code=404, detail="World not found") + + if world.owner_id != current_user.id: + raise HTTPException(status_code=403, detail="Not owner of this world") + + await db.delete(world) + await db.commit() diff --git a/backend/docker-compose.yml b/backend/docker-compose.yml new file mode 100644 index 0000000..c9698e7 --- /dev/null +++ b/backend/docker-compose.yml @@ -0,0 +1,34 @@ +version: "3.9" + +services: + postgres: + image: postgres:16-alpine + environment: + POSTGRES_USER: agp_user + POSTGRES_PASSWORD: agp_password + POSTGRES_DB: agp_db + ports: + - "5432:5432" + volumes: + - postgres_data:/var/lib/postgresql/data + healthcheck: + test: ["CMD-SHELL", "pg_isready -U agp_user -d agp_db"] + interval: 5s + timeout: 5s + retries: 5 + + redis: + image: redis:7-alpine + ports: + - "6379:6379" + volumes: + - redis_data:/data + healthcheck: + test: ["CMD", "redis-cli", "ping"] + interval: 5s + timeout: 5s + retries: 5 + +volumes: + postgres_data: + redis_data: diff --git a/backend/requirements.txt b/backend/requirements.txt new file mode 100644 index 0000000..5cb3fb3 --- /dev/null +++ b/backend/requirements.txt @@ -0,0 +1,17 @@ +fastapi==0.115.6 +uvicorn[standard]==0.34.0 +sqlalchemy==2.0.36 +alembic==1.14.0 +psycopg2-binary==2.9.10 +asyncpg==0.31.0 +redis==5.2.1 +pydantic==2.10.3 +pydantic-settings==2.7.0 +python-jose[cryptography]==3.3.0 +passlib[bcrypt]==1.7.4 +python-multipart==0.0.20 +email-validator==2.2.0 +httpx==0.28.1 +pytest==8.3.4 +pytest-asyncio==0.25.0 +pytest-cov==6.0.0