dolgolyov.alexei
4cbce89129
Backend:
- Structured JSON logging (python-json-logger) with request ID correlation
- RequestIDMiddleware (server-generated UUID, no client trust)
- Global exception handlers: AppException, RequestValidationError, generic 500
— all return consistent {"error": {code, message, request_id}} format
- Async rate limiting with lock + stale key eviction on auth endpoints
- Health endpoint checks DB connectivity, returns version + status
- Custom exception classes (NotFoundException, ForbiddenException, etc.)
- OpenAPI docs with tag descriptions, conditional URL (disabled in production)
- LOG_LEVEL, DOCS_ENABLED, RATE_LIMIT_* settings added
Docker:
- Backend: multi-stage build (builder + runtime), non-root user, HEALTHCHECK
- Frontend: removed dead user, HEALTHCHECK directive
- docker-compose: restart policies, healthchecks, Redis service, named volumes
for uploads/PDFs, rate limit env vars forwarded
- Alembic migrations run only in Dockerfile CMD (removed from lifespan)
Nginx:
- server_tokens off
- CSP, Referrer-Policy, Permissions-Policy headers
- HSTS ready (commented, enable with TLS)
Config & Docs:
- .env.production.example with production-ready settings
- CLAUDE.md project conventions (structure, workflow, naming, how-to)
- .env.example updated with new variables
Review fixes applied:
- Rate limiter: async lock prevents race condition, stale key eviction
- Request ID: always server-generated (no log injection)
- Removed duplicate alembic migration from lifespan
- Removed dead app user from frontend Dockerfile
- Health check logs DB errors
- Rate limit env vars forwarded in docker-compose
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
80 lines
2.4 KiB
Python
80 lines
2.4 KiB
Python
from typing import Annotated
|
|
|
|
from fastapi import APIRouter, Depends, Request, status
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.api.deps import get_current_user
|
|
from app.database import get_db
|
|
from app.models.user import User
|
|
from app.schemas.auth import (
|
|
AuthResponse,
|
|
LoginRequest,
|
|
RefreshRequest,
|
|
TokenResponse,
|
|
UserResponse,
|
|
RegisterRequest,
|
|
)
|
|
from app.core.rate_limit import check_rate_limit
|
|
from app.services import auth_service
|
|
|
|
router = APIRouter(prefix="/auth", tags=["auth"])
|
|
|
|
|
|
@router.post("/register", response_model=AuthResponse, status_code=status.HTTP_201_CREATED)
|
|
async def register(
|
|
data: RegisterRequest,
|
|
request: Request,
|
|
db: Annotated[AsyncSession, Depends(get_db)],
|
|
):
|
|
await check_rate_limit(request)
|
|
from app.services.setting_service import get_setting_value
|
|
registration_enabled = await get_setting_value(db, "self_registration_enabled", True)
|
|
if not registration_enabled:
|
|
from fastapi import HTTPException
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Registration is currently disabled")
|
|
|
|
return await auth_service.register_user(
|
|
db,
|
|
data,
|
|
ip_address=request.client.host if request.client else None,
|
|
device_info=request.headers.get("user-agent"),
|
|
)
|
|
|
|
|
|
@router.post("/login", response_model=AuthResponse)
|
|
async def login(
|
|
data: LoginRequest,
|
|
request: Request,
|
|
db: Annotated[AsyncSession, Depends(get_db)],
|
|
):
|
|
await check_rate_limit(request)
|
|
return await auth_service.login_user(
|
|
db,
|
|
email=data.email,
|
|
password=data.password,
|
|
remember_me=data.remember_me,
|
|
ip_address=request.client.host if request.client else None,
|
|
device_info=request.headers.get("user-agent"),
|
|
)
|
|
|
|
|
|
@router.post("/refresh", response_model=TokenResponse)
|
|
async def refresh(
|
|
data: RefreshRequest,
|
|
db: Annotated[AsyncSession, Depends(get_db)],
|
|
):
|
|
return await auth_service.refresh_tokens(db, data.refresh_token)
|
|
|
|
|
|
@router.post("/logout", status_code=status.HTTP_204_NO_CONTENT)
|
|
async def logout(
|
|
data: RefreshRequest,
|
|
db: Annotated[AsyncSession, Depends(get_db)],
|
|
):
|
|
await auth_service.logout_user(db, data.refresh_token)
|
|
|
|
|
|
@router.get("/me", response_model=UserResponse)
|
|
async def me(user: Annotated[User, Depends(get_current_user)]):
|
|
return UserResponse.model_validate(user)
|