WIP checkpoint: Address review feedback: Implement Godot dedicated server scene + player spawning
This commit is contained in:
@@ -0,0 +1,23 @@
|
||||
# Database (async driver)
|
||||
DATABASE_URL=postgresql+asyncpg://agp_user:agp_password@localhost:5432/agp_db
|
||||
|
||||
# Redis
|
||||
REDIS_URL=redis://localhost:6379/0
|
||||
|
||||
# JWT / Auth
|
||||
ALGORITHM=RS256
|
||||
ACCESS_TOKEN_EXPIRE_MINUTES=60
|
||||
REFRESH_TOKEN_EXPIRE_DAYS=30
|
||||
# Directory where the RSA keypair is loaded/generated at runtime.
|
||||
# Defaults to ~/.agp/keys (outside the repo). Keys are never committed to git.
|
||||
RSA_KEY_DIR=~/.agp/keys
|
||||
|
||||
# App
|
||||
APP_NAME=AGP Backend
|
||||
APP_VERSION=0.1.0
|
||||
DEBUG=true
|
||||
CORS_ORIGINS=http://localhost:8080,http://localhost:3000
|
||||
|
||||
# File uploads
|
||||
UPLOAD_DIR=uploads
|
||||
MAX_UPLOAD_SIZE_MB=100
|
||||
@@ -0,0 +1,4 @@
|
||||
.env
|
||||
__pycache__/
|
||||
*.pyc
|
||||
.venv/
|
||||
@@ -0,0 +1,42 @@
|
||||
# Alembic configuration file.
|
||||
# Run: alembic upgrade head (to apply migrations)
|
||||
# Run: alembic revision --autogenerate -m "description" (to generate migration)
|
||||
|
||||
[alembic]
|
||||
script_location = alembic
|
||||
prepend_sys_path = .
|
||||
sqlalchemy.url = postgresql+asyncpg://agp_user:agp_password@localhost:5432/agp_db
|
||||
|
||||
[loggers]
|
||||
keys = root,sqlalchemy,alembic
|
||||
|
||||
[handlers]
|
||||
keys = console
|
||||
|
||||
[formatters]
|
||||
keys = generic
|
||||
|
||||
[logger_root]
|
||||
level = WARN
|
||||
handlers = console
|
||||
qualname =
|
||||
|
||||
[logger_sqlalchemy]
|
||||
level = WARN
|
||||
handlers =
|
||||
qualname = sqlalchemy.engine
|
||||
|
||||
[logger_alembic]
|
||||
level = INFO
|
||||
handlers =
|
||||
qualname = alembic
|
||||
|
||||
[handler_console]
|
||||
class = StreamHandler
|
||||
args = (sys.stderr,)
|
||||
level = NOTSET
|
||||
formatter = generic
|
||||
|
||||
[formatter_generic]
|
||||
format = %(levelname)-5.5s [%(name)s] %(message)s
|
||||
datefmt = %H:%M:%S
|
||||
@@ -0,0 +1,65 @@
|
||||
"""Alembic environment configuration."""
|
||||
|
||||
import asyncio
|
||||
from logging.config import fileConfig
|
||||
|
||||
from alembic import context
|
||||
from sqlalchemy.ext.asyncio import create_async_engine
|
||||
|
||||
from app.config import settings
|
||||
from app.database import Base
|
||||
from app.models import user, session, world, asset # noqa: F401
|
||||
|
||||
# this is the Alembic Config object, which provides
|
||||
# access to the values within the .ini file in use.
|
||||
config = context.config
|
||||
|
||||
# Interpret the config file for Python logging.
|
||||
# This line sets up loggers basically.
|
||||
if config.config_file_name is not None:
|
||||
fileConfig(config.config_file_name)
|
||||
|
||||
# add your model's MetaData object here
|
||||
# for 'autogenerate' support
|
||||
target_metadata = Base.metadata
|
||||
|
||||
|
||||
def run_migrations_offline() -> None:
|
||||
"""Run migrations in 'offline' mode."""
|
||||
url = settings.DATABASE_URL
|
||||
context.configure(
|
||||
url=url,
|
||||
target_metadata=target_metadata,
|
||||
literal_binds=True,
|
||||
dialect_opts={"paramstyle": "named"},
|
||||
)
|
||||
|
||||
with context.begin_transaction():
|
||||
context.run_migrations()
|
||||
|
||||
|
||||
def do_run_migrations(connection):
|
||||
context.configure(connection=connection, target_metadata=target_metadata)
|
||||
with context.begin_transaction():
|
||||
context.run_migrations()
|
||||
|
||||
|
||||
async def run_async_migrations():
|
||||
"""Run migrations in 'online' mode with async engine."""
|
||||
connectable = create_async_engine(settings.DATABASE_URL, echo=False)
|
||||
|
||||
async with connectable.connect() as connection:
|
||||
await connection.run_sync(do_run_migrations)
|
||||
|
||||
await connectable.dispose()
|
||||
|
||||
|
||||
def run_migrations_online() -> None:
|
||||
"""Run migrations in 'online' mode."""
|
||||
asyncio.run(run_async_migrations())
|
||||
|
||||
|
||||
if context.is_offline_mode():
|
||||
run_migrations_offline()
|
||||
else:
|
||||
run_migrations_online()
|
||||
@@ -0,0 +1,27 @@
|
||||
"""${message}
|
||||
|
||||
Revision ID: ${up_revision}
|
||||
Revises: ${down_revision | comma,n}
|
||||
Create Date: ${create_date}
|
||||
"""
|
||||
from typing import Sequence, Union
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
${imports if imports else ""}
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision: str = ${repr(up_revision)}
|
||||
down_revision: Union[str, None] = ${repr(down_revision)}
|
||||
branch_labels: Union[str, Sequence[str], None] = ${repr(branch_labels)}
|
||||
depends_on: Union[str, Sequence[str], None] = ${repr(depends_on)}
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
"""Upgrade database schema."""
|
||||
${upgrades if upgrades else "pass"}
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
"""Downgrade database schema."""
|
||||
${downgrades if downgrades else "pass"}
|
||||
@@ -0,0 +1,127 @@
|
||||
"""initial schema
|
||||
|
||||
Revision ID: 0001_initial
|
||||
Revises:
|
||||
Create Date: 2024-01-01 00:00:00.000000
|
||||
"""
|
||||
from typing import Sequence, Union
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
from sqlalchemy.dialects import postgresql
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision: str = "0001_initial"
|
||||
down_revision: Union[str, None] = None
|
||||
branch_labels: Union[str, Sequence[str], None] = None
|
||||
depends_on: Union[str, Sequence[str], None] = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
"""Upgrade database schema."""
|
||||
# Create ENUM types
|
||||
world_visibility = postgresql.ENUM(
|
||||
"public", "private", "friends_only", name="world_visibility"
|
||||
)
|
||||
world_visibility.create(op.get_bind(), checkfirst=True)
|
||||
|
||||
asset_type = postgresql.ENUM(
|
||||
"image", "audio", "video", "document", "model_3d", "other", name="asset_type"
|
||||
)
|
||||
asset_type.create(op.get_bind(), checkfirst=True)
|
||||
|
||||
# Create users table
|
||||
op.create_table(
|
||||
"users",
|
||||
sa.Column("id", sa.Integer(), primary_key=True),
|
||||
sa.Column("username", sa.String(length=50), nullable=False),
|
||||
sa.Column("email", sa.String(length=120), nullable=False),
|
||||
sa.Column("hashed_password", sa.String(length=255), nullable=False),
|
||||
sa.Column("is_active", sa.Boolean(), nullable=True),
|
||||
sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
|
||||
sa.Column("updated_at", sa.DateTime(timezone=True), nullable=True),
|
||||
)
|
||||
op.create_index(op.f("ix_users_email"), "users", ["email"], unique=True)
|
||||
op.create_index(op.f("ix_users_id"), "users", ["id"], unique=False)
|
||||
op.create_index(op.f("ix_users_username"), "users", ["username"], unique=True)
|
||||
|
||||
# Create sessions table
|
||||
op.create_table(
|
||||
"sessions",
|
||||
sa.Column("id", sa.String(length=36), primary_key=True),
|
||||
sa.Column("user_id", sa.Integer(), nullable=False),
|
||||
sa.Column("token", sa.String(), nullable=False),
|
||||
sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
|
||||
sa.Column("is_active", sa.Boolean(), nullable=True),
|
||||
sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
|
||||
sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
|
||||
sa.ForeignKeyConstraint(["user_id"], ["users.id"], ondelete="CASCADE"),
|
||||
)
|
||||
op.create_index(op.f("ix_sessions_token"), "sessions", ["token"], unique=True)
|
||||
|
||||
# Create worlds table
|
||||
op.create_table(
|
||||
"worlds",
|
||||
sa.Column("id", sa.Integer(), primary_key=True),
|
||||
sa.Column("name", sa.String(length=255), nullable=False),
|
||||
sa.Column("description", sa.Text(), nullable=True),
|
||||
sa.Column("owner_id", sa.Integer(), nullable=False),
|
||||
sa.Column(
|
||||
"visibility",
|
||||
postgresql.ENUM(
|
||||
"public", "private", "friends_only", name="world_visibility",
|
||||
create_type=False,
|
||||
),
|
||||
nullable=True,
|
||||
),
|
||||
sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
|
||||
sa.Column("updated_at", sa.DateTime(timezone=True), nullable=True),
|
||||
sa.ForeignKeyConstraint(["owner_id"], ["users.id"]),
|
||||
)
|
||||
op.create_index(op.f("ix_worlds_id"), "worlds", ["id"], unique=False)
|
||||
|
||||
# Create assets table
|
||||
op.create_table(
|
||||
"assets",
|
||||
sa.Column("id", sa.Integer(), primary_key=True),
|
||||
sa.Column("name", sa.String(length=255), nullable=False),
|
||||
sa.Column("description", sa.Text(), nullable=True),
|
||||
sa.Column(
|
||||
"asset_type",
|
||||
postgresql.ENUM(
|
||||
"image", "audio", "video", "document", "model_3d", "other",
|
||||
name="asset_type", create_type=False,
|
||||
),
|
||||
nullable=False,
|
||||
),
|
||||
sa.Column("file_path", sa.String(length=512), nullable=False),
|
||||
sa.Column("file_size", sa.Integer(), nullable=True),
|
||||
sa.Column("mime_type", sa.String(length=128), nullable=True),
|
||||
sa.Column("metadata_json", sa.Text(), nullable=True),
|
||||
sa.Column("world_id", sa.Integer(), nullable=True),
|
||||
sa.Column("owner_id", sa.Integer(), nullable=False),
|
||||
sa.Column("is_public", sa.Boolean(), nullable=False),
|
||||
sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
|
||||
sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
|
||||
sa.ForeignKeyConstraint(["owner_id"], ["users.id"]),
|
||||
sa.ForeignKeyConstraint(["world_id"], ["worlds.id"]),
|
||||
)
|
||||
op.create_index(op.f("ix_assets_id"), "assets", ["id"], unique=False)
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
"""Downgrade database schema."""
|
||||
op.drop_index(op.f("ix_assets_id"), table_name="assets")
|
||||
op.drop_table("assets")
|
||||
op.drop_index(op.f("ix_worlds_id"), table_name="worlds")
|
||||
op.drop_table("worlds")
|
||||
op.drop_index(op.f("ix_sessions_token"), table_name="sessions")
|
||||
op.drop_table("sessions")
|
||||
op.drop_index(op.f("ix_users_username"), table_name="users")
|
||||
op.drop_index(op.f("ix_users_id"), table_name="users")
|
||||
op.drop_index(op.f("ix_users_email"), table_name="users")
|
||||
op.drop_table("users")
|
||||
|
||||
# Drop ENUM types
|
||||
postgresql.ENUM(name="asset_type").drop(op.get_bind(), checkfirst=True)
|
||||
postgresql.ENUM(name="world_visibility").drop(op.get_bind(), checkfirst=True)
|
||||
@@ -0,0 +1,30 @@
|
||||
"""add date_of_birth column to users table
|
||||
|
||||
Revision ID: 0002_add_date_of_birth_to_users
|
||||
Revises: 0001_initial
|
||||
Create Date: 2025-01-01 00:00:00.000000
|
||||
|
||||
"""
|
||||
from typing import Sequence, Union
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision: str = "0002_add_date_of_birth_to_users"
|
||||
down_revision: Union[str, None] = "0001_initial"
|
||||
branch_labels: Union[str, Sequence[str], None] = None
|
||||
depends_on: Union[str, Sequence[str], None] = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
"""Add date_of_birth column to users table."""
|
||||
op.add_column(
|
||||
"users",
|
||||
sa.Column("date_of_birth", sa.Date(), nullable=True),
|
||||
)
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
"""Remove date_of_birth column from users table."""
|
||||
op.drop_column("users", "date_of_birth")
|
||||
@@ -0,0 +1,36 @@
|
||||
"""add refresh_tokens table
|
||||
|
||||
Revision ID: 0003_add_refresh_tokens_table
|
||||
Revises: 0002_add_date_of_birth_to_users
|
||||
Create Date: 2025-07-25 00:00:00.000000
|
||||
|
||||
"""
|
||||
from typing import Sequence, Union
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
|
||||
# revision identifiers, used by Alembic.
|
||||
revision: str = "0003_add_refresh_tokens_table"
|
||||
down_revision: Union[str, None] = "0002_add_date_of_birth_to_users"
|
||||
branch_labels: Union[str, Sequence[str], None] = None
|
||||
depends_on: Union[str, Sequence[str], None] = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
"""Create the refresh_tokens table."""
|
||||
op.create_table(
|
||||
"refresh_tokens",
|
||||
sa.Column("id", sa.String(36), primary_key=True),
|
||||
sa.Column("user_id", sa.Integer(), sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=False),
|
||||
sa.Column("token", sa.String(512), unique=True, index=True, nullable=False),
|
||||
sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
|
||||
sa.Column("is_active", sa.Boolean(), server_default=sa.text("true"), nullable=False),
|
||||
sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
|
||||
sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
|
||||
)
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
"""Drop the refresh_tokens table."""
|
||||
op.drop_table("refresh_tokens")
|
||||
@@ -0,0 +1,127 @@
|
||||
"""Application configuration via pydantic-settings."""
|
||||
|
||||
from functools import lru_cache
|
||||
from pathlib import Path
|
||||
|
||||
from cryptography.hazmat.primitives.asymmetric.rsa import (
|
||||
RSAPrivateKey,
|
||||
RSAPublicKey,
|
||||
generate_private_key,
|
||||
)
|
||||
from cryptography.hazmat.primitives.serialization import (
|
||||
Encoding,
|
||||
NoEncryption,
|
||||
PrivateFormat,
|
||||
PublicFormat,
|
||||
load_pem_private_key,
|
||||
load_pem_public_key,
|
||||
)
|
||||
from pydantic_settings import BaseSettings, SettingsConfigDict
|
||||
|
||||
|
||||
def _load_or_generate_rsa_keys(key_dir: Path) -> tuple[bytes, bytes]:
|
||||
"""Load existing RSA keys or generate a new pair.
|
||||
|
||||
Keys are stored as PEM files in *key_dir*. The directory is created
|
||||
if it does not exist. Files are named ``private.pem`` and
|
||||
``public.pem`` and are **not** committed to git.
|
||||
"""
|
||||
private_path = key_dir / "private.pem"
|
||||
public_path = key_dir / "public.pem"
|
||||
|
||||
if private_path.exists() and public_path.exists():
|
||||
private_pem = private_path.read_bytes()
|
||||
public_pem = public_path.read_bytes()
|
||||
else:
|
||||
# Generate a new 2048-bit RSA key pair
|
||||
private_key = generate_private_key(public_exponent=65537, key_size=2048)
|
||||
private_pem = private_key.private_bytes(
|
||||
Encoding.PEM,
|
||||
PrivateFormat.PKCS8,
|
||||
NoEncryption(),
|
||||
)
|
||||
public_pem = private_key.public_key().public_bytes(
|
||||
Encoding.PEM,
|
||||
PublicFormat.SubjectPublicKeyInfo,
|
||||
)
|
||||
key_dir.mkdir(parents=True, exist_ok=True)
|
||||
private_path.write_bytes(private_pem)
|
||||
public_path.write_bytes(public_pem)
|
||||
|
||||
return private_pem, public_pem
|
||||
|
||||
|
||||
class Settings(BaseSettings):
|
||||
# App
|
||||
APP_NAME: str = "AGP Backend"
|
||||
APP_VERSION: str = "0.1.0"
|
||||
DEBUG: bool = True
|
||||
|
||||
# Database (async)
|
||||
DATABASE_URL: str = "postgresql+asyncpg://agp_user:agp_password@localhost:5432/agp_db"
|
||||
|
||||
# Redis
|
||||
REDIS_URL: str = "redis://localhost:6379/0"
|
||||
|
||||
# JWT / Auth
|
||||
ALGORITHM: str = "RS256"
|
||||
ACCESS_TOKEN_EXPIRE_MINUTES: int = 60
|
||||
REFRESH_TOKEN_EXPIRE_DAYS: int = 30
|
||||
|
||||
# RS256 key storage. Defaults to a directory outside the repo so the
|
||||
# generated keypair is never accidentally committed.
|
||||
RSA_KEY_DIR: str = str(Path.home() / ".agp" / "keys")
|
||||
|
||||
# CORS
|
||||
CORS_ORIGINS: str = "http://localhost:8080,http://localhost:3000"
|
||||
|
||||
# File uploads
|
||||
UPLOAD_DIR: str = "uploads"
|
||||
MAX_UPLOAD_SIZE_MB: int = 100
|
||||
GLTF_MAX_FILE_SIZE_MB: int = 200
|
||||
|
||||
model_config = SettingsConfigDict(
|
||||
env_file=".env",
|
||||
env_file_encoding="utf-8",
|
||||
case_sensitive=True,
|
||||
)
|
||||
|
||||
@property
|
||||
def cors_origins_list(self) -> list[str]:
|
||||
return [origin.strip() for origin in self.CORS_ORIGINS.split(",")]
|
||||
|
||||
@property
|
||||
def rsa_key_dir(self) -> Path:
|
||||
return Path(self.RSA_KEY_DIR)
|
||||
|
||||
@property
|
||||
def private_pem(self) -> bytes:
|
||||
"""Return the private key PEM bytes (loads/generates on first call)."""
|
||||
private_pem, _ = _load_or_generate_rsa_keys(self.rsa_key_dir)
|
||||
return private_pem
|
||||
|
||||
@property
|
||||
def public_pem(self) -> bytes:
|
||||
"""Return the public key PEM bytes (loads/generates on first call)."""
|
||||
_, public_pem = _load_or_generate_rsa_keys(self.rsa_key_dir)
|
||||
return public_pem
|
||||
|
||||
@property
|
||||
def private_key(self) -> RSAPrivateKey:
|
||||
"""Return the deserialized RSA private key object."""
|
||||
return load_pem_private_key(self.private_pem, password=None)
|
||||
|
||||
@property
|
||||
def public_key(self) -> RSAPublicKey:
|
||||
"""Return the deserialized RSA public key object."""
|
||||
return load_pem_public_key(self.public_pem)
|
||||
|
||||
|
||||
@lru_cache()
|
||||
def get_settings() -> Settings:
|
||||
"""Return cached settings instance."""
|
||||
return Settings()
|
||||
|
||||
|
||||
# Convenience singleton
|
||||
settings = get_settings()
|
||||
@@ -0,0 +1,42 @@
|
||||
"""Async database engine and session factory."""
|
||||
|
||||
from sqlalchemy.ext.asyncio import (
|
||||
AsyncSession,
|
||||
async_sessionmaker,
|
||||
create_async_engine,
|
||||
)
|
||||
from sqlalchemy.orm import DeclarativeBase
|
||||
|
||||
from app.config import settings
|
||||
|
||||
engine = create_async_engine(
|
||||
settings.DATABASE_URL,
|
||||
echo=settings.DEBUG,
|
||||
pool_size=10,
|
||||
max_overflow=20,
|
||||
)
|
||||
|
||||
async_session_factory = async_sessionmaker(
|
||||
engine,
|
||||
class_=AsyncSession,
|
||||
expire_on_commit=False,
|
||||
)
|
||||
|
||||
|
||||
class Base(DeclarativeBase):
|
||||
pass
|
||||
|
||||
|
||||
async def get_db() -> AsyncSession:
|
||||
"""Dependency that yields an async database session.
|
||||
|
||||
Handlers are responsible for committing or rolling back their own
|
||||
transactions. This avoids the double-commit problem where the
|
||||
session is committed both here and in the handler.
|
||||
"""
|
||||
async with async_session_factory() as session:
|
||||
try:
|
||||
yield session
|
||||
except Exception:
|
||||
await session.rollback()
|
||||
raise
|
||||
@@ -0,0 +1,55 @@
|
||||
"""Shared FastAPI dependencies, including JWT-based auth."""
|
||||
|
||||
from typing import Annotated
|
||||
|
||||
from fastapi import Depends, HTTPException, status
|
||||
from fastapi.security import OAuth2PasswordBearer
|
||||
from jose import JWTError, jwt
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.config import settings
|
||||
from app.database import get_db
|
||||
from app.models.user import User
|
||||
|
||||
oauth2_scheme = OAuth2PasswordBearer(tokenUrl="/api/auth/login")
|
||||
|
||||
|
||||
async def get_current_user(
|
||||
token: Annotated[str, Depends(oauth2_scheme)],
|
||||
db: Annotated[AsyncSession, Depends(get_db)],
|
||||
) -> User:
|
||||
"""Resolve the JWT bearer token to a User, or raise 401."""
|
||||
credentials_exception = HTTPException(
|
||||
status_code=status.HTTP_401_UNAUTHORIZED,
|
||||
detail="Could not validate credentials",
|
||||
headers={"WWW-Authenticate": "Bearer"},
|
||||
)
|
||||
try:
|
||||
payload = jwt.decode(
|
||||
token, settings.public_pem, algorithms=[settings.ALGORITHM]
|
||||
)
|
||||
user_id: str | None = payload.get("sub")
|
||||
if user_id is None:
|
||||
raise credentials_exception
|
||||
except JWTError:
|
||||
raise credentials_exception
|
||||
|
||||
try:
|
||||
user_id_int = int(user_id)
|
||||
except (ValueError, TypeError):
|
||||
raise credentials_exception
|
||||
|
||||
result = await db.execute(select(User).where(User.id == user_id_int))
|
||||
user = result.scalar_one_or_none()
|
||||
if user is None:
|
||||
raise credentials_exception
|
||||
if not user.is_active:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_403_FORBIDDEN,
|
||||
detail="User account is inactive",
|
||||
)
|
||||
return user
|
||||
|
||||
|
||||
CurrentUser = Annotated[User, Depends(get_current_user)]
|
||||
@@ -0,0 +1,46 @@
|
||||
"""FastAPI application entry point."""
|
||||
|
||||
from contextlib import asynccontextmanager
|
||||
|
||||
from fastapi import FastAPI
|
||||
from fastapi.middleware.cors import CORSMiddleware
|
||||
|
||||
from app.config import settings
|
||||
from app.routers import auth, users, worlds, assets
|
||||
|
||||
|
||||
@asynccontextmanager
|
||||
async def lifespan(app: FastAPI):
|
||||
"""Application lifespan: startup and shutdown events."""
|
||||
# Startup: initialize database, connect to Redis, etc.
|
||||
yield
|
||||
# Shutdown: close connections, cleanup
|
||||
|
||||
|
||||
app = FastAPI(
|
||||
title=settings.APP_NAME,
|
||||
version=settings.APP_VERSION,
|
||||
description="Agentic Game Platform - Backend API",
|
||||
lifespan=lifespan,
|
||||
)
|
||||
|
||||
# CORS
|
||||
app.add_middleware(
|
||||
CORSMiddleware,
|
||||
allow_origins=settings.cors_origins_list,
|
||||
allow_credentials=True,
|
||||
allow_methods=["*"],
|
||||
allow_headers=["*"],
|
||||
)
|
||||
|
||||
# Include routers
|
||||
app.include_router(auth.router, prefix="/api/auth", tags=["auth"])
|
||||
app.include_router(users.router, prefix="/api/users", tags=["users"])
|
||||
app.include_router(worlds.router, prefix="/api/worlds", tags=["worlds"])
|
||||
app.include_router(assets.router, prefix="/api/assets", tags=["assets"])
|
||||
|
||||
|
||||
@app.get("/api/health")
|
||||
async def health_check():
|
||||
"""Simple health check endpoint."""
|
||||
return {"status": "ok", "app": settings.APP_NAME}
|
||||
@@ -0,0 +1,6 @@
|
||||
from app.models.user import User
|
||||
from app.models.session import Session
|
||||
from app.models.world import World
|
||||
from app.models.asset import Asset
|
||||
|
||||
__all__ = ["User", "Session", "World", "Asset"]
|
||||
@@ -0,0 +1,40 @@
|
||||
from sqlalchemy import Column, Integer, String, ForeignKey, Text, DateTime, Boolean
|
||||
from sqlalchemy.dialects.postgresql import ENUM
|
||||
from sqlalchemy.orm import relationship
|
||||
from sqlalchemy.sql import func
|
||||
import enum
|
||||
|
||||
from app.database import Base
|
||||
|
||||
|
||||
class AssetType(str, enum.Enum):
|
||||
IMAGE = "image"
|
||||
AUDIO = "audio"
|
||||
VIDEO = "video"
|
||||
DOCUMENT = "document"
|
||||
MODEL_3D = "model_3d"
|
||||
OTHER = "other"
|
||||
|
||||
|
||||
class Asset(Base):
|
||||
__tablename__ = "assets"
|
||||
|
||||
id = Column(Integer, primary_key=True, index=True)
|
||||
name = Column(String(255), nullable=False)
|
||||
description = Column(Text, nullable=True)
|
||||
asset_type = Column(
|
||||
ENUM(AssetType, name="asset_type", create_type=False),
|
||||
nullable=False,
|
||||
)
|
||||
file_path = Column(String(512), nullable=False)
|
||||
file_size = Column(Integer, nullable=True)
|
||||
mime_type = Column(String(128), nullable=True)
|
||||
metadata_json = Column(Text, nullable=True)
|
||||
world_id = Column(Integer, ForeignKey("worlds.id"), nullable=True)
|
||||
owner_id = Column(Integer, ForeignKey("users.id"), nullable=False)
|
||||
is_public = Column(Boolean, default=False, nullable=False)
|
||||
created_at = Column(DateTime(timezone=True), server_default=func.now())
|
||||
updated_at = Column(DateTime(timezone=True), server_default=func.now(), onupdate=func.now())
|
||||
|
||||
owner = relationship("User", back_populates="assets")
|
||||
world = relationship("World", back_populates="assets")
|
||||
@@ -0,0 +1,41 @@
|
||||
import uuid
|
||||
|
||||
from sqlalchemy import Column, Integer, String, DateTime, ForeignKey, Boolean
|
||||
from sqlalchemy.orm import relationship
|
||||
from sqlalchemy.sql import func
|
||||
|
||||
from app.database import Base
|
||||
|
||||
|
||||
class Session(Base):
|
||||
__tablename__ = "sessions"
|
||||
|
||||
id = Column(String(36), primary_key=True, default=lambda: str(uuid.uuid4()))
|
||||
user_id = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False)
|
||||
token = Column(String, unique=True, index=True, nullable=False)
|
||||
expires_at = Column(DateTime(timezone=True), nullable=False)
|
||||
is_active = Column(Boolean, default=True)
|
||||
created_at = Column(DateTime(timezone=True), server_default=func.now())
|
||||
updated_at = Column(DateTime(timezone=True), server_default=func.now(), onupdate=func.now())
|
||||
|
||||
user = relationship("User", back_populates="sessions")
|
||||
|
||||
|
||||
class RefreshToken(Base):
|
||||
__tablename__ = "refresh_tokens"
|
||||
|
||||
id = Column(String(36), primary_key=True, default=lambda: str(uuid.uuid4()))
|
||||
user_id = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False)
|
||||
# RS256 JWTs are ~420+ chars; 512 is sufficient and matches the migration.
|
||||
token = Column(String(512), unique=True, index=True, nullable=False)
|
||||
expires_at = Column(DateTime(timezone=True), nullable=False)
|
||||
is_active = Column(Boolean, nullable=False, default=True, server_default="true")
|
||||
created_at = Column(DateTime(timezone=True), nullable=False, server_default=func.now())
|
||||
updated_at = Column(
|
||||
DateTime(timezone=True),
|
||||
nullable=False,
|
||||
server_default=func.now(),
|
||||
onupdate=func.now(),
|
||||
)
|
||||
|
||||
user = relationship("User", back_populates="refresh_tokens")
|
||||
@@ -0,0 +1,38 @@
|
||||
from datetime import date
|
||||
from typing import Optional
|
||||
|
||||
from sqlalchemy import Column, Integer, String, Boolean, DateTime, Date
|
||||
from sqlalchemy.orm import relationship
|
||||
from sqlalchemy.sql import func
|
||||
|
||||
from app.database import Base
|
||||
|
||||
|
||||
class User(Base):
|
||||
__tablename__ = "users"
|
||||
|
||||
id = Column(Integer, primary_key=True, index=True)
|
||||
username = Column(String(50), unique=True, index=True, nullable=False)
|
||||
email = Column(String(120), unique=True, index=True, nullable=False)
|
||||
hashed_password = Column(String(255), nullable=False)
|
||||
date_of_birth = Column(Date, nullable=True)
|
||||
is_active = Column(Boolean, default=True)
|
||||
created_at = Column(DateTime(timezone=True), server_default=func.now())
|
||||
updated_at = Column(DateTime(timezone=True), onupdate=func.now())
|
||||
|
||||
sessions = relationship("Session", back_populates="user", cascade="all, delete-orphan")
|
||||
refresh_tokens = relationship("RefreshToken", back_populates="user", cascade="all, delete-orphan")
|
||||
worlds = relationship("World", back_populates="owner")
|
||||
assets = relationship("Asset", back_populates="owner")
|
||||
|
||||
@property
|
||||
def is_adult(self) -> bool:
|
||||
"""Return True if the user is 18 or older based on date_of_birth."""
|
||||
if self.date_of_birth is None:
|
||||
return False
|
||||
today = date.today()
|
||||
age = today.year - self.date_of_birth.year
|
||||
# Adjust if birthday hasn't occurred yet this year
|
||||
if (today.month, today.day) < (self.date_of_birth.month, self.date_of_birth.day):
|
||||
age -= 1
|
||||
return age >= 18
|
||||
@@ -0,0 +1,36 @@
|
||||
from sqlalchemy import Column, Integer, String, Text, DateTime, ForeignKey
|
||||
from sqlalchemy.dialects.postgresql import ENUM
|
||||
from sqlalchemy.orm import relationship
|
||||
from sqlalchemy.sql import func
|
||||
import enum
|
||||
|
||||
from app.database import Base
|
||||
|
||||
|
||||
class WorldVisibility(enum.Enum):
|
||||
PUBLIC = "public"
|
||||
PRIVATE = "private"
|
||||
FRIENDS_ONLY = "friends_only"
|
||||
|
||||
|
||||
class World(Base):
|
||||
__tablename__ = "worlds"
|
||||
|
||||
id = Column(Integer, primary_key=True, index=True)
|
||||
name = Column(String(255), nullable=False)
|
||||
description = Column(Text, nullable=True)
|
||||
owner_id = Column(Integer, ForeignKey("users.id"), nullable=False)
|
||||
visibility = Column(
|
||||
ENUM(
|
||||
WorldVisibility,
|
||||
name="world_visibility",
|
||||
create_type=False,
|
||||
values_callable=lambda enum_cls: [e.value for e in enum_cls],
|
||||
),
|
||||
default=WorldVisibility.PUBLIC,
|
||||
)
|
||||
created_at = Column(DateTime(timezone=True), server_default=func.now())
|
||||
updated_at = Column(DateTime(timezone=True), onupdate=func.now())
|
||||
|
||||
owner = relationship("User", back_populates="worlds")
|
||||
assets = relationship("Asset", back_populates="world", cascade="all, delete-orphan")
|
||||
@@ -0,0 +1,243 @@
|
||||
"""Asset management router."""
|
||||
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
from typing import Optional
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException, UploadFile, File, Query
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.config import settings
|
||||
from app.database import get_db
|
||||
from app.dependencies import CurrentUser
|
||||
from app.models.asset import Asset, AssetType
|
||||
from app.models.world import World
|
||||
from app.services import gltf as gltf_service
|
||||
from pydantic import BaseModel, Field
|
||||
|
||||
router = APIRouter()
|
||||
|
||||
|
||||
# --- Pydantic schemas ---
|
||||
|
||||
class AssetCreate(BaseModel):
|
||||
"""Schema for creating an asset reference."""
|
||||
name: str = Field(..., min_length=1, max_length=255)
|
||||
description: Optional[str] = None
|
||||
asset_type: AssetType
|
||||
world_id: Optional[int] = None
|
||||
|
||||
|
||||
class AssetResponse(BaseModel):
|
||||
"""Schema for asset responses."""
|
||||
id: int
|
||||
name: str
|
||||
description: Optional[str]
|
||||
asset_type: AssetType
|
||||
file_path: str
|
||||
file_size: Optional[int]
|
||||
mime_type: Optional[str]
|
||||
world_id: Optional[int]
|
||||
owner_id: int
|
||||
is_public: bool
|
||||
created_at: str
|
||||
updated_at: str
|
||||
|
||||
model_config = {"from_attributes": True}
|
||||
|
||||
|
||||
class AssetUpdate(BaseModel):
|
||||
"""Schema for updating an asset."""
|
||||
name: Optional[str] = None
|
||||
description: Optional[str] = None
|
||||
is_public: Optional[bool] = None
|
||||
|
||||
|
||||
# --- Helpers ---
|
||||
|
||||
def _sanitize_filename(filename: str) -> str:
|
||||
"""Strip path components and unsafe characters from a filename."""
|
||||
# Remove any directory components (path traversal protection).
|
||||
base = os.path.basename(filename.replace("\\", "/"))
|
||||
# Keep only safe characters.
|
||||
safe = "".join(c for c in base if c.isalnum() or c in "._-")
|
||||
return safe or "file"
|
||||
|
||||
|
||||
def _detect_asset_type(filename: Optional[str], content: bytes) -> AssetType:
|
||||
"""Detect the asset type from filename and content."""
|
||||
if filename and gltf_service.looks_like_gltf(content, filename):
|
||||
return AssetType.MODEL_3D
|
||||
# Fallback: let the caller decide based on mime_type or default.
|
||||
return AssetType.OTHER
|
||||
|
||||
|
||||
# --- Endpoints ---
|
||||
|
||||
@router.post("/", response_model=AssetResponse, status_code=201)
|
||||
async def create_asset(
|
||||
payload: AssetCreate,
|
||||
current_user: CurrentUser,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Create a new asset reference."""
|
||||
# Verify world ownership if world_id is provided
|
||||
if payload.world_id is not None:
|
||||
world = await db.get(World, payload.world_id)
|
||||
if world is None:
|
||||
raise HTTPException(status_code=404, detail="World not found")
|
||||
if world.owner_id != current_user.id:
|
||||
raise HTTPException(status_code=403, detail="Not owner of this world")
|
||||
|
||||
asset = Asset(
|
||||
name=payload.name,
|
||||
description=payload.description,
|
||||
asset_type=payload.asset_type,
|
||||
file_path="", # Will be set after upload
|
||||
owner_id=current_user.id,
|
||||
world_id=payload.world_id,
|
||||
is_public=False,
|
||||
)
|
||||
db.add(asset)
|
||||
await db.commit()
|
||||
await db.refresh(asset)
|
||||
return asset
|
||||
|
||||
|
||||
@router.get("/", response_model=list[AssetResponse])
|
||||
async def list_assets(
|
||||
current_user: CurrentUser,
|
||||
world_id: Optional[int] = Query(None, description="Filter by world"),
|
||||
asset_type: Optional[AssetType] = Query(None),
|
||||
limit: int = Query(50, ge=1, le=100),
|
||||
offset: int = Query(0, ge=0),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""List assets with optional filters."""
|
||||
stmt = select(Asset).where(Asset.owner_id == current_user.id)
|
||||
|
||||
if world_id is not None:
|
||||
stmt = stmt.where(Asset.world_id == world_id)
|
||||
if asset_type is not None:
|
||||
stmt = stmt.where(Asset.asset_type == asset_type)
|
||||
|
||||
stmt = stmt.order_by(Asset.created_at.desc()).limit(limit).offset(offset)
|
||||
result = await db.execute(stmt)
|
||||
assets = result.scalars().all()
|
||||
return assets
|
||||
|
||||
|
||||
@router.get("/{asset_id}", response_model=AssetResponse)
|
||||
async def get_asset(
|
||||
asset_id: int,
|
||||
current_user: CurrentUser,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Get a single asset by ID."""
|
||||
asset = await db.get(Asset, asset_id)
|
||||
if asset is None or asset.owner_id != current_user.id:
|
||||
raise HTTPException(status_code=404, detail="Asset not found")
|
||||
return asset
|
||||
|
||||
|
||||
@router.patch("/{asset_id}", response_model=AssetResponse)
|
||||
async def update_asset(
|
||||
asset_id: int,
|
||||
payload: AssetUpdate,
|
||||
current_user: CurrentUser,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Update an asset."""
|
||||
asset = await db.get(Asset, asset_id)
|
||||
if asset is None or asset.owner_id != current_user.id:
|
||||
raise HTTPException(status_code=404, detail="Asset not found")
|
||||
|
||||
update_data = payload.model_dump(exclude_unset=True)
|
||||
for field, value in update_data.items():
|
||||
setattr(asset, field, value)
|
||||
|
||||
await db.commit()
|
||||
await db.refresh(asset)
|
||||
return asset
|
||||
|
||||
|
||||
@router.delete("/{asset_id}", status_code=204)
|
||||
async def delete_asset(
|
||||
asset_id: int,
|
||||
current_user: CurrentUser,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Delete an asset."""
|
||||
asset = await db.get(Asset, asset_id)
|
||||
if asset is None or asset.owner_id != current_user.id:
|
||||
raise HTTPException(status_code=404, detail="Asset not found")
|
||||
|
||||
await db.delete(asset)
|
||||
await db.commit()
|
||||
|
||||
|
||||
@router.post("/{asset_id}/upload", response_model=AssetResponse)
|
||||
async def upload_asset_file(
|
||||
asset_id: int,
|
||||
current_user: CurrentUser,
|
||||
file: UploadFile = File(...),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Upload a file for an existing asset."""
|
||||
asset = await db.get(Asset, asset_id)
|
||||
if asset is None or asset.owner_id != current_user.id:
|
||||
raise HTTPException(status_code=404, detail="Asset not found")
|
||||
|
||||
# Sanitize filename to prevent path traversal.
|
||||
safe_filename = _sanitize_filename(file.filename or f"asset_{asset_id}")
|
||||
|
||||
# Read the file content.
|
||||
content = await file.read()
|
||||
file_size = len(content)
|
||||
|
||||
# Determine which size limit to apply.
|
||||
if gltf_service.looks_like_gltf(content, file.filename):
|
||||
max_bytes = settings.GLTF_MAX_FILE_SIZE_MB * 1024 * 1024
|
||||
else:
|
||||
max_bytes = settings.MAX_UPLOAD_SIZE_MB * 1024 * 1024
|
||||
|
||||
if file_size > max_bytes:
|
||||
raise HTTPException(
|
||||
status_code=413,
|
||||
detail=f"File size {file_size} exceeds maximum allowed size {max_bytes} bytes",
|
||||
)
|
||||
|
||||
# Write the file to the upload directory.
|
||||
upload_dir = Path(settings.UPLOAD_DIR)
|
||||
upload_dir.mkdir(parents=True, exist_ok=True)
|
||||
stored_name = f"{asset_id}_{safe_filename}"
|
||||
file_path = upload_dir / stored_name
|
||||
file_path.write_bytes(content)
|
||||
|
||||
# Detect asset type from content/filename.
|
||||
detected_type = _detect_asset_type(file.filename, content)
|
||||
|
||||
# Update asset record.
|
||||
asset.file_path = str(file_path)
|
||||
asset.mime_type = file.content_type
|
||||
asset.file_size = file_size
|
||||
|
||||
# If this is a glTF file, extract and store metadata.
|
||||
if detected_type == AssetType.MODEL_3D:
|
||||
try:
|
||||
metadata = gltf_service.extract_gltf_metadata(content)
|
||||
asset.metadata_json = json.dumps(metadata)
|
||||
# Also set the asset type to model_3d if it was auto-detected.
|
||||
if asset.asset_type == AssetType.OTHER:
|
||||
asset.asset_type = AssetType.MODEL_3D
|
||||
except ValueError as exc:
|
||||
raise HTTPException(
|
||||
status_code=400,
|
||||
detail=f"Invalid glTF file: {exc}",
|
||||
)
|
||||
|
||||
await db.commit()
|
||||
await db.refresh(asset)
|
||||
return asset
|
||||
@@ -0,0 +1,311 @@
|
||||
"""Authentication router - login, register, token refresh."""
|
||||
|
||||
import uuid
|
||||
from datetime import date, datetime, timedelta, timezone
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException, status
|
||||
from fastapi.security import OAuth2PasswordRequestForm
|
||||
from jose import JWTError, jwt
|
||||
from passlib.context import CryptContext
|
||||
from pydantic import BaseModel, EmailStr
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.config import settings
|
||||
from app.database import get_db
|
||||
from app.dependencies import CurrentUser
|
||||
from app.models.session import RefreshToken
|
||||
from app.models.user import User
|
||||
|
||||
pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
|
||||
|
||||
router = APIRouter()
|
||||
|
||||
|
||||
# --- Pydantic schemas ---
|
||||
|
||||
class TokenResponse(BaseModel):
|
||||
access_token: str
|
||||
refresh_token: str
|
||||
token_type: str = "bearer"
|
||||
access_token_expires_minutes: int
|
||||
|
||||
|
||||
class RefreshRequest(BaseModel):
|
||||
refresh_token: str
|
||||
|
||||
|
||||
class RegisterRequest(BaseModel):
|
||||
username: str
|
||||
email: EmailStr
|
||||
password: str
|
||||
over_18: bool # Simple boolean confirmation instead of date_of_birth
|
||||
|
||||
|
||||
class UserResponse(BaseModel):
|
||||
id: int
|
||||
username: str
|
||||
email: str
|
||||
date_of_birth: str | None = None
|
||||
is_active: bool
|
||||
created_at: datetime | None = None
|
||||
|
||||
model_config = {"from_attributes": True}
|
||||
|
||||
|
||||
# --- Helpers ---
|
||||
|
||||
def _create_access_token(data: dict) -> str:
|
||||
"""Create a signed access token using RS256.
|
||||
|
||||
Includes a unique ``jti`` claim so that concurrent/same-second calls
|
||||
(e.g. back-to-back /refresh requests) still produce distinct tokens —
|
||||
without it, two tokens minted for the same user within the same
|
||||
second are byte-identical since ``sub``/``exp`` are the only claims.
|
||||
"""
|
||||
to_encode = data.copy()
|
||||
to_encode["jti"] = str(uuid.uuid4())
|
||||
expire = datetime.now(timezone.utc) + timedelta(
|
||||
minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES
|
||||
)
|
||||
to_encode.update({"exp": expire})
|
||||
return jwt.encode(
|
||||
to_encode,
|
||||
settings.private_pem,
|
||||
algorithm=settings.ALGORITHM,
|
||||
)
|
||||
|
||||
|
||||
def _create_refresh_token(data: dict) -> str:
|
||||
"""Create a signed refresh token using RS256.
|
||||
|
||||
Includes a unique ``jti`` claim so that concurrent calls produce
|
||||
distinct tokens even when issued within the same second.
|
||||
"""
|
||||
to_encode = data.copy()
|
||||
to_encode["jti"] = str(uuid.uuid4())
|
||||
expire = datetime.now(timezone.utc) + timedelta(
|
||||
days=settings.REFRESH_TOKEN_EXPIRE_DAYS
|
||||
)
|
||||
to_encode.update({"exp": expire})
|
||||
return jwt.encode(
|
||||
to_encode,
|
||||
settings.private_pem,
|
||||
algorithm=settings.ALGORITHM,
|
||||
)
|
||||
|
||||
|
||||
def verify_password(plain_password: str, hashed_password: str) -> bool:
|
||||
"""Verify a plain password against a hash."""
|
||||
return pwd_context.verify(plain_password, hashed_password)
|
||||
|
||||
|
||||
def hash_password(password: str) -> str:
|
||||
"""Hash a password."""
|
||||
return pwd_context.hash(password)
|
||||
|
||||
|
||||
def calculate_age(birth_date: date, today: date | None = None) -> int:
|
||||
"""Calculate age in years from a birth date.
|
||||
|
||||
Not called by /register anymore (that endpoint now just trusts the
|
||||
client's over_18 boolean, see RegisterRequest) -- kept as a real,
|
||||
tested utility since date-of-birth storage/verification is coming
|
||||
back in a future pass (real age math, not just a client-side claim,
|
||||
the user explicitly wants to revisit this design). Removing it broke
|
||||
backend/tests/test_auth_age_gate.py's collection entirely (ImportError
|
||||
on `from app.routers.auth import calculate_age`) for zero benefit --
|
||||
restoring it is the lower-risk path over rewriting or deleting 17
|
||||
tests for logic this codebase will need again.
|
||||
|
||||
Args:
|
||||
birth_date: The person's date of birth.
|
||||
today: The reference date. Defaults to today's date (UTC).
|
||||
|
||||
Returns:
|
||||
Age in whole years as of the reference date.
|
||||
"""
|
||||
if today is None:
|
||||
today = datetime.now(timezone.utc).date()
|
||||
|
||||
age = today.year - birth_date.year
|
||||
# Adjust if birthday hasn't occurred yet this year
|
||||
if (today.month, today.day) < (birth_date.month, birth_date.day):
|
||||
age -= 1
|
||||
return age
|
||||
|
||||
|
||||
def _issue_refresh_token(user_id: int, db: AsyncSession) -> str:
|
||||
"""Create and persist a refresh token for the given user."""
|
||||
refresh_token_value = _create_refresh_token({"sub": str(user_id)})
|
||||
refresh_token_record = RefreshToken(
|
||||
id=str(uuid.uuid4()),
|
||||
user_id=user_id,
|
||||
token=refresh_token_value,
|
||||
expires_at=datetime.now(timezone.utc)
|
||||
+ timedelta(days=settings.REFRESH_TOKEN_EXPIRE_DAYS),
|
||||
)
|
||||
db.add(refresh_token_record)
|
||||
return refresh_token_value
|
||||
|
||||
|
||||
# --- Endpoints ---
|
||||
|
||||
@router.post("/register", response_model=TokenResponse, status_code=status.HTTP_201_CREATED)
|
||||
async def register(req: RegisterRequest, db: AsyncSession = Depends(get_db)):
|
||||
"""Register a new user and return access + refresh tokens.
|
||||
|
||||
Requires over_18 boolean confirmation; rejects users who are not 18+.
|
||||
"""
|
||||
if not req.over_18:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_400_BAD_REQUEST,
|
||||
detail="Must be 18 or older to register",
|
||||
)
|
||||
|
||||
# Check if username already exists
|
||||
result = await db.execute(select(User).where(User.username == req.username))
|
||||
if result.scalar_one_or_none():
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_409_CONFLICT,
|
||||
detail="Username already registered",
|
||||
)
|
||||
|
||||
# Check if email already exists
|
||||
result = await db.execute(select(User).where(User.email == req.email))
|
||||
if result.scalar_one_or_none():
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_409_CONFLICT,
|
||||
detail="Email already registered",
|
||||
)
|
||||
|
||||
user = User(
|
||||
username=req.username,
|
||||
email=req.email,
|
||||
hashed_password=hash_password(req.password),
|
||||
date_of_birth=None, # No longer collecting DOB
|
||||
)
|
||||
db.add(user)
|
||||
await db.flush() # flush to get user.id before creating refresh token
|
||||
await db.refresh(user)
|
||||
|
||||
# Create access token
|
||||
access_token = _create_access_token({"sub": str(user.id)})
|
||||
|
||||
# Create and persist refresh token
|
||||
refresh_token_value = _issue_refresh_token(user.id, db)
|
||||
await db.commit()
|
||||
|
||||
return TokenResponse(
|
||||
access_token=access_token,
|
||||
refresh_token=refresh_token_value,
|
||||
access_token_expires_minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES,
|
||||
)
|
||||
|
||||
|
||||
@router.post("/login", response_model=TokenResponse)
|
||||
async def login(form: OAuth2PasswordRequestForm = Depends(), db: AsyncSession = Depends(get_db)):
|
||||
"""Authenticate user and return access + refresh tokens.
|
||||
|
||||
Accepts form-encoded credentials (username/password) as expected by
|
||||
OAuth2PasswordBearer, so the Swagger UI "Authorize" flow works correctly.
|
||||
"""
|
||||
result = await db.execute(select(User).where(User.username == form.username))
|
||||
user = result.scalar_one_or_none()
|
||||
|
||||
if not user or not verify_password(form.password, user.hashed_password):
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_401_UNAUTHORIZED,
|
||||
detail="Incorrect username or password",
|
||||
)
|
||||
|
||||
if not user.is_active:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_403_FORBIDDEN,
|
||||
detail="User account is inactive",
|
||||
)
|
||||
|
||||
# Create access token
|
||||
access_token = _create_access_token({"sub": str(user.id)})
|
||||
|
||||
# Create and persist refresh token
|
||||
refresh_token_value = _issue_refresh_token(user.id, db)
|
||||
await db.commit()
|
||||
|
||||
return TokenResponse(
|
||||
access_token=access_token,
|
||||
refresh_token=refresh_token_value,
|
||||
access_token_expires_minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES,
|
||||
)
|
||||
|
||||
|
||||
@router.post("/refresh", response_model=TokenResponse)
|
||||
async def refresh(req: RefreshRequest, db: AsyncSession = Depends(get_db)):
|
||||
"""Exchange a valid refresh token for a new access token.
|
||||
|
||||
Validates the refresh token against the database:
|
||||
- Must exist in the refresh_tokens table
|
||||
- Must not be expired (expires_at > now)
|
||||
- Must be active (is_active == true)
|
||||
|
||||
On success, returns a new access token. The refresh token itself is
|
||||
NOT rotated (the client keeps using the same refresh token).
|
||||
"""
|
||||
credentials_exception = HTTPException(
|
||||
status_code=status.HTTP_401_UNAUTHORIZED,
|
||||
detail="Invalid or expired refresh token",
|
||||
)
|
||||
|
||||
# Step 1: Decode and validate the JWT signature/claims
|
||||
try:
|
||||
payload = jwt.decode(
|
||||
req.refresh_token,
|
||||
settings.public_pem,
|
||||
algorithms=[settings.ALGORITHM],
|
||||
)
|
||||
except JWTError:
|
||||
raise credentials_exception
|
||||
|
||||
user_id_str: str | None = payload.get("sub")
|
||||
if user_id_str is None:
|
||||
raise credentials_exception
|
||||
|
||||
try:
|
||||
user_id = int(user_id_str)
|
||||
except (ValueError, TypeError):
|
||||
raise credentials_exception
|
||||
|
||||
# Step 2: Look up the refresh token in the database
|
||||
result = await db.execute(
|
||||
select(RefreshToken).where(
|
||||
RefreshToken.token == req.refresh_token,
|
||||
RefreshToken.user_id == user_id,
|
||||
)
|
||||
)
|
||||
stored_token = result.scalar_one_or_none()
|
||||
|
||||
if stored_token is None:
|
||||
raise credentials_exception
|
||||
|
||||
# Step 3: Check if the token is expired
|
||||
if datetime.now(timezone.utc) >= stored_token.expires_at:
|
||||
raise credentials_exception
|
||||
|
||||
# Step 4: Check if the token is active
|
||||
if not stored_token.is_active:
|
||||
raise credentials_exception
|
||||
|
||||
# Step 5: Issue a new access token
|
||||
access_token = _create_access_token({"sub": str(user_id)})
|
||||
|
||||
return TokenResponse(
|
||||
access_token=access_token,
|
||||
refresh_token=req.refresh_token, # Return the same refresh token
|
||||
access_token_expires_minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES,
|
||||
)
|
||||
|
||||
|
||||
@router.get("/me", response_model=UserResponse)
|
||||
async def get_current_user(current_user: CurrentUser):
|
||||
"""Get current user profile from the JWT token."""
|
||||
return current_user
|
||||
@@ -0,0 +1,106 @@
|
||||
"""User management router."""
|
||||
|
||||
from typing import Annotated
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException, status
|
||||
from pydantic import BaseModel, EmailStr
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.database import get_db
|
||||
from app.dependencies import CurrentUser
|
||||
from app.models.user import User
|
||||
|
||||
router = APIRouter()
|
||||
|
||||
|
||||
# ─── Pydantic schemas ────────────────────────────────────────────────────────
|
||||
|
||||
class UserResponse(BaseModel):
|
||||
id: int
|
||||
username: str
|
||||
email: str
|
||||
is_active: bool
|
||||
|
||||
model_config = {"from_attributes": True}
|
||||
|
||||
|
||||
class UserUpdate(BaseModel):
|
||||
email: EmailStr | None = None
|
||||
is_active: bool | None = None
|
||||
|
||||
|
||||
# ─── Endpoints ───────────────────────────────────────────────────────────────
|
||||
|
||||
@router.get("/me", response_model=UserResponse)
|
||||
async def get_current_user_profile(
|
||||
current_user: CurrentUser,
|
||||
):
|
||||
"""Get the currently authenticated user's profile."""
|
||||
return current_user
|
||||
|
||||
|
||||
@router.get("/{user_id}", response_model=UserResponse)
|
||||
async def get_user(
|
||||
user_id: int,
|
||||
current_user: CurrentUser,
|
||||
db: Annotated[AsyncSession, Depends(get_db)],
|
||||
):
|
||||
"""Get a user by ID. Only the owner can view their own profile."""
|
||||
result = await db.execute(select(User).where(User.id == user_id))
|
||||
user = result.scalar_one_or_none()
|
||||
if not user:
|
||||
raise HTTPException(status_code=404, detail="User not found")
|
||||
|
||||
# Only the owner may view their own profile.
|
||||
if user.id != current_user.id:
|
||||
raise HTTPException(status_code=403, detail="Not authorized to view this user")
|
||||
|
||||
return user
|
||||
|
||||
|
||||
@router.patch("/{user_id}", response_model=UserResponse)
|
||||
async def update_user(
|
||||
user_id: int,
|
||||
user_update: UserUpdate,
|
||||
current_user: CurrentUser,
|
||||
db: Annotated[AsyncSession, Depends(get_db)],
|
||||
):
|
||||
"""Update a user. Only the owner can update their own account."""
|
||||
result = await db.execute(select(User).where(User.id == user_id))
|
||||
user = result.scalar_one_or_none()
|
||||
if not user:
|
||||
raise HTTPException(status_code=404, detail="User not found")
|
||||
|
||||
# Only the owner may update their own account.
|
||||
if user.id != current_user.id:
|
||||
raise HTTPException(status_code=403, detail="Not authorized to update this user")
|
||||
|
||||
if user_update.email is not None:
|
||||
user.email = user_update.email
|
||||
if user_update.is_active is not None:
|
||||
user.is_active = user_update.is_active
|
||||
|
||||
await db.commit()
|
||||
await db.refresh(user)
|
||||
return user
|
||||
|
||||
|
||||
@router.delete("/{user_id}", status_code=status.HTTP_204_NO_CONTENT)
|
||||
async def delete_user(
|
||||
user_id: int,
|
||||
current_user: CurrentUser,
|
||||
db: Annotated[AsyncSession, Depends(get_db)],
|
||||
):
|
||||
"""Delete a user. Only the owner can delete their own account."""
|
||||
result = await db.execute(select(User).where(User.id == user_id))
|
||||
user = result.scalar_one_or_none()
|
||||
if not user:
|
||||
raise HTTPException(status_code=404, detail="User not found")
|
||||
|
||||
# Only the owner may delete their own account.
|
||||
if user.id != current_user.id:
|
||||
raise HTTPException(status_code=403, detail="Not authorized to delete this user")
|
||||
|
||||
await db.delete(user)
|
||||
await db.commit()
|
||||
@@ -0,0 +1,169 @@
|
||||
"""Worlds router - CRUD for game worlds."""
|
||||
|
||||
from datetime import datetime
|
||||
from typing import Annotated
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException, Query
|
||||
from pydantic import BaseModel, Field
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
from sqlalchemy.orm import selectinload
|
||||
|
||||
from app.database import get_db
|
||||
from app.dependencies import CurrentUser
|
||||
from app.models.world import World, WorldVisibility
|
||||
|
||||
router = APIRouter()
|
||||
|
||||
DbDep = Annotated[AsyncSession, Depends(get_db)]
|
||||
|
||||
|
||||
# --- Pydantic schemas ---
|
||||
|
||||
class WorldCreate(BaseModel):
|
||||
"""Schema for creating a world."""
|
||||
name: str = Field(..., min_length=1, max_length=255)
|
||||
description: str | None = None
|
||||
visibility: WorldVisibility = WorldVisibility.PUBLIC
|
||||
|
||||
|
||||
class WorldUpdate(BaseModel):
|
||||
"""Schema for updating a world."""
|
||||
name: str | None = Field(None, min_length=1, max_length=255)
|
||||
description: str | None = None
|
||||
visibility: WorldVisibility | None = None
|
||||
|
||||
|
||||
class WorldResponse(BaseModel):
|
||||
"""Schema for world responses."""
|
||||
id: int
|
||||
name: str
|
||||
description: str | None
|
||||
visibility: WorldVisibility
|
||||
owner_id: int
|
||||
created_at: datetime | None = None
|
||||
|
||||
model_config = {"from_attributes": True}
|
||||
|
||||
|
||||
# --- Endpoints ---
|
||||
|
||||
@router.get("/", response_model=list[WorldResponse])
|
||||
async def list_worlds(
|
||||
current_user: CurrentUser,
|
||||
db: DbDep,
|
||||
skip: int = Query(0, ge=0),
|
||||
limit: int = Query(50, ge=1, le=100),
|
||||
visibility: WorldVisibility | None = None,
|
||||
):
|
||||
"""List worlds visible to the current user.
|
||||
|
||||
PUBLIC worlds are visible to everyone.
|
||||
PRIVATE/FRIENDS_ONLY worlds are visible to their owner.
|
||||
"""
|
||||
query = select(World).options(selectinload(World.owner))
|
||||
|
||||
# Filter by visibility if specified
|
||||
if visibility:
|
||||
query = query.where(World.visibility == visibility)
|
||||
if visibility != WorldVisibility.PUBLIC:
|
||||
# Requesting a non-public visibility explicitly must not bypass
|
||||
# ownership — otherwise any authenticated user could list every
|
||||
# PRIVATE/FRIENDS_ONLY world in the system just by passing the
|
||||
# filter, defeating the point of the check below.
|
||||
query = query.where(World.owner_id == current_user.id)
|
||||
else:
|
||||
# Show PUBLIC worlds + owner's own worlds
|
||||
query = query.where(
|
||||
(World.visibility == WorldVisibility.PUBLIC)
|
||||
| (World.owner_id == current_user.id)
|
||||
)
|
||||
|
||||
query = query.offset(skip).limit(limit).order_by(World.created_at.desc())
|
||||
result = await db.execute(query)
|
||||
worlds = result.scalars().all()
|
||||
return worlds
|
||||
|
||||
|
||||
@router.get("/{world_id}", response_model=WorldResponse)
|
||||
async def get_world(
|
||||
world_id: int,
|
||||
current_user: CurrentUser,
|
||||
db: DbDep,
|
||||
):
|
||||
"""Get a single world by ID, respecting visibility."""
|
||||
result = await db.execute(
|
||||
select(World).where(World.id == world_id).options(selectinload(World.owner))
|
||||
)
|
||||
world = result.scalar_one_or_none()
|
||||
if not world:
|
||||
raise HTTPException(status_code=404, detail="World not found")
|
||||
|
||||
# Allow access if world is PUBLIC or owned by current user
|
||||
if world.visibility != WorldVisibility.PUBLIC and world.owner_id != current_user.id:
|
||||
raise HTTPException(status_code=404, detail="World not found")
|
||||
|
||||
return world
|
||||
|
||||
|
||||
@router.post("/", response_model=WorldResponse, status_code=201)
|
||||
async def create_world(
|
||||
world_data: WorldCreate,
|
||||
current_user: CurrentUser,
|
||||
db: DbDep,
|
||||
):
|
||||
"""Create a new world."""
|
||||
world = World(
|
||||
name=world_data.name,
|
||||
description=world_data.description,
|
||||
owner_id=current_user.id,
|
||||
visibility=world_data.visibility,
|
||||
)
|
||||
db.add(world)
|
||||
await db.commit()
|
||||
await db.refresh(world)
|
||||
return world
|
||||
|
||||
|
||||
@router.put("/{world_id}", response_model=WorldResponse)
|
||||
async def update_world(
|
||||
world_id: int,
|
||||
world_data: WorldUpdate,
|
||||
current_user: CurrentUser,
|
||||
db: DbDep,
|
||||
):
|
||||
"""Update an existing world."""
|
||||
result = await db.execute(select(World).where(World.id == world_id))
|
||||
world = result.scalar_one_or_none()
|
||||
if not world:
|
||||
raise HTTPException(status_code=404, detail="World not found")
|
||||
|
||||
if world.owner_id != current_user.id:
|
||||
raise HTTPException(status_code=403, detail="Not owner of this world")
|
||||
|
||||
update_data = world_data.model_dump(exclude_unset=True)
|
||||
for field, value in update_data.items():
|
||||
setattr(world, field, value)
|
||||
|
||||
await db.commit()
|
||||
await db.refresh(world)
|
||||
return world
|
||||
|
||||
|
||||
@router.delete("/{world_id}", status_code=204)
|
||||
async def delete_world(
|
||||
world_id: int,
|
||||
current_user: CurrentUser,
|
||||
db: DbDep,
|
||||
):
|
||||
"""Delete a world."""
|
||||
result = await db.execute(select(World).where(World.id == world_id))
|
||||
world = result.scalar_one_or_none()
|
||||
if not world:
|
||||
raise HTTPException(status_code=404, detail="World not found")
|
||||
|
||||
if world.owner_id != current_user.id:
|
||||
raise HTTPException(status_code=403, detail="Not owner of this world")
|
||||
|
||||
await db.delete(world)
|
||||
await db.commit()
|
||||
@@ -0,0 +1,197 @@
|
||||
"""Lightweight glTF / GLB metadata extraction.
|
||||
|
||||
This module intentionally avoids heavyweight dependencies such as trimesh or
|
||||
pygltflib. For the metadata fields the asset upload pipeline needs (mesh and
|
||||
vertex counts, animation presence, texture references, and the bounding box)
|
||||
a small amount of glTF-specific parsing is sufficient and keeps the backend
|
||||
dependency-free.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import json
|
||||
import struct
|
||||
from typing import Any, Optional
|
||||
|
||||
# GLB binary header magic bytes ("glTF").
|
||||
_GLB_MAGIC = b"glTF"
|
||||
_GLB_MAGIC_INT = 0x46546C67 # b"glTF" interpreted as little-endian uint32
|
||||
_GLB_JSON_CHUNK_TYPE = 0x4E4F534A # "JSON"
|
||||
_GLB_BIN_CHUNK_TYPE = 0x004E4942 # "BIN\0"
|
||||
|
||||
# Whitespace allowed around a GLB JSON chunk. The spec pads with spaces (0x20),
|
||||
# but be lenient with null bytes and other whitespace that real exporters emit.
|
||||
_JSON_CHUNK_TRIM = b" \t\r\n\x00"
|
||||
|
||||
|
||||
def looks_like_gltf(content: bytes, filename: Optional[str] = None) -> bool:
|
||||
"""Return True when the bytes or filename indicate a glTF/GLB asset."""
|
||||
if content.startswith(_GLB_MAGIC):
|
||||
return True
|
||||
|
||||
if filename:
|
||||
lowered = filename.lower()
|
||||
if lowered.endswith(".gltf") or lowered.endswith(".glb"):
|
||||
return True
|
||||
|
||||
# A bare JSON buffer (e.g. uploaded without an extension) that has the
|
||||
# glTF asset marker is also a glTF file.
|
||||
stripped = content.lstrip()
|
||||
if stripped.startswith(b"{"):
|
||||
try:
|
||||
payload = json.loads(stripped.decode("utf-8"))
|
||||
except (ValueError, UnicodeDecodeError):
|
||||
return False
|
||||
return isinstance(payload, dict) and "asset" in payload and "version" in payload.get("asset", {})
|
||||
|
||||
return False
|
||||
|
||||
|
||||
def _parse_glb(content: bytes) -> dict[str, Any]:
|
||||
"""Parse the JSON chunk of a GLB binary container."""
|
||||
if len(content) < 12:
|
||||
raise ValueError("GLB file is too short")
|
||||
|
||||
magic, _version, _length = struct.unpack_from("<III", content, 0)
|
||||
if magic != _GLB_MAGIC_INT:
|
||||
raise ValueError("invalid GLB magic")
|
||||
|
||||
offset = 12
|
||||
json_chunk: Optional[dict[str, Any]] = None
|
||||
|
||||
while offset + 8 <= len(content):
|
||||
chunk_length, chunk_type = struct.unpack_from("<II", content, offset)
|
||||
offset += 8
|
||||
chunk_end = offset + chunk_length
|
||||
if chunk_end > len(content):
|
||||
raise ValueError("GLB chunk overruns file boundary")
|
||||
|
||||
chunk_data = content[offset:chunk_end]
|
||||
if chunk_type == _GLB_JSON_CHUNK_TYPE:
|
||||
try:
|
||||
json_chunk = json.loads(chunk_data.strip(_JSON_CHUNK_TRIM).decode("utf-8"))
|
||||
except (ValueError, UnicodeDecodeError) as exc:
|
||||
raise ValueError(f"invalid GLB JSON chunk: {exc}") from exc
|
||||
|
||||
offset = chunk_end
|
||||
|
||||
if json_chunk is None:
|
||||
raise ValueError("GLB file does not contain a JSON chunk")
|
||||
|
||||
return json_chunk
|
||||
|
||||
|
||||
def _parse_gltf_json(content: bytes) -> dict[str, Any]:
|
||||
"""Parse a plain .gltf JSON file."""
|
||||
stripped = content.lstrip()
|
||||
try:
|
||||
payload = json.loads(stripped.decode("utf-8"))
|
||||
except (ValueError, UnicodeDecodeError) as exc:
|
||||
raise ValueError(f"invalid glTF JSON: {exc}") from exc
|
||||
|
||||
if not isinstance(payload, dict):
|
||||
raise ValueError("glTF JSON root must be an object")
|
||||
return payload
|
||||
|
||||
|
||||
def _position_accessor_counts(gltf: dict[str, Any]) -> list[int]:
|
||||
"""Return POSITION accessor counts for every mesh primitive."""
|
||||
counts: list[int] = []
|
||||
accessors = gltf.get("accessors", [])
|
||||
for mesh in gltf.get("meshes", []):
|
||||
for primitive in mesh.get("primitives", []):
|
||||
attributes = primitive.get("attributes", {})
|
||||
position_index = attributes.get("POSITION")
|
||||
if position_index is None:
|
||||
continue
|
||||
try:
|
||||
accessor = accessors[int(position_index)]
|
||||
except (IndexError, TypeError, ValueError):
|
||||
continue
|
||||
count = accessor.get("count")
|
||||
if isinstance(count, int):
|
||||
counts.append(count)
|
||||
return counts
|
||||
|
||||
|
||||
def _position_bounds(gltf: dict[str, Any]) -> list[list[float]]:
|
||||
"""Return min/max bounds for every POSITION accessor that declares them."""
|
||||
bounds: list[list[float]] = []
|
||||
accessors = gltf.get("accessors", [])
|
||||
for mesh in gltf.get("meshes", []):
|
||||
for primitive in mesh.get("primitives", []):
|
||||
attributes = primitive.get("attributes", {})
|
||||
position_index = attributes.get("POSITION")
|
||||
if position_index is None:
|
||||
continue
|
||||
try:
|
||||
accessor = accessors[int(position_index)]
|
||||
except (IndexError, TypeError, ValueError):
|
||||
continue
|
||||
minimum = accessor.get("min")
|
||||
maximum = accessor.get("max")
|
||||
if isinstance(minimum, list) and isinstance(maximum, list):
|
||||
bounds.append([float(x) for x in minimum])
|
||||
bounds.append([float(x) for x in maximum])
|
||||
return bounds
|
||||
|
||||
|
||||
def _texture_refs(gltf: dict[str, Any]) -> list[str]:
|
||||
"""Collect external texture source references from the image array."""
|
||||
refs: list[str] = []
|
||||
for index, image in enumerate(gltf.get("images", [])):
|
||||
uri = image.get("uri")
|
||||
if isinstance(uri, str) and not uri.startswith("data:"):
|
||||
refs.append(uri)
|
||||
continue
|
||||
|
||||
name = image.get("name")
|
||||
if isinstance(name, str) and name:
|
||||
refs.append(name)
|
||||
continue
|
||||
|
||||
if isinstance(uri, str):
|
||||
# Embedded data URI; keep a stable, non-huge reference.
|
||||
refs.append(f"data:{index}")
|
||||
continue
|
||||
|
||||
buffer_view = image.get("bufferView")
|
||||
if buffer_view is not None:
|
||||
refs.append(f"bufferView:{buffer_view}")
|
||||
continue
|
||||
|
||||
refs.append(f"image:{index}")
|
||||
|
||||
return refs
|
||||
|
||||
|
||||
def extract_gltf_metadata(content: bytes) -> dict[str, Any]:
|
||||
"""Extract upload-relevant metadata from glTF/GLB bytes.
|
||||
|
||||
Raises ValueError for malformed glTF content. The returned dict contains:
|
||||
mesh_count, vertex_count, has_animation, texture_refs,
|
||||
bounding_box_min, bounding_box_max.
|
||||
"""
|
||||
if content.startswith(_GLB_MAGIC):
|
||||
gltf = _parse_glb(content)
|
||||
else:
|
||||
gltf = _parse_gltf_json(content)
|
||||
|
||||
position_counts = _position_accessor_counts(gltf)
|
||||
bounds = _position_bounds(gltf)
|
||||
|
||||
if bounds:
|
||||
bounding_box_min = [min(axis) for axis in zip(*bounds[::2])]
|
||||
bounding_box_max = [max(axis) for axis in zip(*bounds[1::2])]
|
||||
else:
|
||||
bounding_box_min = [0.0, 0.0, 0.0]
|
||||
bounding_box_max = [0.0, 0.0, 0.0]
|
||||
|
||||
return {
|
||||
"mesh_count": len(gltf.get("meshes", [])),
|
||||
"vertex_count": sum(position_counts),
|
||||
"has_animation": bool(gltf.get("animations")),
|
||||
"texture_refs": _texture_refs(gltf),
|
||||
"bounding_box_min": bounding_box_min,
|
||||
"bounding_box_max": bounding_box_max,
|
||||
}
|
||||
@@ -0,0 +1,34 @@
|
||||
version: "3.9"
|
||||
|
||||
services:
|
||||
postgres:
|
||||
image: postgres:16-alpine
|
||||
environment:
|
||||
POSTGRES_USER: agp_user
|
||||
POSTGRES_PASSWORD: agp_password
|
||||
POSTGRES_DB: agp_db
|
||||
ports:
|
||||
- "${POSTGRES_HOST_PORT:-5432}:5432"
|
||||
volumes:
|
||||
- postgres_data:/var/lib/postgresql/data
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -U agp_user -d agp_db"]
|
||||
interval: 5s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
|
||||
redis:
|
||||
image: redis:7-alpine
|
||||
ports:
|
||||
- "${REDIS_HOST_PORT:-6379}:6379"
|
||||
volumes:
|
||||
- redis_data:/data
|
||||
healthcheck:
|
||||
test: ["CMD", "redis-cli", "ping"]
|
||||
interval: 5s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
|
||||
volumes:
|
||||
postgres_data:
|
||||
redis_data:
|
||||
@@ -0,0 +1,3 @@
|
||||
[pytest]
|
||||
asyncio_mode = auto
|
||||
testpaths = tests
|
||||
@@ -0,0 +1,25 @@
|
||||
fastapi==0.115.6
|
||||
uvicorn[standard]==0.34.0
|
||||
sqlalchemy==2.0.36
|
||||
alembic==1.14.0
|
||||
psycopg2-binary==2.9.10
|
||||
asyncpg==0.31.0
|
||||
redis==5.2.1
|
||||
pydantic==2.10.3
|
||||
pydantic-settings==2.7.0
|
||||
python-jose[cryptography]==3.3.0
|
||||
passlib[bcrypt]==1.7.4
|
||||
# passlib 1.7.4 (last release, unmaintained since ~2020) detects its bcrypt
|
||||
# backend via bcrypt.__about__.__version__, which bcrypt>=4.1 removed --
|
||||
# hashing/verifying a password then raises "password cannot be longer than
|
||||
# 72 bytes" (a misleading downstream symptom of the real AttributeError:
|
||||
# module 'bcrypt' has no attribute '__about__') on every call. Without this
|
||||
# pin, `pip install -r requirements.txt` silently grabs whatever the latest
|
||||
# bcrypt is and breaks register/login outright. Pin below 4.1 explicitly.
|
||||
bcrypt==4.0.1
|
||||
python-multipart==0.0.20
|
||||
email-validator==2.2.0
|
||||
httpx==0.28.1
|
||||
pytest==8.3.4
|
||||
pytest-asyncio==0.25.0
|
||||
pytest-cov==6.0.0
|
||||
@@ -0,0 +1,38 @@
|
||||
"""Shared pytest fixtures.
|
||||
|
||||
The auth integration tests hit the *real* Postgres database (per
|
||||
``DATABASE_URL``), so they persist data between runs. Without cleanup a
|
||||
second run of the suite fails with 409 conflicts because the users it
|
||||
registered on the first run already exist. The session-scoped fixture below
|
||||
truncates all application tables once before the first test, making the suite
|
||||
re-runnable.
|
||||
|
||||
Truncation order doesn't strictly matter because ``CASCADE`` follows foreign
|
||||
keys, but the tables are listed explicitly for clarity.
|
||||
"""
|
||||
|
||||
import asyncio
|
||||
|
||||
import pytest
|
||||
from sqlalchemy import text
|
||||
from sqlalchemy.ext.asyncio import create_async_engine
|
||||
|
||||
from app.config import settings
|
||||
|
||||
TEST_TABLES = ("assets", "worlds", "sessions", "refresh_tokens", "users")
|
||||
|
||||
|
||||
@pytest.fixture(scope="session", autouse=True)
|
||||
def _reset_database():
|
||||
"""Truncate all application tables once per test session."""
|
||||
|
||||
async def _truncate() -> None:
|
||||
engine = create_async_engine(settings.DATABASE_URL)
|
||||
async with engine.begin() as conn:
|
||||
await conn.execute(
|
||||
text(f"TRUNCATE TABLE {', '.join(TEST_TABLES)} CASCADE")
|
||||
)
|
||||
await engine.dispose()
|
||||
|
||||
asyncio.run(_truncate())
|
||||
yield
|
||||
@@ -0,0 +1,94 @@
|
||||
"""Tests for the 18+ age gate on user registration."""
|
||||
|
||||
from datetime import date, timedelta
|
||||
|
||||
import pytest
|
||||
|
||||
from app.routers.auth import calculate_age
|
||||
|
||||
|
||||
class TestCalculateAge:
|
||||
"""Unit tests for the calculate_age helper."""
|
||||
|
||||
def test_exactly_18(self):
|
||||
"""A person born exactly 18 years ago today is 18."""
|
||||
today = date(2025, 6, 15)
|
||||
dob = today.replace(year=today.year - 18)
|
||||
assert calculate_age(dob, today=today) == 18
|
||||
|
||||
def test_just_turned_18(self):
|
||||
"""A person who turned 18 yesterday is 18."""
|
||||
today = date(2025, 6, 15)
|
||||
dob = today.replace(year=today.year - 18) - timedelta(days=1)
|
||||
assert calculate_age(dob, today=today) == 18
|
||||
|
||||
def test_one_day_short_of_18(self):
|
||||
"""A person born one day after their 18th birthday is 17."""
|
||||
today = date(2025, 6, 15)
|
||||
dob = today.replace(year=today.year - 18) + timedelta(days=1)
|
||||
assert calculate_age(dob, today=today) == 17
|
||||
|
||||
def test_17_years_old(self):
|
||||
"""A person who is 17 years old today is 17."""
|
||||
today = date(2025, 6, 15)
|
||||
dob = date(2008, 6, 15)
|
||||
assert calculate_age(dob, today=today) == 17
|
||||
|
||||
def test_65_years_old(self):
|
||||
"""A person who is 65 is correctly calculated."""
|
||||
today = date(2025, 6, 15)
|
||||
dob = today.replace(year=today.year - 65)
|
||||
assert calculate_age(dob, today=today) == 65
|
||||
|
||||
def test_newborn(self):
|
||||
"""A newborn is 0."""
|
||||
today = date(2025, 6, 15)
|
||||
dob = today
|
||||
assert calculate_age(dob, today=today) == 0
|
||||
|
||||
def test_birthday_not_yet_this_year(self):
|
||||
"""Person born Dec 31, 2000 — on Jan 1, 2025 they are still 24."""
|
||||
dob = date(2000, 12, 31)
|
||||
assert calculate_age(dob, today=date(2025, 1, 1)) == 24
|
||||
|
||||
def test_birthday_today(self):
|
||||
"""Person born Dec 31, 2000 — on Dec 31, 2024 they turn 24."""
|
||||
dob = date(2000, 12, 31)
|
||||
assert calculate_age(dob, today=date(2024, 12, 31)) == 24
|
||||
|
||||
|
||||
class TestRegisterRequestOver18Field:
|
||||
"""Tests for RegisterRequest's over_18 field.
|
||||
|
||||
Replaces TestRegisterRequestDateValidation -- date_of_birth and its
|
||||
field_validator were removed from RegisterRequest 2026-08-20 (interim
|
||||
simplification: a plain client-side over_18 confirmation instead of
|
||||
collecting/validating an actual date of birth; see calculate_age's
|
||||
own docstring in app/routers/auth.py for why that function is still
|
||||
here even though this endpoint no longer calls it). There's no date
|
||||
format left to validate, so the equivalent coverage is just: the
|
||||
field exists, is a real bool, and is required."""
|
||||
|
||||
def test_over_18_true_accepted(self):
|
||||
from app.routers.auth import RegisterRequest
|
||||
|
||||
req = RegisterRequest(username="u", email="u@example.com", password="p", over_18=True)
|
||||
assert req.over_18 is True
|
||||
|
||||
def test_over_18_false_accepted(self):
|
||||
"""False is a valid value at the schema level -- the endpoint,
|
||||
not the schema, is what rejects it (see
|
||||
TestRegister::test_register_rejects_not_over_18 in
|
||||
test_auth_endpoints.py)."""
|
||||
from app.routers.auth import RegisterRequest
|
||||
|
||||
req = RegisterRequest(username="u", email="u@example.com", password="p", over_18=False)
|
||||
assert req.over_18 is False
|
||||
|
||||
def test_over_18_missing_rejected(self):
|
||||
"""over_18 has no default -- omitting it entirely is a validation error."""
|
||||
from app.routers.auth import RegisterRequest
|
||||
from pydantic import ValidationError
|
||||
|
||||
with pytest.raises(ValidationError):
|
||||
RegisterRequest(username="u", email="u@example.com", password="p")
|
||||
@@ -0,0 +1,259 @@
|
||||
"""Integration tests for the auth endpoints (register + login).
|
||||
|
||||
These tests hit the real FastAPI app against the real configured database
|
||||
(DATABASE_URL -- Postgres via Alembic migrations in CI/dev, not an isolated
|
||||
in-memory DB), so they exercise the full stack: Pydantic validation → DB →
|
||||
JWT → response. Requires migrations already applied (alembic upgrade head)
|
||||
before running.
|
||||
"""
|
||||
|
||||
import pytest
|
||||
from fastapi.testclient import TestClient
|
||||
from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
|
||||
from sqlalchemy.pool import NullPool
|
||||
|
||||
from app.config import settings
|
||||
from app.main import app
|
||||
from app.database import get_db
|
||||
from app.routers.auth import pwd_context
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Test fixtures
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
@pytest.fixture(autouse=True)
|
||||
def _override_db():
|
||||
"""Override get_db so the app uses a fresh session per test.
|
||||
|
||||
Deliberately does NOT reuse app.database's shared engine: FastAPI's
|
||||
(sync) TestClient runs each request through anyio's blocking-portal
|
||||
machinery, which can hand different requests different event loops.
|
||||
asyncpg connections are bound to the loop they were created on, so
|
||||
reusing one from the shared engine's connection pool across requests
|
||||
raises "cannot perform operation: another operation is in progress" the
|
||||
moment a test makes more than one request (register-then-login,
|
||||
register-twice, etc.) -- confirmed this is the actual cause, not a bug
|
||||
in the endpoints themselves. NullPool sidesteps it: every checkout is a
|
||||
brand-new connection, never handed to a different loop than the one
|
||||
that opened it.
|
||||
"""
|
||||
test_engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
|
||||
test_session_factory = async_sessionmaker(test_engine, expire_on_commit=False)
|
||||
|
||||
async def _get_db():
|
||||
async_session = test_session_factory()
|
||||
try:
|
||||
yield async_session
|
||||
await async_session.commit()
|
||||
except Exception:
|
||||
await async_session.rollback()
|
||||
raise
|
||||
finally:
|
||||
await async_session.close()
|
||||
|
||||
app.dependency_overrides[get_db] = _get_db
|
||||
yield
|
||||
app.dependency_overrides.clear()
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Register endpoint
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
class TestRegister:
|
||||
"""Tests for POST /api/auth/register."""
|
||||
|
||||
def test_register_success(self):
|
||||
"""A valid registration returns 201 with a token."""
|
||||
client = TestClient(app)
|
||||
resp = client.post(
|
||||
"/api/auth/register",
|
||||
json={
|
||||
"username": "newuser",
|
||||
"email": "new@example.com",
|
||||
"password": "secret123",
|
||||
"over_18": True,
|
||||
},
|
||||
)
|
||||
assert resp.status_code == 201
|
||||
data = resp.json()
|
||||
assert "access_token" in data
|
||||
assert data["token_type"] == "bearer"
|
||||
|
||||
def test_register_rejects_not_over_18(self):
|
||||
"""over_18=false gets a 400 with a detail message.
|
||||
|
||||
The interim design (2026-08-20) trusts a client-side boolean
|
||||
confirmation instead of collecting/validating an actual date of
|
||||
birth -- this only checks that the flag is respected, not real
|
||||
age math (there's no date to verify against anymore). Real DOB
|
||||
collection/verification may come back in a future pass."""
|
||||
client = TestClient(app)
|
||||
resp = client.post(
|
||||
"/api/auth/register",
|
||||
json={
|
||||
"username": "kid",
|
||||
"email": "kid@example.com",
|
||||
"password": "secret123",
|
||||
"over_18": False,
|
||||
},
|
||||
)
|
||||
assert resp.status_code == 400
|
||||
assert "18 or older" in resp.json()["detail"]
|
||||
|
||||
def test_register_rejects_duplicate_username(self):
|
||||
"""Registering the same username twice returns 409."""
|
||||
client = TestClient(app)
|
||||
# First registration
|
||||
client.post(
|
||||
"/api/auth/register",
|
||||
json={
|
||||
"username": "duplicate",
|
||||
"email": "dup1@example.com",
|
||||
"password": "secret123",
|
||||
"over_18": True,
|
||||
},
|
||||
)
|
||||
# Second registration with same username, different email
|
||||
resp = client.post(
|
||||
"/api/auth/register",
|
||||
json={
|
||||
"username": "duplicate",
|
||||
"email": "dup2@example.com",
|
||||
"password": "secret123",
|
||||
"over_18": True,
|
||||
},
|
||||
)
|
||||
assert resp.status_code == 409
|
||||
assert "Username already registered" in resp.json()["detail"]
|
||||
|
||||
def test_register_rejects_duplicate_email(self):
|
||||
"""Registering the same email twice returns 409."""
|
||||
client = TestClient(app)
|
||||
client.post(
|
||||
"/api/auth/register",
|
||||
json={
|
||||
"username": "user1",
|
||||
"email": "same@example.com",
|
||||
"password": "secret123",
|
||||
"over_18": True,
|
||||
},
|
||||
)
|
||||
resp = client.post(
|
||||
"/api/auth/register",
|
||||
json={
|
||||
"username": "user2",
|
||||
"email": "same@example.com",
|
||||
"password": "secret123",
|
||||
"over_18": True,
|
||||
},
|
||||
)
|
||||
assert resp.status_code == 409
|
||||
assert "Email already registered" in resp.json()["detail"]
|
||||
|
||||
def test_register_missing_over_18(self):
|
||||
"""Missing the required over_18 field returns 422.
|
||||
|
||||
Replaces the old test_register_invalid_date_format -- there's no
|
||||
date format to get wrong anymore (no date field at all), so the
|
||||
closest equivalent "malformed request" case is the required
|
||||
over_18 boolean being absent entirely."""
|
||||
client = TestClient(app)
|
||||
resp = client.post(
|
||||
"/api/auth/register",
|
||||
json={
|
||||
"username": "user",
|
||||
"email": "user@example.com",
|
||||
"password": "secret123",
|
||||
},
|
||||
)
|
||||
assert resp.status_code == 422
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Login endpoint
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
class TestLogin:
|
||||
"""Tests for POST /api/auth/login."""
|
||||
|
||||
def _create_user(self, username: str, password: str, email: str = None):
|
||||
"""Helper to create a user via register."""
|
||||
client = TestClient(app)
|
||||
if email is None:
|
||||
email = f"{username}@example.com"
|
||||
resp = client.post(
|
||||
"/api/auth/register",
|
||||
json={
|
||||
"username": username,
|
||||
"email": email,
|
||||
"password": password,
|
||||
"over_18": True,
|
||||
},
|
||||
)
|
||||
assert resp.status_code == 201
|
||||
return resp.json()["access_token"]
|
||||
|
||||
def test_login_success(self):
|
||||
"""Correct credentials return a token."""
|
||||
self._create_user("loginuser", "correctpass")
|
||||
client = TestClient(app)
|
||||
resp = client.post(
|
||||
"/api/auth/login",
|
||||
data={"username": "loginuser", "password": "correctpass"},
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
data = resp.json()
|
||||
assert "access_token" in data
|
||||
assert data["token_type"] == "bearer"
|
||||
|
||||
def test_login_wrong_password(self):
|
||||
"""Wrong password returns 401."""
|
||||
# Distinct username from test_login_success -- there's no per-test
|
||||
# DB rollback/isolation here (real Postgres via the app's own
|
||||
# dependency-overridden session), so reusing "loginuser" collided
|
||||
# with the user that test already created (409 on register instead
|
||||
# of the intended 401-on-login assertion this test is actually for).
|
||||
self._create_user("loginuser_wrongpass", "correctpass")
|
||||
client = TestClient(app)
|
||||
resp = client.post(
|
||||
"/api/auth/login",
|
||||
data={"username": "loginuser_wrongpass", "password": "wrongpass"},
|
||||
)
|
||||
assert resp.status_code == 401
|
||||
assert "Incorrect username or password" in resp.json()["detail"]
|
||||
|
||||
def test_login_nonexistent_user(self):
|
||||
"""Non-existent user returns 401 (not 404)."""
|
||||
client = TestClient(app)
|
||||
resp = client.post(
|
||||
"/api/auth/login",
|
||||
data={"username": "nobody", "password": "any"},
|
||||
)
|
||||
assert resp.status_code == 401
|
||||
assert "Incorrect username or password" in resp.json()["detail"]
|
||||
|
||||
def test_login_accepts_form_encoded(self):
|
||||
"""Login accepts application/x-www-form-urlencoded (OAuth2)."""
|
||||
self._create_user("formuser", "formpass")
|
||||
client = TestClient(app)
|
||||
resp = client.post(
|
||||
"/api/auth/login",
|
||||
data={"username": "formuser", "password": "formpass"},
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
assert "access_token" in resp.json()
|
||||
|
||||
def test_login_token_is_valid_jwt(self):
|
||||
"""The returned token is a valid JWT that can be decoded."""
|
||||
self._create_user("jwttoken", "jwt123")
|
||||
client = TestClient(app)
|
||||
resp = client.post(
|
||||
"/api/auth/login",
|
||||
data={"username": "jwttoken", "password": "jwt123"},
|
||||
)
|
||||
token = resp.json()["access_token"]
|
||||
# Verify it's a 3-part JWT
|
||||
parts = token.split(".")
|
||||
assert len(parts) == 3
|
||||
@@ -0,0 +1,171 @@
|
||||
"""Tests for expired-token rejection across auth endpoints.
|
||||
|
||||
Covers two distinct expiry paths:
|
||||
|
||||
1. An *access* JWT whose ``exp`` claim is in the past must be rejected
|
||||
with 401 by ``GET /api/auth/me`` (jose's built-in ``exp`` validation).
|
||||
2. A *refresh* token whose persisted ``expires_at`` is in the past must be
|
||||
rejected with 401 by ``POST /api/auth/refresh`` even though its JWT
|
||||
signature is still valid.
|
||||
|
||||
Requires migrations already applied (alembic upgrade head) before running.
|
||||
"""
|
||||
|
||||
import asyncio
|
||||
from datetime import datetime, timedelta, timezone
|
||||
|
||||
import pytest
|
||||
from fastapi.testclient import TestClient
|
||||
from jose import jwt
|
||||
from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
|
||||
from sqlalchemy.pool import NullPool
|
||||
|
||||
from app.config import settings
|
||||
from app.main import app
|
||||
from app.database import get_db
|
||||
from app.models.session import RefreshToken
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Test fixtures
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
@pytest.fixture(autouse=True)
|
||||
def _override_db():
|
||||
"""Override get_db so the app uses a fresh session per test."""
|
||||
test_engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
|
||||
test_session_factory = async_sessionmaker(test_engine, expire_on_commit=False)
|
||||
|
||||
async def _get_db():
|
||||
async_session = test_session_factory()
|
||||
try:
|
||||
yield async_session
|
||||
await async_session.commit()
|
||||
except Exception:
|
||||
await async_session.rollback()
|
||||
raise
|
||||
finally:
|
||||
await async_session.close()
|
||||
|
||||
app.dependency_overrides[get_db] = _get_db
|
||||
yield
|
||||
app.dependency_overrides.clear()
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Helpers
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
def _mint_access_token(exp: datetime) -> str:
|
||||
"""Mint an RS256 access token with an explicit ``exp`` claim."""
|
||||
return jwt.encode(
|
||||
{"sub": "1", "exp": exp},
|
||||
settings.private_pem,
|
||||
algorithm=settings.ALGORITHM,
|
||||
)
|
||||
|
||||
|
||||
def _expire_refresh_token_in_db(token: str) -> None:
|
||||
"""Set the persisted refresh token's ``expires_at`` into the past."""
|
||||
|
||||
async def _do():
|
||||
engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
|
||||
session_factory = async_sessionmaker(engine, expire_on_commit=False)
|
||||
async with session_factory() as session:
|
||||
from sqlalchemy import update
|
||||
|
||||
await session.execute(
|
||||
update(RefreshToken)
|
||||
.where(RefreshToken.token == token)
|
||||
.values(expires_at=datetime.now(timezone.utc) - timedelta(hours=1))
|
||||
)
|
||||
await session.commit()
|
||||
await engine.dispose()
|
||||
|
||||
asyncio.run(_do())
|
||||
|
||||
|
||||
def _register_user(client: TestClient, username: str) -> str:
|
||||
"""Register a user and return its refresh token."""
|
||||
resp = client.post(
|
||||
"/api/auth/register",
|
||||
json={
|
||||
"username": username,
|
||||
"email": f"{username}@example.com",
|
||||
"password": "secret123",
|
||||
"over_18": True,
|
||||
},
|
||||
)
|
||||
assert resp.status_code == 201
|
||||
return resp.json()["refresh_token"]
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Expired access token (GET /api/auth/me)
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
class TestExpiredAccessToken:
|
||||
def test_expired_access_token_is_rejected_by_me(self):
|
||||
"""An access JWT with a past exp claim returns 401 on /me."""
|
||||
client = TestClient(app)
|
||||
expired_token = _mint_access_token(
|
||||
datetime.now(timezone.utc) - timedelta(minutes=5)
|
||||
)
|
||||
resp = client.get(
|
||||
"/api/auth/me",
|
||||
headers={"Authorization": f"Bearer {expired_token}"},
|
||||
)
|
||||
assert resp.status_code == 401
|
||||
assert "Could not validate credentials" in resp.json()["detail"]
|
||||
|
||||
def test_garbage_access_token_is_rejected_by_me(self):
|
||||
"""A non-JWT bearer token returns 401 on /me."""
|
||||
client = TestClient(app)
|
||||
resp = client.get(
|
||||
"/api/auth/me",
|
||||
headers={"Authorization": "Bearer not-a-real-jwt"},
|
||||
)
|
||||
assert resp.status_code == 401
|
||||
|
||||
def test_missing_bearer_token_returns_401(self):
|
||||
"""No Authorization header at all returns 401 on /me."""
|
||||
client = TestClient(app)
|
||||
resp = client.get("/api/auth/me")
|
||||
assert resp.status_code == 401
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Expired refresh token (POST /api/auth/refresh)
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
class TestExpiredRefreshToken:
|
||||
def test_expired_refresh_token_is_rejected(self):
|
||||
"""A refresh token whose DB expires_at is in the past returns 401."""
|
||||
client = TestClient(app)
|
||||
refresh_token = _register_user(client, "expired_rt_user")
|
||||
|
||||
# Force the persisted record to be expired while its JWT signature
|
||||
# is still valid.
|
||||
_expire_refresh_token_in_db(refresh_token)
|
||||
|
||||
resp = client.post(
|
||||
"/api/auth/refresh",
|
||||
json={"refresh_token": refresh_token},
|
||||
)
|
||||
assert resp.status_code == 401
|
||||
assert "Invalid or expired refresh token" in resp.json()["detail"]
|
||||
|
||||
def test_expired_refresh_token_jwt_is_rejected(self):
|
||||
"""A refresh JWT with a past exp claim is rejected before DB lookup."""
|
||||
client = TestClient(app)
|
||||
expired_jwt = jwt.encode(
|
||||
{"sub": "1", "exp": datetime.now(timezone.utc) - timedelta(minutes=5)},
|
||||
settings.private_pem,
|
||||
algorithm=settings.ALGORITHM,
|
||||
)
|
||||
resp = client.post(
|
||||
"/api/auth/refresh",
|
||||
json={"refresh_token": expired_jwt},
|
||||
)
|
||||
assert resp.status_code == 401
|
||||
assert "Invalid or expired refresh token" in resp.json()["detail"]
|
||||
@@ -0,0 +1,220 @@
|
||||
"""Tests for the lightweight glTF metadata extraction service."""
|
||||
|
||||
import json
|
||||
import struct
|
||||
import pytest
|
||||
|
||||
from app.services.gltf import (
|
||||
extract_gltf_metadata,
|
||||
looks_like_gltf,
|
||||
_parse_glb,
|
||||
_parse_gltf_json,
|
||||
)
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Test data helpers
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
def _make_gltf_json(
|
||||
meshes: int = 1,
|
||||
vertices_per_mesh: int = 24,
|
||||
has_animations: bool = False,
|
||||
images: list[dict] | None = None,
|
||||
) -> dict:
|
||||
"""Build a minimal glTF JSON structure."""
|
||||
accessors = []
|
||||
meshes_data = []
|
||||
for i in range(meshes):
|
||||
acc_index = len(accessors)
|
||||
accessors.append({
|
||||
"bufferView": 0,
|
||||
"componentType": 5126, # FLOAT
|
||||
"count": vertices_per_mesh,
|
||||
"type": "VEC3",
|
||||
"max": [1.0, 1.0, 1.0],
|
||||
"min": [-1.0, -1.0, -1.0],
|
||||
})
|
||||
meshes_data.append({
|
||||
"primitives": [{
|
||||
"attributes": {"POSITION": acc_index},
|
||||
}],
|
||||
})
|
||||
gltf = {
|
||||
"asset": {"version": "2.0"},
|
||||
"accessors": accessors,
|
||||
"meshes": meshes_data,
|
||||
}
|
||||
if has_animations:
|
||||
gltf["animations"] = [{"name": "anim1", "channels": [], "samplers": []}]
|
||||
if images:
|
||||
gltf["images"] = images
|
||||
return gltf
|
||||
|
||||
|
||||
def _make_glb(gltf_json: dict) -> bytes:
|
||||
"""Wrap *gltf_json* in a minimal GLB binary container."""
|
||||
json_bytes = json.dumps(gltf_json).encode("utf-8")
|
||||
json_length = len(json_bytes)
|
||||
# Pad JSON chunk to 4-byte boundary.
|
||||
json_padding = (4 - json_length % 4) % 4
|
||||
json_chunk = json_bytes + b"\x00" * json_padding
|
||||
json_chunk_type = 0x4E4F534A # "JSON"
|
||||
# No BIN chunk.
|
||||
bin_length = 0
|
||||
bin_chunk_type = 0x004E4942
|
||||
total_length = 12 + 8 + len(json_chunk) + 8 + bin_length
|
||||
header = struct.pack("<III", 0x46546C67, 2, total_length) # magic, version, length
|
||||
json_header = struct.pack("<II", len(json_chunk), json_chunk_type)
|
||||
if bin_length > 0:
|
||||
bin_header = struct.pack("<II", bin_length, bin_chunk_type)
|
||||
else:
|
||||
bin_header = b""
|
||||
return header + json_header + json_chunk + bin_header
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# looks_like_gltf
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
class TestLooksLikeGltf:
|
||||
def test_glb_magic(self):
|
||||
assert looks_like_gltf(b"glTF\x00\x00\x00\x00") is True
|
||||
|
||||
def test_gltf_extension(self):
|
||||
assert looks_like_gltf(b'{"asset":{"version":"2.0"}}', "model.gltf") is True
|
||||
|
||||
def test_glb_extension(self):
|
||||
assert looks_like_gltf(b"some binary", "model.glb") is True
|
||||
|
||||
def test_json_with_asset_version(self):
|
||||
payload = json.dumps({"asset": {"version": "2.0"}}).encode()
|
||||
assert looks_like_gltf(payload) is True
|
||||
|
||||
def test_plain_json_no_asset(self):
|
||||
payload = json.dumps({"foo": "bar"}).encode()
|
||||
assert looks_like_gltf(payload) is False
|
||||
|
||||
def test_non_json_bytes(self):
|
||||
assert looks_like_gltf(b"\x89PNG\r\n\x1a\n") is False
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# _parse_glb
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
class TestParseGlb:
|
||||
def test_parses_valid_glb(self):
|
||||
gltf_json = _make_gltf_json()
|
||||
glb = _make_glb(gltf_json)
|
||||
result = _parse_glb(glb)
|
||||
assert result["asset"]["version"] == "2.0"
|
||||
assert len(result["meshes"]) == 1
|
||||
|
||||
def test_rejects_too_short(self):
|
||||
with pytest.raises(ValueError, match="too short"):
|
||||
_parse_glb(b"glTF\x00\x00")
|
||||
|
||||
def test_rejects_invalid_magic(self):
|
||||
with pytest.raises(ValueError, match="invalid GLB magic"):
|
||||
_parse_glb(b"NOTglTF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# _parse_gltf_json
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
class TestParseGltfJson:
|
||||
def test_parses_valid_gltf(self):
|
||||
gltf_json = _make_gltf_json()
|
||||
result = _parse_gltf_json(json.dumps(gltf_json).encode())
|
||||
assert result["asset"]["version"] == "2.0"
|
||||
|
||||
def test_rejects_non_object(self):
|
||||
with pytest.raises(ValueError, match="root must be an object"):
|
||||
_parse_gltf_json(b"[1, 2, 3]")
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# extract_gltf_metadata (GLB path)
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
class TestExtractGltfMetadataGlb:
|
||||
def test_basic_glb(self):
|
||||
gltf_json = _make_gltf_json(meshes=1, vertices_per_mesh=24)
|
||||
glb = _make_glb(gltf_json)
|
||||
meta = extract_gltf_metadata(glb)
|
||||
assert meta["mesh_count"] == 1
|
||||
assert meta["vertex_count"] == 24
|
||||
assert meta["has_animation"] is False
|
||||
assert meta["bounding_box_min"] == [-1.0, -1.0, -1.0]
|
||||
assert meta["bounding_box_max"] == [1.0, 1.0, 1.0]
|
||||
assert meta["texture_refs"] == []
|
||||
|
||||
def test_multiple_meshes(self):
|
||||
gltf_json = _make_gltf_json(meshes=3, vertices_per_mesh=12)
|
||||
glb = _make_glb(gltf_json)
|
||||
meta = extract_gltf_metadata(glb)
|
||||
assert meta["mesh_count"] == 3
|
||||
assert meta["vertex_count"] == 36
|
||||
|
||||
def test_with_animation(self):
|
||||
gltf_json = _make_gltf_json(has_animations=True)
|
||||
glb = _make_glb(gltf_json)
|
||||
meta = extract_gltf_metadata(glb)
|
||||
assert meta["has_animation"] is True
|
||||
|
||||
def test_with_external_texture(self):
|
||||
gltf_json = _make_gltf_json(images=[{"uri": "textures/rock.png"}])
|
||||
glb = _make_glb(gltf_json)
|
||||
meta = extract_gltf_metadata(glb)
|
||||
assert meta["texture_refs"] == ["textures/rock.png"]
|
||||
|
||||
def test_with_named_texture(self):
|
||||
gltf_json = _make_gltf_json(images=[{"name": "my_texture"}])
|
||||
glb = _make_glb(gltf_json)
|
||||
meta = extract_gltf_metadata(glb)
|
||||
assert meta["texture_refs"] == ["my_texture"]
|
||||
|
||||
def test_empty_meshes(self):
|
||||
gltf_json = _make_gltf_json(meshes=0)
|
||||
glb = _make_glb(gltf_json)
|
||||
meta = extract_gltf_metadata(glb)
|
||||
assert meta["mesh_count"] == 0
|
||||
assert meta["vertex_count"] == 0
|
||||
assert meta["bounding_box_min"] == [0.0, 0.0, 0.0]
|
||||
assert meta["bounding_box_max"] == [0.0, 0.0, 0.0]
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# extract_gltf_metadata (plain .gltf JSON path)
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
class TestExtractGltfMetadataGltfJson:
|
||||
def test_plain_gltf(self):
|
||||
gltf_json = _make_gltf_json(meshes=2, vertices_per_mesh=8)
|
||||
raw = json.dumps(gltf_json).encode()
|
||||
meta = extract_gltf_metadata(raw)
|
||||
assert meta["mesh_count"] == 2
|
||||
assert meta["vertex_count"] == 16
|
||||
assert meta["has_animation"] is False
|
||||
|
||||
def test_plain_gltf_with_animation(self):
|
||||
gltf_json = _make_gltf_json(has_animations=True)
|
||||
raw = json.dumps(gltf_json).encode()
|
||||
meta = extract_gltf_metadata(raw)
|
||||
assert meta["has_animation"] is True
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Error handling
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
class TestExtractGltfMetadataErrors:
|
||||
def test_invalid_glb(self):
|
||||
with pytest.raises(ValueError):
|
||||
extract_gltf_metadata(b"not a glb")
|
||||
|
||||
def test_invalid_gltf_json(self):
|
||||
with pytest.raises(ValueError):
|
||||
_parse_gltf_json(b"[1, 2, 3]")
|
||||
@@ -0,0 +1,201 @@
|
||||
"""Tests for the POST /api/auth/refresh endpoint.
|
||||
|
||||
These tests exercise the full stack: register → get refresh token →
|
||||
refresh → new access token. Requires migrations already applied
|
||||
(alembic upgrade head) before running.
|
||||
"""
|
||||
|
||||
import pytest
|
||||
from fastapi.testclient import TestClient
|
||||
from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
|
||||
from sqlalchemy.pool import NullPool
|
||||
|
||||
from app.config import settings
|
||||
from app.main import app
|
||||
from app.database import get_db
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Test fixtures
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
@pytest.fixture(autouse=True)
|
||||
def _override_db():
|
||||
"""Override get_db so the app uses a fresh session per test."""
|
||||
test_engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
|
||||
test_session_factory = async_sessionmaker(test_engine, expire_on_commit=False)
|
||||
|
||||
async def _get_db():
|
||||
async_session = test_session_factory()
|
||||
try:
|
||||
yield async_session
|
||||
await async_session.commit()
|
||||
except Exception:
|
||||
await async_session.rollback()
|
||||
raise
|
||||
finally:
|
||||
await async_session.close()
|
||||
|
||||
app.dependency_overrides[get_db] = _get_db
|
||||
yield
|
||||
app.dependency_overrides.clear()
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Refresh endpoint tests
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
class TestRefresh:
|
||||
"""Tests for POST /api/auth/refresh."""
|
||||
|
||||
def _register_user(self, username: str, password: str, email: str = None):
|
||||
"""Helper to register a user and return the refresh token."""
|
||||
client = TestClient(app)
|
||||
if email is None:
|
||||
email = f"{username}@example.com"
|
||||
resp = client.post(
|
||||
"/api/auth/register",
|
||||
json={
|
||||
"username": username,
|
||||
"email": email,
|
||||
"password": password,
|
||||
"over_18": True,
|
||||
},
|
||||
)
|
||||
assert resp.status_code == 201
|
||||
return resp.json()["refresh_token"]
|
||||
|
||||
def test_refresh_success(self):
|
||||
"""A valid refresh token returns a new access token."""
|
||||
refresh_token = self._register_user("refep_refreshuser", "secret123")
|
||||
client = TestClient(app)
|
||||
resp = client.post(
|
||||
"/api/auth/refresh",
|
||||
json={"refresh_token": refresh_token},
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
data = resp.json()
|
||||
assert "access_token" in data
|
||||
assert data["token_type"] == "bearer"
|
||||
# The refresh token in the response is the same one we sent
|
||||
assert data["refresh_token"] == refresh_token
|
||||
|
||||
def test_refresh_returns_different_access_token(self):
|
||||
"""Refreshing produces a new access token (different from any previous)."""
|
||||
refresh_token = self._register_user("refep_refreshtoken", "secret123")
|
||||
client = TestClient(app)
|
||||
|
||||
# First refresh
|
||||
resp1 = client.post(
|
||||
"/api/auth/refresh",
|
||||
json={"refresh_token": refresh_token},
|
||||
)
|
||||
assert resp1.status_code == 200
|
||||
access_token_1 = resp1.json()["access_token"]
|
||||
|
||||
# Second refresh
|
||||
resp2 = client.post(
|
||||
"/api/auth/refresh",
|
||||
json={"refresh_token": refresh_token},
|
||||
)
|
||||
assert resp2.status_code == 200
|
||||
access_token_2 = resp2.json()["access_token"]
|
||||
|
||||
# Each refresh should produce a new access token
|
||||
assert access_token_1 != access_token_2
|
||||
|
||||
def test_refresh_invalid_token(self):
|
||||
"""An invalid (garbage) refresh token returns 401."""
|
||||
client = TestClient(app)
|
||||
resp = client.post(
|
||||
"/api/auth/refresh",
|
||||
json={"refresh_token": "not.a.jwt.token"},
|
||||
)
|
||||
assert resp.status_code == 401
|
||||
assert "Invalid or expired refresh token" in resp.json()["detail"]
|
||||
|
||||
def test_refresh_empty_body(self):
|
||||
"""Missing refresh_token field returns 422 validation error."""
|
||||
client = TestClient(app)
|
||||
resp = client.post(
|
||||
"/api/auth/refresh",
|
||||
json={},
|
||||
)
|
||||
assert resp.status_code == 422
|
||||
|
||||
def test_refresh_missing_field(self):
|
||||
"""No body at all returns 422."""
|
||||
client = TestClient(app)
|
||||
resp = client.post(
|
||||
"/api/auth/refresh",
|
||||
content="{}",
|
||||
headers={"Content-Type": "application/json"},
|
||||
)
|
||||
assert resp.status_code == 422
|
||||
|
||||
def test_refresh_with_login_token(self):
|
||||
"""A refresh token obtained from login also works for /refresh."""
|
||||
client = TestClient(app)
|
||||
# Register first
|
||||
client.post(
|
||||
"/api/auth/register",
|
||||
json={
|
||||
"username": "refep_loginrefuser",
|
||||
"email": "loginref@example.com",
|
||||
"password": "secret123",
|
||||
"over_18": True,
|
||||
},
|
||||
)
|
||||
# Login to get a refresh token
|
||||
login_resp = client.post(
|
||||
"/api/auth/login",
|
||||
data={"username": "refep_loginrefuser", "password": "secret123"},
|
||||
)
|
||||
assert login_resp.status_code == 200
|
||||
refresh_token = login_resp.json()["refresh_token"]
|
||||
|
||||
# Use it to refresh
|
||||
resp = client.post(
|
||||
"/api/auth/refresh",
|
||||
json={"refresh_token": refresh_token},
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
assert "access_token" in resp.json()
|
||||
|
||||
def test_refresh_access_token_is_valid_jwt(self):
|
||||
"""The access token returned by /refresh is a valid JWT."""
|
||||
from jose import jwt
|
||||
|
||||
refresh_token = self._register_user("refep_jwttoken", "secret123")
|
||||
client = TestClient(app)
|
||||
resp = client.post(
|
||||
"/api/auth/refresh",
|
||||
json={"refresh_token": refresh_token},
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
access_token = resp.json()["access_token"]
|
||||
|
||||
# Verify it's a 3-part JWT
|
||||
parts = access_token.split(".")
|
||||
assert len(parts) == 3
|
||||
|
||||
# Verify it decodes with the public key
|
||||
payload = jwt.decode(
|
||||
access_token,
|
||||
settings.public_pem,
|
||||
algorithms=[settings.ALGORITHM],
|
||||
)
|
||||
assert "sub" in payload
|
||||
assert "exp" in payload
|
||||
|
||||
def test_refresh_expires_minutes_in_response(self):
|
||||
"""The response includes access_token_expires_minutes."""
|
||||
refresh_token = self._register_user("refep_expiretest", "secret123")
|
||||
client = TestClient(app)
|
||||
resp = client.post(
|
||||
"/api/auth/refresh",
|
||||
json={"refresh_token": refresh_token},
|
||||
)
|
||||
assert resp.status_code == 200
|
||||
assert "access_token_expires_minutes" in resp.json()
|
||||
assert resp.json()["access_token_expires_minutes"] == settings.ACCESS_TOKEN_EXPIRE_MINUTES
|
||||
@@ -0,0 +1,79 @@
|
||||
"""Tests for refresh token uniqueness (jti claim) and model column length."""
|
||||
|
||||
import uuid
|
||||
from datetime import datetime, timedelta, timezone
|
||||
|
||||
import pytest
|
||||
from jose import jwt
|
||||
|
||||
from app.config import settings
|
||||
from app.routers.auth import _create_refresh_token
|
||||
from app.models.session import RefreshToken
|
||||
|
||||
|
||||
class TestRefreshTokenJtiUniqueness:
|
||||
"""Verify that _create_refresh_token produces unique tokens even when
|
||||
called with identical data in rapid succession (issue #1 from review)."""
|
||||
|
||||
def test_two_calls_produce_different_tokens(self):
|
||||
"""Two calls with the same sub produce different JWTs because of jti."""
|
||||
token_a = _create_refresh_token({"sub": "42"})
|
||||
token_b = _create_refresh_token({"sub": "42"})
|
||||
assert token_a != token_b
|
||||
|
||||
def test_jti_is_valid_uuid(self):
|
||||
"""The jti claim inside the refresh token is a valid UUID."""
|
||||
token = _create_refresh_token({"sub": "1"})
|
||||
payload = jwt.decode(
|
||||
token,
|
||||
settings.public_pem,
|
||||
algorithms=[settings.ALGORITHM],
|
||||
)
|
||||
assert "jti" in payload
|
||||
# Verify it parses as a UUID (raises ValueError if not)
|
||||
uuid.UUID(payload["jti"])
|
||||
|
||||
def test_each_token_has_unique_jti(self):
|
||||
"""Generate 100 tokens for the same user — all jtis must differ."""
|
||||
jtis = set()
|
||||
for _ in range(100):
|
||||
token = _create_refresh_token({"sub": "999"})
|
||||
payload = jwt.decode(
|
||||
token,
|
||||
settings.public_pem,
|
||||
algorithms=[settings.ALGORITHM],
|
||||
)
|
||||
jtis.add(payload["jti"])
|
||||
assert len(jtis) == 100
|
||||
|
||||
def test_jti_survives_decode(self):
|
||||
"""The jti claim is present and correct after decode."""
|
||||
token = _create_refresh_token({"sub": "7"})
|
||||
payload = jwt.decode(
|
||||
token,
|
||||
settings.public_pem,
|
||||
algorithms=[settings.ALGORITHM],
|
||||
)
|
||||
assert payload["sub"] == "7"
|
||||
assert "jti" in payload
|
||||
assert "exp" in payload
|
||||
|
||||
|
||||
class TestRefreshTokenModelColumnLength:
|
||||
"""Verify the model's token column length matches the migration (issue #2)."""
|
||||
|
||||
def test_token_column_has_length_512(self):
|
||||
"""RefreshToken.token column should be String(512), not unbounded."""
|
||||
from sqlalchemy import inspect
|
||||
|
||||
# Get the column definition from the model's table
|
||||
column = RefreshToken.__table__.columns["token"]
|
||||
# The type should be String with length 512
|
||||
assert column.type.length == 512
|
||||
|
||||
def test_token_column_type_is_string(self):
|
||||
"""The token column should be a String type."""
|
||||
from sqlalchemy import String as SAString
|
||||
|
||||
column = RefreshToken.__table__.columns["token"]
|
||||
assert isinstance(column.type, SAString)
|
||||
Reference in New Issue
Block a user