gh-christianlouis-inboxconverge/backend/app/api/v1/endpoints/auth.py

"""
Authentication endpoints (login, register, OAuth).
"""

from fastapi import APIRouter, Depends, HTTPException, status
from fastapi.security import OAuth2PasswordRequestForm
from sqlalchemy.ext.asyncio import AsyncSession
from sqlalchemy import select
from datetime import datetime, timedelta, timezone
from urllib.parse import quote as urlquote
import logging

from app.core.config import settings
from app.core.database import get_db
from app.core.security import verify_password, get_password_hash, encrypt_credential
from app.models.database_models import User, SubscriptionTier, GmailCredential
from app.models.schemas import Token, UserCreate, UserResponse, GoogleAuthRequest
from app.services.auth_service import oauth_service
from app.services.gmail_service import GmailService, GMAIL_SCOPES

router = APIRouter()
logger = logging.getLogger(__name__)

# All scopes requested during Google Sign-In so users only go through one OAuth
# consent screen for both login and Gmail API access.
# GMAIL_SCOPES (gmail.insert, gmail.labels, gmail.readonly) are imported from
# gmail_service so the scope list stays in sync with what GmailService uses.
GOOGLE_LOGIN_SCOPES = [
    "openid",
    "email",
    "profile",
    *GMAIL_SCOPES,
]


@router.post(
    "/register", response_model=UserResponse, status_code=status.HTTP_201_CREATED
)
async def register(user_in: UserCreate, db: AsyncSession = Depends(get_db)):
    """Register a new user with email and password"""

    # Check if user exists
    result = await db.execute(select(User).where(User.email == user_in.email))
    existing_user = result.scalar_one_or_none()

    if existing_user:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST, detail="Email already registered"
        )

    # Create new user
    user = User(
        email=user_in.email,
        full_name=user_in.full_name,
        hashed_password=(
            get_password_hash(user_in.password) if user_in.password else None
        ),
        subscription_tier=SubscriptionTier.FREE,
        is_active=True,
        is_superuser=(
            settings.ADMIN_EMAIL is not None
            and user_in.email.lower() == settings.ADMIN_EMAIL.lower()
        ),
    )

    db.add(user)
    await db.commit()
    await db.refresh(user)

    logger.info(f"New user registered: {user.email}")

    return user


@router.post("/login", response_model=Token)
async def login(
    form_data: OAuth2PasswordRequestForm = Depends(), db: AsyncSession = Depends(get_db)
):
    """Login with email and password"""

    # Get user
    result = await db.execute(select(User).where(User.email == form_data.username))
    user = result.scalar_one_or_none()

    if not user or not user.hashed_password:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Incorrect email or password",
            headers={"WWW-Authenticate": "Bearer"},
        )

    # Verify password
    if not verify_password(form_data.password, user.hashed_password):  # type: ignore[arg-type]
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Incorrect email or password",
            headers={"WWW-Authenticate": "Bearer"},
        )

    # Check if user is active
    if not user.is_active:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN, detail="User account is inactive"
        )

    # Update last login
    user.last_login_at = datetime.now(timezone.utc)  # type: ignore[assignment]

    # Auto-promote to superuser if this is the configured admin email
    if (
        settings.ADMIN_EMAIL is not None
        and user.email.lower() == settings.ADMIN_EMAIL.lower()
        and not user.is_superuser
    ):
        user.is_superuser = True  # type: ignore[assignment]
        logger.info(f"Auto-promoted admin user: {user.email}")

    await db.commit()

    # Create tokens
    tokens = oauth_service.create_tokens_for_user(user)

    logger.info(f"User logged in: {user.email}")

    return tokens


@router.post("/google", response_model=Token)
async def google_oauth(
    auth_request: GoogleAuthRequest, db: AsyncSession = Depends(get_db)
):
    """
    Authenticate with Google OAuth2.
    Exchange authorization code for access token and user info.
    """

    # Get user info from Google
    user_info = await oauth_service.get_google_user_info(
        code=auth_request.code, redirect_uri=auth_request.redirect_uri
    )

    if not user_info.get("verified_email"):
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="Email not verified with Google",
        )

    email = user_info["email"]
    google_id = user_info["google_id"]

    # Check if user exists
    result = await db.execute(
        select(User).where((User.email == email) | (User.google_id == google_id))
    )
    user = result.scalar_one_or_none()

    if user:
        # Update Google ID if not set
        if not user.google_id:
            user.google_id = google_id  # type: ignore[assignment]
            user.oauth_provider = "google"  # type: ignore[assignment]

        # Update last login
        user.last_login_at = datetime.now(timezone.utc)  # type: ignore[assignment]

        # Auto-promote to superuser if this is the configured admin email
        if (
            settings.ADMIN_EMAIL is not None
            and user.email.lower() == settings.ADMIN_EMAIL.lower()
            and not user.is_superuser
        ):
            user.is_superuser = True  # type: ignore[assignment]
            logger.info(f"Auto-promoted admin user via Google OAuth: {user.email}")

        logger.info(f"Existing user logged in with Google: {user.email}")
    else:
        # Create new user
        user = User(
            email=email,
            full_name=user_info.get("full_name"),
            google_id=google_id,
            oauth_provider="google",
            subscription_tier=SubscriptionTier.FREE,
            is_active=True,
            last_login_at=datetime.now(timezone.utc),
            is_superuser=(
                settings.ADMIN_EMAIL is not None
                and email.lower() == settings.ADMIN_EMAIL.lower()
            ),
        )
        db.add(user)

        logger.info(f"New user registered with Google: {user.email}")

    await db.commit()
    await db.refresh(user)

    # If Gmail tokens were returned (Gmail scopes were granted), store them so
    # users don't need a separate "Connect Gmail" step after signing in.
    google_access_token = user_info.get("access_token")
    google_refresh_token = user_info.get("refresh_token")
    if google_access_token:
        try:
            gmail_service = GmailService(
                access_token=google_access_token,
                refresh_token=google_refresh_token,
                client_id=settings.GOOGLE_CLIENT_ID,
                client_secret=settings.GOOGLE_CLIENT_SECRET,
            )
            is_valid = await gmail_service.verify_access()
            if is_valid:
                token_expiry = datetime.now(timezone.utc) + timedelta(
                    seconds=int(user_info.get("expires_in", 3600))
                )
                encrypted_access = encrypt_credential(google_access_token)
                encrypted_refresh = (
                    encrypt_credential(google_refresh_token)
                    if google_refresh_token
                    else None
                )
                scope_list = user_info.get("scope", "").split()

                cred_result = await db.execute(
                    select(GmailCredential).where(GmailCredential.user_id == user.id)
                )
                existing_cred = cred_result.scalar_one_or_none()

                if existing_cred:
                    existing_cred.gmail_email = email  # type: ignore[assignment]
                    existing_cred.encrypted_access_token = encrypted_access  # type: ignore[assignment]
                    if encrypted_refresh:
                        existing_cred.encrypted_refresh_token = encrypted_refresh  # type: ignore[assignment]
                    existing_cred.token_expiry = token_expiry  # type: ignore[assignment]
                    existing_cred.scopes = scope_list  # type: ignore[assignment]
                    existing_cred.is_valid = True  # type: ignore[assignment]
                    existing_cred.last_verified_at = datetime.now(timezone.utc)  # type: ignore[assignment]
                else:
                    new_cred = GmailCredential(
                        user_id=user.id,
                        gmail_email=email,
                        encrypted_access_token=encrypted_access,
                        encrypted_refresh_token=encrypted_refresh,
                        token_expiry=token_expiry,
                        scopes=scope_list,
                        is_valid=True,
                        last_verified_at=datetime.now(timezone.utc),
                    )
                    db.add(new_cred)

                await db.commit()
                logger.info(f"Gmail credentials stored for user: {email}")
        except Exception as e:
            # Non-fatal: login succeeds even if Gmail credential storage fails
            logger.warning(
                f"Could not store Gmail credentials during Google login for {email}: {e}"
            )

    # Create tokens
    tokens = oauth_service.create_tokens_for_user(user)

    return tokens


@router.get("/google/authorize-url")
async def get_google_authorize_url(redirect_uri: str):
    """Get Google OAuth2 authorization URL requesting all necessary scopes."""
    scope = urlquote(" ".join(GOOGLE_LOGIN_SCOPES))
    auth_url = (
        "https://accounts.google.com/o/oauth2/v2/auth"
        f"?client_id={settings.GOOGLE_CLIENT_ID}"
        "&response_type=code"
        f"&scope={scope}"
        f"&redirect_uri={redirect_uri}"
        "&access_type=offline"
        "&prompt=consent"
        "&include_granted_scopes=true"
    )

    return {"authorization_url": auth_url}