WIP checkpoint: Address review feedback: Implement Godot dedicated server scene + player spawning
This commit is contained in:
@@ -0,0 +1,243 @@
|
||||
"""Asset management router."""
|
||||
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
from typing import Optional
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException, UploadFile, File, Query
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.config import settings
|
||||
from app.database import get_db
|
||||
from app.dependencies import CurrentUser
|
||||
from app.models.asset import Asset, AssetType
|
||||
from app.models.world import World
|
||||
from app.services import gltf as gltf_service
|
||||
from pydantic import BaseModel, Field
|
||||
|
||||
router = APIRouter()
|
||||
|
||||
|
||||
# --- Pydantic schemas ---
|
||||
|
||||
class AssetCreate(BaseModel):
|
||||
"""Schema for creating an asset reference."""
|
||||
name: str = Field(..., min_length=1, max_length=255)
|
||||
description: Optional[str] = None
|
||||
asset_type: AssetType
|
||||
world_id: Optional[int] = None
|
||||
|
||||
|
||||
class AssetResponse(BaseModel):
|
||||
"""Schema for asset responses."""
|
||||
id: int
|
||||
name: str
|
||||
description: Optional[str]
|
||||
asset_type: AssetType
|
||||
file_path: str
|
||||
file_size: Optional[int]
|
||||
mime_type: Optional[str]
|
||||
world_id: Optional[int]
|
||||
owner_id: int
|
||||
is_public: bool
|
||||
created_at: str
|
||||
updated_at: str
|
||||
|
||||
model_config = {"from_attributes": True}
|
||||
|
||||
|
||||
class AssetUpdate(BaseModel):
|
||||
"""Schema for updating an asset."""
|
||||
name: Optional[str] = None
|
||||
description: Optional[str] = None
|
||||
is_public: Optional[bool] = None
|
||||
|
||||
|
||||
# --- Helpers ---
|
||||
|
||||
def _sanitize_filename(filename: str) -> str:
|
||||
"""Strip path components and unsafe characters from a filename."""
|
||||
# Remove any directory components (path traversal protection).
|
||||
base = os.path.basename(filename.replace("\\", "/"))
|
||||
# Keep only safe characters.
|
||||
safe = "".join(c for c in base if c.isalnum() or c in "._-")
|
||||
return safe or "file"
|
||||
|
||||
|
||||
def _detect_asset_type(filename: Optional[str], content: bytes) -> AssetType:
|
||||
"""Detect the asset type from filename and content."""
|
||||
if filename and gltf_service.looks_like_gltf(content, filename):
|
||||
return AssetType.MODEL_3D
|
||||
# Fallback: let the caller decide based on mime_type or default.
|
||||
return AssetType.OTHER
|
||||
|
||||
|
||||
# --- Endpoints ---
|
||||
|
||||
@router.post("/", response_model=AssetResponse, status_code=201)
|
||||
async def create_asset(
|
||||
payload: AssetCreate,
|
||||
current_user: CurrentUser,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Create a new asset reference."""
|
||||
# Verify world ownership if world_id is provided
|
||||
if payload.world_id is not None:
|
||||
world = await db.get(World, payload.world_id)
|
||||
if world is None:
|
||||
raise HTTPException(status_code=404, detail="World not found")
|
||||
if world.owner_id != current_user.id:
|
||||
raise HTTPException(status_code=403, detail="Not owner of this world")
|
||||
|
||||
asset = Asset(
|
||||
name=payload.name,
|
||||
description=payload.description,
|
||||
asset_type=payload.asset_type,
|
||||
file_path="", # Will be set after upload
|
||||
owner_id=current_user.id,
|
||||
world_id=payload.world_id,
|
||||
is_public=False,
|
||||
)
|
||||
db.add(asset)
|
||||
await db.commit()
|
||||
await db.refresh(asset)
|
||||
return asset
|
||||
|
||||
|
||||
@router.get("/", response_model=list[AssetResponse])
|
||||
async def list_assets(
|
||||
current_user: CurrentUser,
|
||||
world_id: Optional[int] = Query(None, description="Filter by world"),
|
||||
asset_type: Optional[AssetType] = Query(None),
|
||||
limit: int = Query(50, ge=1, le=100),
|
||||
offset: int = Query(0, ge=0),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""List assets with optional filters."""
|
||||
stmt = select(Asset).where(Asset.owner_id == current_user.id)
|
||||
|
||||
if world_id is not None:
|
||||
stmt = stmt.where(Asset.world_id == world_id)
|
||||
if asset_type is not None:
|
||||
stmt = stmt.where(Asset.asset_type == asset_type)
|
||||
|
||||
stmt = stmt.order_by(Asset.created_at.desc()).limit(limit).offset(offset)
|
||||
result = await db.execute(stmt)
|
||||
assets = result.scalars().all()
|
||||
return assets
|
||||
|
||||
|
||||
@router.get("/{asset_id}", response_model=AssetResponse)
|
||||
async def get_asset(
|
||||
asset_id: int,
|
||||
current_user: CurrentUser,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Get a single asset by ID."""
|
||||
asset = await db.get(Asset, asset_id)
|
||||
if asset is None or asset.owner_id != current_user.id:
|
||||
raise HTTPException(status_code=404, detail="Asset not found")
|
||||
return asset
|
||||
|
||||
|
||||
@router.patch("/{asset_id}", response_model=AssetResponse)
|
||||
async def update_asset(
|
||||
asset_id: int,
|
||||
payload: AssetUpdate,
|
||||
current_user: CurrentUser,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Update an asset."""
|
||||
asset = await db.get(Asset, asset_id)
|
||||
if asset is None or asset.owner_id != current_user.id:
|
||||
raise HTTPException(status_code=404, detail="Asset not found")
|
||||
|
||||
update_data = payload.model_dump(exclude_unset=True)
|
||||
for field, value in update_data.items():
|
||||
setattr(asset, field, value)
|
||||
|
||||
await db.commit()
|
||||
await db.refresh(asset)
|
||||
return asset
|
||||
|
||||
|
||||
@router.delete("/{asset_id}", status_code=204)
|
||||
async def delete_asset(
|
||||
asset_id: int,
|
||||
current_user: CurrentUser,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Delete an asset."""
|
||||
asset = await db.get(Asset, asset_id)
|
||||
if asset is None or asset.owner_id != current_user.id:
|
||||
raise HTTPException(status_code=404, detail="Asset not found")
|
||||
|
||||
await db.delete(asset)
|
||||
await db.commit()
|
||||
|
||||
|
||||
@router.post("/{asset_id}/upload", response_model=AssetResponse)
|
||||
async def upload_asset_file(
|
||||
asset_id: int,
|
||||
current_user: CurrentUser,
|
||||
file: UploadFile = File(...),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Upload a file for an existing asset."""
|
||||
asset = await db.get(Asset, asset_id)
|
||||
if asset is None or asset.owner_id != current_user.id:
|
||||
raise HTTPException(status_code=404, detail="Asset not found")
|
||||
|
||||
# Sanitize filename to prevent path traversal.
|
||||
safe_filename = _sanitize_filename(file.filename or f"asset_{asset_id}")
|
||||
|
||||
# Read the file content.
|
||||
content = await file.read()
|
||||
file_size = len(content)
|
||||
|
||||
# Determine which size limit to apply.
|
||||
if gltf_service.looks_like_gltf(content, file.filename):
|
||||
max_bytes = settings.GLTF_MAX_FILE_SIZE_MB * 1024 * 1024
|
||||
else:
|
||||
max_bytes = settings.MAX_UPLOAD_SIZE_MB * 1024 * 1024
|
||||
|
||||
if file_size > max_bytes:
|
||||
raise HTTPException(
|
||||
status_code=413,
|
||||
detail=f"File size {file_size} exceeds maximum allowed size {max_bytes} bytes",
|
||||
)
|
||||
|
||||
# Write the file to the upload directory.
|
||||
upload_dir = Path(settings.UPLOAD_DIR)
|
||||
upload_dir.mkdir(parents=True, exist_ok=True)
|
||||
stored_name = f"{asset_id}_{safe_filename}"
|
||||
file_path = upload_dir / stored_name
|
||||
file_path.write_bytes(content)
|
||||
|
||||
# Detect asset type from content/filename.
|
||||
detected_type = _detect_asset_type(file.filename, content)
|
||||
|
||||
# Update asset record.
|
||||
asset.file_path = str(file_path)
|
||||
asset.mime_type = file.content_type
|
||||
asset.file_size = file_size
|
||||
|
||||
# If this is a glTF file, extract and store metadata.
|
||||
if detected_type == AssetType.MODEL_3D:
|
||||
try:
|
||||
metadata = gltf_service.extract_gltf_metadata(content)
|
||||
asset.metadata_json = json.dumps(metadata)
|
||||
# Also set the asset type to model_3d if it was auto-detected.
|
||||
if asset.asset_type == AssetType.OTHER:
|
||||
asset.asset_type = AssetType.MODEL_3D
|
||||
except ValueError as exc:
|
||||
raise HTTPException(
|
||||
status_code=400,
|
||||
detail=f"Invalid glTF file: {exc}",
|
||||
)
|
||||
|
||||
await db.commit()
|
||||
await db.refresh(asset)
|
||||
return asset
|
||||
@@ -0,0 +1,311 @@
|
||||
"""Authentication router - login, register, token refresh."""
|
||||
|
||||
import uuid
|
||||
from datetime import date, datetime, timedelta, timezone
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException, status
|
||||
from fastapi.security import OAuth2PasswordRequestForm
|
||||
from jose import JWTError, jwt
|
||||
from passlib.context import CryptContext
|
||||
from pydantic import BaseModel, EmailStr
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.config import settings
|
||||
from app.database import get_db
|
||||
from app.dependencies import CurrentUser
|
||||
from app.models.session import RefreshToken
|
||||
from app.models.user import User
|
||||
|
||||
pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
|
||||
|
||||
router = APIRouter()
|
||||
|
||||
|
||||
# --- Pydantic schemas ---
|
||||
|
||||
class TokenResponse(BaseModel):
|
||||
access_token: str
|
||||
refresh_token: str
|
||||
token_type: str = "bearer"
|
||||
access_token_expires_minutes: int
|
||||
|
||||
|
||||
class RefreshRequest(BaseModel):
|
||||
refresh_token: str
|
||||
|
||||
|
||||
class RegisterRequest(BaseModel):
|
||||
username: str
|
||||
email: EmailStr
|
||||
password: str
|
||||
over_18: bool # Simple boolean confirmation instead of date_of_birth
|
||||
|
||||
|
||||
class UserResponse(BaseModel):
|
||||
id: int
|
||||
username: str
|
||||
email: str
|
||||
date_of_birth: str | None = None
|
||||
is_active: bool
|
||||
created_at: datetime | None = None
|
||||
|
||||
model_config = {"from_attributes": True}
|
||||
|
||||
|
||||
# --- Helpers ---
|
||||
|
||||
def _create_access_token(data: dict) -> str:
|
||||
"""Create a signed access token using RS256.
|
||||
|
||||
Includes a unique ``jti`` claim so that concurrent/same-second calls
|
||||
(e.g. back-to-back /refresh requests) still produce distinct tokens —
|
||||
without it, two tokens minted for the same user within the same
|
||||
second are byte-identical since ``sub``/``exp`` are the only claims.
|
||||
"""
|
||||
to_encode = data.copy()
|
||||
to_encode["jti"] = str(uuid.uuid4())
|
||||
expire = datetime.now(timezone.utc) + timedelta(
|
||||
minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES
|
||||
)
|
||||
to_encode.update({"exp": expire})
|
||||
return jwt.encode(
|
||||
to_encode,
|
||||
settings.private_pem,
|
||||
algorithm=settings.ALGORITHM,
|
||||
)
|
||||
|
||||
|
||||
def _create_refresh_token(data: dict) -> str:
|
||||
"""Create a signed refresh token using RS256.
|
||||
|
||||
Includes a unique ``jti`` claim so that concurrent calls produce
|
||||
distinct tokens even when issued within the same second.
|
||||
"""
|
||||
to_encode = data.copy()
|
||||
to_encode["jti"] = str(uuid.uuid4())
|
||||
expire = datetime.now(timezone.utc) + timedelta(
|
||||
days=settings.REFRESH_TOKEN_EXPIRE_DAYS
|
||||
)
|
||||
to_encode.update({"exp": expire})
|
||||
return jwt.encode(
|
||||
to_encode,
|
||||
settings.private_pem,
|
||||
algorithm=settings.ALGORITHM,
|
||||
)
|
||||
|
||||
|
||||
def verify_password(plain_password: str, hashed_password: str) -> bool:
|
||||
"""Verify a plain password against a hash."""
|
||||
return pwd_context.verify(plain_password, hashed_password)
|
||||
|
||||
|
||||
def hash_password(password: str) -> str:
|
||||
"""Hash a password."""
|
||||
return pwd_context.hash(password)
|
||||
|
||||
|
||||
def calculate_age(birth_date: date, today: date | None = None) -> int:
|
||||
"""Calculate age in years from a birth date.
|
||||
|
||||
Not called by /register anymore (that endpoint now just trusts the
|
||||
client's over_18 boolean, see RegisterRequest) -- kept as a real,
|
||||
tested utility since date-of-birth storage/verification is coming
|
||||
back in a future pass (real age math, not just a client-side claim,
|
||||
the user explicitly wants to revisit this design). Removing it broke
|
||||
backend/tests/test_auth_age_gate.py's collection entirely (ImportError
|
||||
on `from app.routers.auth import calculate_age`) for zero benefit --
|
||||
restoring it is the lower-risk path over rewriting or deleting 17
|
||||
tests for logic this codebase will need again.
|
||||
|
||||
Args:
|
||||
birth_date: The person's date of birth.
|
||||
today: The reference date. Defaults to today's date (UTC).
|
||||
|
||||
Returns:
|
||||
Age in whole years as of the reference date.
|
||||
"""
|
||||
if today is None:
|
||||
today = datetime.now(timezone.utc).date()
|
||||
|
||||
age = today.year - birth_date.year
|
||||
# Adjust if birthday hasn't occurred yet this year
|
||||
if (today.month, today.day) < (birth_date.month, birth_date.day):
|
||||
age -= 1
|
||||
return age
|
||||
|
||||
|
||||
def _issue_refresh_token(user_id: int, db: AsyncSession) -> str:
|
||||
"""Create and persist a refresh token for the given user."""
|
||||
refresh_token_value = _create_refresh_token({"sub": str(user_id)})
|
||||
refresh_token_record = RefreshToken(
|
||||
id=str(uuid.uuid4()),
|
||||
user_id=user_id,
|
||||
token=refresh_token_value,
|
||||
expires_at=datetime.now(timezone.utc)
|
||||
+ timedelta(days=settings.REFRESH_TOKEN_EXPIRE_DAYS),
|
||||
)
|
||||
db.add(refresh_token_record)
|
||||
return refresh_token_value
|
||||
|
||||
|
||||
# --- Endpoints ---
|
||||
|
||||
@router.post("/register", response_model=TokenResponse, status_code=status.HTTP_201_CREATED)
|
||||
async def register(req: RegisterRequest, db: AsyncSession = Depends(get_db)):
|
||||
"""Register a new user and return access + refresh tokens.
|
||||
|
||||
Requires over_18 boolean confirmation; rejects users who are not 18+.
|
||||
"""
|
||||
if not req.over_18:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_400_BAD_REQUEST,
|
||||
detail="Must be 18 or older to register",
|
||||
)
|
||||
|
||||
# Check if username already exists
|
||||
result = await db.execute(select(User).where(User.username == req.username))
|
||||
if result.scalar_one_or_none():
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_409_CONFLICT,
|
||||
detail="Username already registered",
|
||||
)
|
||||
|
||||
# Check if email already exists
|
||||
result = await db.execute(select(User).where(User.email == req.email))
|
||||
if result.scalar_one_or_none():
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_409_CONFLICT,
|
||||
detail="Email already registered",
|
||||
)
|
||||
|
||||
user = User(
|
||||
username=req.username,
|
||||
email=req.email,
|
||||
hashed_password=hash_password(req.password),
|
||||
date_of_birth=None, # No longer collecting DOB
|
||||
)
|
||||
db.add(user)
|
||||
await db.flush() # flush to get user.id before creating refresh token
|
||||
await db.refresh(user)
|
||||
|
||||
# Create access token
|
||||
access_token = _create_access_token({"sub": str(user.id)})
|
||||
|
||||
# Create and persist refresh token
|
||||
refresh_token_value = _issue_refresh_token(user.id, db)
|
||||
await db.commit()
|
||||
|
||||
return TokenResponse(
|
||||
access_token=access_token,
|
||||
refresh_token=refresh_token_value,
|
||||
access_token_expires_minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES,
|
||||
)
|
||||
|
||||
|
||||
@router.post("/login", response_model=TokenResponse)
|
||||
async def login(form: OAuth2PasswordRequestForm = Depends(), db: AsyncSession = Depends(get_db)):
|
||||
"""Authenticate user and return access + refresh tokens.
|
||||
|
||||
Accepts form-encoded credentials (username/password) as expected by
|
||||
OAuth2PasswordBearer, so the Swagger UI "Authorize" flow works correctly.
|
||||
"""
|
||||
result = await db.execute(select(User).where(User.username == form.username))
|
||||
user = result.scalar_one_or_none()
|
||||
|
||||
if not user or not verify_password(form.password, user.hashed_password):
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_401_UNAUTHORIZED,
|
||||
detail="Incorrect username or password",
|
||||
)
|
||||
|
||||
if not user.is_active:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_403_FORBIDDEN,
|
||||
detail="User account is inactive",
|
||||
)
|
||||
|
||||
# Create access token
|
||||
access_token = _create_access_token({"sub": str(user.id)})
|
||||
|
||||
# Create and persist refresh token
|
||||
refresh_token_value = _issue_refresh_token(user.id, db)
|
||||
await db.commit()
|
||||
|
||||
return TokenResponse(
|
||||
access_token=access_token,
|
||||
refresh_token=refresh_token_value,
|
||||
access_token_expires_minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES,
|
||||
)
|
||||
|
||||
|
||||
@router.post("/refresh", response_model=TokenResponse)
|
||||
async def refresh(req: RefreshRequest, db: AsyncSession = Depends(get_db)):
|
||||
"""Exchange a valid refresh token for a new access token.
|
||||
|
||||
Validates the refresh token against the database:
|
||||
- Must exist in the refresh_tokens table
|
||||
- Must not be expired (expires_at > now)
|
||||
- Must be active (is_active == true)
|
||||
|
||||
On success, returns a new access token. The refresh token itself is
|
||||
NOT rotated (the client keeps using the same refresh token).
|
||||
"""
|
||||
credentials_exception = HTTPException(
|
||||
status_code=status.HTTP_401_UNAUTHORIZED,
|
||||
detail="Invalid or expired refresh token",
|
||||
)
|
||||
|
||||
# Step 1: Decode and validate the JWT signature/claims
|
||||
try:
|
||||
payload = jwt.decode(
|
||||
req.refresh_token,
|
||||
settings.public_pem,
|
||||
algorithms=[settings.ALGORITHM],
|
||||
)
|
||||
except JWTError:
|
||||
raise credentials_exception
|
||||
|
||||
user_id_str: str | None = payload.get("sub")
|
||||
if user_id_str is None:
|
||||
raise credentials_exception
|
||||
|
||||
try:
|
||||
user_id = int(user_id_str)
|
||||
except (ValueError, TypeError):
|
||||
raise credentials_exception
|
||||
|
||||
# Step 2: Look up the refresh token in the database
|
||||
result = await db.execute(
|
||||
select(RefreshToken).where(
|
||||
RefreshToken.token == req.refresh_token,
|
||||
RefreshToken.user_id == user_id,
|
||||
)
|
||||
)
|
||||
stored_token = result.scalar_one_or_none()
|
||||
|
||||
if stored_token is None:
|
||||
raise credentials_exception
|
||||
|
||||
# Step 3: Check if the token is expired
|
||||
if datetime.now(timezone.utc) >= stored_token.expires_at:
|
||||
raise credentials_exception
|
||||
|
||||
# Step 4: Check if the token is active
|
||||
if not stored_token.is_active:
|
||||
raise credentials_exception
|
||||
|
||||
# Step 5: Issue a new access token
|
||||
access_token = _create_access_token({"sub": str(user_id)})
|
||||
|
||||
return TokenResponse(
|
||||
access_token=access_token,
|
||||
refresh_token=req.refresh_token, # Return the same refresh token
|
||||
access_token_expires_minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES,
|
||||
)
|
||||
|
||||
|
||||
@router.get("/me", response_model=UserResponse)
|
||||
async def get_current_user(current_user: CurrentUser):
|
||||
"""Get current user profile from the JWT token."""
|
||||
return current_user
|
||||
@@ -0,0 +1,106 @@
|
||||
"""User management router."""
|
||||
|
||||
from typing import Annotated
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException, status
|
||||
from pydantic import BaseModel, EmailStr
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.database import get_db
|
||||
from app.dependencies import CurrentUser
|
||||
from app.models.user import User
|
||||
|
||||
router = APIRouter()
|
||||
|
||||
|
||||
# ─── Pydantic schemas ────────────────────────────────────────────────────────
|
||||
|
||||
class UserResponse(BaseModel):
|
||||
id: int
|
||||
username: str
|
||||
email: str
|
||||
is_active: bool
|
||||
|
||||
model_config = {"from_attributes": True}
|
||||
|
||||
|
||||
class UserUpdate(BaseModel):
|
||||
email: EmailStr | None = None
|
||||
is_active: bool | None = None
|
||||
|
||||
|
||||
# ─── Endpoints ───────────────────────────────────────────────────────────────
|
||||
|
||||
@router.get("/me", response_model=UserResponse)
|
||||
async def get_current_user_profile(
|
||||
current_user: CurrentUser,
|
||||
):
|
||||
"""Get the currently authenticated user's profile."""
|
||||
return current_user
|
||||
|
||||
|
||||
@router.get("/{user_id}", response_model=UserResponse)
|
||||
async def get_user(
|
||||
user_id: int,
|
||||
current_user: CurrentUser,
|
||||
db: Annotated[AsyncSession, Depends(get_db)],
|
||||
):
|
||||
"""Get a user by ID. Only the owner can view their own profile."""
|
||||
result = await db.execute(select(User).where(User.id == user_id))
|
||||
user = result.scalar_one_or_none()
|
||||
if not user:
|
||||
raise HTTPException(status_code=404, detail="User not found")
|
||||
|
||||
# Only the owner may view their own profile.
|
||||
if user.id != current_user.id:
|
||||
raise HTTPException(status_code=403, detail="Not authorized to view this user")
|
||||
|
||||
return user
|
||||
|
||||
|
||||
@router.patch("/{user_id}", response_model=UserResponse)
|
||||
async def update_user(
|
||||
user_id: int,
|
||||
user_update: UserUpdate,
|
||||
current_user: CurrentUser,
|
||||
db: Annotated[AsyncSession, Depends(get_db)],
|
||||
):
|
||||
"""Update a user. Only the owner can update their own account."""
|
||||
result = await db.execute(select(User).where(User.id == user_id))
|
||||
user = result.scalar_one_or_none()
|
||||
if not user:
|
||||
raise HTTPException(status_code=404, detail="User not found")
|
||||
|
||||
# Only the owner may update their own account.
|
||||
if user.id != current_user.id:
|
||||
raise HTTPException(status_code=403, detail="Not authorized to update this user")
|
||||
|
||||
if user_update.email is not None:
|
||||
user.email = user_update.email
|
||||
if user_update.is_active is not None:
|
||||
user.is_active = user_update.is_active
|
||||
|
||||
await db.commit()
|
||||
await db.refresh(user)
|
||||
return user
|
||||
|
||||
|
||||
@router.delete("/{user_id}", status_code=status.HTTP_204_NO_CONTENT)
|
||||
async def delete_user(
|
||||
user_id: int,
|
||||
current_user: CurrentUser,
|
||||
db: Annotated[AsyncSession, Depends(get_db)],
|
||||
):
|
||||
"""Delete a user. Only the owner can delete their own account."""
|
||||
result = await db.execute(select(User).where(User.id == user_id))
|
||||
user = result.scalar_one_or_none()
|
||||
if not user:
|
||||
raise HTTPException(status_code=404, detail="User not found")
|
||||
|
||||
# Only the owner may delete their own account.
|
||||
if user.id != current_user.id:
|
||||
raise HTTPException(status_code=403, detail="Not authorized to delete this user")
|
||||
|
||||
await db.delete(user)
|
||||
await db.commit()
|
||||
@@ -0,0 +1,169 @@
|
||||
"""Worlds router - CRUD for game worlds."""
|
||||
|
||||
from datetime import datetime
|
||||
from typing import Annotated
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException, Query
|
||||
from pydantic import BaseModel, Field
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
from sqlalchemy.orm import selectinload
|
||||
|
||||
from app.database import get_db
|
||||
from app.dependencies import CurrentUser
|
||||
from app.models.world import World, WorldVisibility
|
||||
|
||||
router = APIRouter()
|
||||
|
||||
DbDep = Annotated[AsyncSession, Depends(get_db)]
|
||||
|
||||
|
||||
# --- Pydantic schemas ---
|
||||
|
||||
class WorldCreate(BaseModel):
|
||||
"""Schema for creating a world."""
|
||||
name: str = Field(..., min_length=1, max_length=255)
|
||||
description: str | None = None
|
||||
visibility: WorldVisibility = WorldVisibility.PUBLIC
|
||||
|
||||
|
||||
class WorldUpdate(BaseModel):
|
||||
"""Schema for updating a world."""
|
||||
name: str | None = Field(None, min_length=1, max_length=255)
|
||||
description: str | None = None
|
||||
visibility: WorldVisibility | None = None
|
||||
|
||||
|
||||
class WorldResponse(BaseModel):
|
||||
"""Schema for world responses."""
|
||||
id: int
|
||||
name: str
|
||||
description: str | None
|
||||
visibility: WorldVisibility
|
||||
owner_id: int
|
||||
created_at: datetime | None = None
|
||||
|
||||
model_config = {"from_attributes": True}
|
||||
|
||||
|
||||
# --- Endpoints ---
|
||||
|
||||
@router.get("/", response_model=list[WorldResponse])
|
||||
async def list_worlds(
|
||||
current_user: CurrentUser,
|
||||
db: DbDep,
|
||||
skip: int = Query(0, ge=0),
|
||||
limit: int = Query(50, ge=1, le=100),
|
||||
visibility: WorldVisibility | None = None,
|
||||
):
|
||||
"""List worlds visible to the current user.
|
||||
|
||||
PUBLIC worlds are visible to everyone.
|
||||
PRIVATE/FRIENDS_ONLY worlds are visible to their owner.
|
||||
"""
|
||||
query = select(World).options(selectinload(World.owner))
|
||||
|
||||
# Filter by visibility if specified
|
||||
if visibility:
|
||||
query = query.where(World.visibility == visibility)
|
||||
if visibility != WorldVisibility.PUBLIC:
|
||||
# Requesting a non-public visibility explicitly must not bypass
|
||||
# ownership — otherwise any authenticated user could list every
|
||||
# PRIVATE/FRIENDS_ONLY world in the system just by passing the
|
||||
# filter, defeating the point of the check below.
|
||||
query = query.where(World.owner_id == current_user.id)
|
||||
else:
|
||||
# Show PUBLIC worlds + owner's own worlds
|
||||
query = query.where(
|
||||
(World.visibility == WorldVisibility.PUBLIC)
|
||||
| (World.owner_id == current_user.id)
|
||||
)
|
||||
|
||||
query = query.offset(skip).limit(limit).order_by(World.created_at.desc())
|
||||
result = await db.execute(query)
|
||||
worlds = result.scalars().all()
|
||||
return worlds
|
||||
|
||||
|
||||
@router.get("/{world_id}", response_model=WorldResponse)
|
||||
async def get_world(
|
||||
world_id: int,
|
||||
current_user: CurrentUser,
|
||||
db: DbDep,
|
||||
):
|
||||
"""Get a single world by ID, respecting visibility."""
|
||||
result = await db.execute(
|
||||
select(World).where(World.id == world_id).options(selectinload(World.owner))
|
||||
)
|
||||
world = result.scalar_one_or_none()
|
||||
if not world:
|
||||
raise HTTPException(status_code=404, detail="World not found")
|
||||
|
||||
# Allow access if world is PUBLIC or owned by current user
|
||||
if world.visibility != WorldVisibility.PUBLIC and world.owner_id != current_user.id:
|
||||
raise HTTPException(status_code=404, detail="World not found")
|
||||
|
||||
return world
|
||||
|
||||
|
||||
@router.post("/", response_model=WorldResponse, status_code=201)
|
||||
async def create_world(
|
||||
world_data: WorldCreate,
|
||||
current_user: CurrentUser,
|
||||
db: DbDep,
|
||||
):
|
||||
"""Create a new world."""
|
||||
world = World(
|
||||
name=world_data.name,
|
||||
description=world_data.description,
|
||||
owner_id=current_user.id,
|
||||
visibility=world_data.visibility,
|
||||
)
|
||||
db.add(world)
|
||||
await db.commit()
|
||||
await db.refresh(world)
|
||||
return world
|
||||
|
||||
|
||||
@router.put("/{world_id}", response_model=WorldResponse)
|
||||
async def update_world(
|
||||
world_id: int,
|
||||
world_data: WorldUpdate,
|
||||
current_user: CurrentUser,
|
||||
db: DbDep,
|
||||
):
|
||||
"""Update an existing world."""
|
||||
result = await db.execute(select(World).where(World.id == world_id))
|
||||
world = result.scalar_one_or_none()
|
||||
if not world:
|
||||
raise HTTPException(status_code=404, detail="World not found")
|
||||
|
||||
if world.owner_id != current_user.id:
|
||||
raise HTTPException(status_code=403, detail="Not owner of this world")
|
||||
|
||||
update_data = world_data.model_dump(exclude_unset=True)
|
||||
for field, value in update_data.items():
|
||||
setattr(world, field, value)
|
||||
|
||||
await db.commit()
|
||||
await db.refresh(world)
|
||||
return world
|
||||
|
||||
|
||||
@router.delete("/{world_id}", status_code=204)
|
||||
async def delete_world(
|
||||
world_id: int,
|
||||
current_user: CurrentUser,
|
||||
db: DbDep,
|
||||
):
|
||||
"""Delete a world."""
|
||||
result = await db.execute(select(World).where(World.id == world_id))
|
||||
world = result.scalar_one_or_none()
|
||||
if not world:
|
||||
raise HTTPException(status_code=404, detail="World not found")
|
||||
|
||||
if world.owner_id != current_user.id:
|
||||
raise HTTPException(status_code=403, detail="Not owner of this world")
|
||||
|
||||
await db.delete(world)
|
||||
await db.commit()
|
||||
Reference in New Issue
Block a user