53 lines
2.2 KiB
Python
53 lines
2.2 KiB
Python
|
# api/auth.py
|
||
|
|
# 认证模块：登录（签发 JWT）、创建用户（仅管理员）、获取当前用户信息
|
||
|
|
from fastapi import APIRouter, Depends, HTTPException
|
||
|
|
from sqlalchemy.orm import Session
|
||
|
|
|
||
|
|
from core.security import verify_password, create_access_token
|
||
|
|
from core.deps import get_current_user, require_roles
|
||
|
|
from dao.users_dao import UserDAO
|
||
|
|
from database import get_db
|
||
|
|
from model.user import User
|
||
|
|
from scheme.users import UserAdd, UserLogin, UserResponse, TokenResponse
|
||
|
|
|
||
|
|
router = APIRouter()
|
||
|
|
|
||
|
|
|
||
|
|
# ---------- 登录 ----------
|
||
|
|
@router.post("/login", response_model=TokenResponse, summary="登录获取 JWT token")
|
||
|
|
async def login(body: UserLogin, db: Session = Depends(get_db)):
|
||
|
|
user = UserDAO.get_by_username(db, body.username)
|
||
|
|
# 用户不存在 / 已被软删除 / 密码错误，统一返回 401（避免暴露用户是否存在）
|
||
|
|
if (user is None) or user.is_deleted == 1 or not verify_password(body.password, user.password_hash):
|
||
|
|
raise HTTPException(status_code=401, detail="用户名或密码错误")
|
||
|
|
token = create_access_token(user.user_id, user.role)
|
||
|
|
return TokenResponse(
|
||
|
|
access_token=token,
|
||
|
|
user=UserResponse.model_validate(user),
|
||
|
|
)
|
||
|
|
|
||
|
|
|
||
|
|
# ---------- 创建用户（仅管理员） ----------
|
||
|
|
@router.post("/register", response_model=UserResponse, summary="创建用户（仅管理员）")
|
||
|
|
async def register(
|
||
|
|
body: UserAdd,
|
||
|
|
db: Session = Depends(get_db),
|
||
|
|
current_user: User = Depends(require_roles("admin")),
|
||
|
|
):
|
||
|
|
existing = UserDAO.get_by_username(db, body.username)
|
||
|
|
if existing:
|
||
|
|
raise HTTPException(status_code=409, detail="用户名已存在")
|
||
|
|
# 绑定业务身份的合法性校验
|
||
|
|
if body.role == "student" and body.stu_id is None:
|
||
|
|
raise HTTPException(status_code=400, detail="student 角色必须提供 stu_id")
|
||
|
|
if body.role == "teacher" and body.teacher_id is None:
|
||
|
|
raise HTTPException(status_code=400, detail="teacher 角色必须提供 teacher_id")
|
||
|
|
user = UserDAO.add_user(db, body)
|
||
|
|
return user
|
||
|
|
|
||
|
|
|
||
|
|
# ---------- 获取当前登录用户 ----------
|
||
|
|
@router.get("/me", response_model=UserResponse, summary="获取当前登录用户信息")
|
||
|
|
async def me(current_user: User = Depends(get_current_user)):
|
||
|
|
return current_user
|