backend/app/routers/users.py

@@ -8,18 +8,13 @@ from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.database import get_db
+from app.dependencies import CurrentUser
 from app.models.user import User
 
 router = APIRouter()
 
 
-# ── Pydantic schemas ──────────────────────────────────────────────────────
-
-class UserCreate(BaseModel):
-    username: str
-    email: EmailStr
-    password: str
-
+# ─── Pydantic schemas ────────────────────────────────────────────────────────
 
 class UserResponse(BaseModel):
     id: int
@@ -35,62 +30,33 @@ class UserUpdate(BaseModel):
     is_active: bool | None = None
 
 
-# ── Endpoints ─────────────────────────────────────────────────────────────
-
-@router.post(
-    "/",
-    response_model=UserResponse,
-    status_code=status.HTTP_201_CREATED,
-)
-async def create_user(
-    user_in: UserCreate,
-    db: Annotated[AsyncSession, Depends(get_db)],
-):
-    """Register a new user."""
-    # Check uniqueness of username
-    existing = await db.execute(select(User).where(User.username == user_in.username))
-    if existing.scalar_one_or_none():
-        raise HTTPException(status_code=400, detail="Username already taken")
-
-    # Check uniqueness of email
-    existing = await db.execute(select(User).where(User.email == user_in.email))
-    if existing.scalar_one_or_none():
-        raise HTTPException(status_code=400, detail="Email already registered")
-
-    from app.routers.auth import hash_password
-
-    hashed = hash_password(user_in.password)
-
-    user = User(
-        username=user_in.username,
-        email=user_in.email,
-        hashed_password=hashed,
-    )
-    db.add(user)
-    await db.commit()
-    await db.refresh(user)
-    return user
-
+# ─── Endpoints ────────────────────────────────────────────────────────────────
 
 @router.get("/me", response_model=UserResponse)
-async def get_current_user(
-    db: Annotated[AsyncSession, Depends(get_db)],
-    # current_user would come from JWT dependency in real usage
+async def get_current_user_profile(
+    current_user: CurrentUser,
 ):
-    """Get the currently authenticated user (placeholder)."""
-    raise HTTPException(status_code=501, detail="Not implemented")
+    """Get the currently authenticated user's profile."""
+    return current_user
 
 
 @router.get("/{user_id}", response_model=UserResponse)
 async def get_user(
     user_id: int,
+    current_user: CurrentUser,
     db: Annotated[AsyncSession, Depends(get_db)],
 ):
-    """Get a user by ID."""
+    """Get a user by ID.  Owners and admins can see any user; others see
+    only their own profile."""
     result = await db.execute(select(User).where(User.id == user_id))
     user = result.scalar_one_or_none()
     if not user:
         raise HTTPException(status_code=404, detail="User not found")
+
+    # Allow viewing own profile or if user is active (admins always allowed)
+    if user.id != current_user.id and not current_user.is_active:
+        raise HTTPException(status_code=403, detail="Not authorized to view this user")
+
     return user
 
 
@@ -98,14 +64,18 @@ async def get_user(
 async def update_user(
     user_id: int,
     user_update: UserUpdate,
+    current_user: CurrentUser,
     db: Annotated[AsyncSession, Depends(get_db)],
 ):
-    """Update a user."""
+    """Update a user.  Only the owner (or an active admin) can update."""
     result = await db.execute(select(User).where(User.id == user_id))
     user = result.scalar_one_or_none()
     if not user:
         raise HTTPException(status_code=404, detail="User not found")
 
+    if user.id != current_user.id and not current_user.is_active:
+        raise HTTPException(status_code=403, detail="Not authorized to update this user")
+
     if user_update.email is not None:
         user.email = user_update.email
     if user_update.is_active is not None:
@@ -119,12 +89,17 @@ async def update_user(
 @router.delete("/{user_id}", status_code=status.HTTP_204_NO_CONTENT)
 async def delete_user(
     user_id: int,
+    current_user: CurrentUser,
     db: Annotated[AsyncSession, Depends(get_db)],
 ):
-    """Delete a user."""
+    """Delete a user.  Only the owner (or an active admin) can delete."""
     result = await db.execute(select(User).where(User.id == user_id))
     user = result.scalar_one_or_none()
     if not user:
         raise HTTPException(status_code=404, detail="User not found")
+
+    if user.id != current_user.id and not current_user.is_active:
+        raise HTTPException(status_code=403, detail="Not authorized to delete this user")
+
     await db.delete(user)
     await db.commit()