98 lines
2.7 KiB
Python
98 lines
2.7 KiB
Python
"""
|
||
认证路由：登录与令牌刷新。
|
||
|
||
- POST /api/auth/login — 验证用户名密码，返回 JWT 令牌对
|
||
- POST /api/auth/refresh — 用刷新令牌换取新的访问令牌
|
||
"""
|
||
|
||
import logging
|
||
|
||
from fastapi import APIRouter, HTTPException, status
|
||
from jose import JWTError
|
||
|
||
from app.auth.jwt import (
|
||
create_access_token,
|
||
create_token_pair,
|
||
decode_refresh_token,
|
||
verify_password,
|
||
)
|
||
from app.database import get_connection
|
||
from app.schemas.auth import LoginRequest, RefreshRequest, TokenResponse
|
||
|
||
logger = logging.getLogger(__name__)
|
||
|
||
router = APIRouter(prefix="/api/auth", tags=["认证"])
|
||
|
||
|
||
@router.post("/login", response_model=TokenResponse)
|
||
async def login(body: LoginRequest):
|
||
"""
|
||
用户登录。
|
||
|
||
查询 admin_users 表验证用户名密码，成功后返回 JWT 令牌对。
|
||
- 用户不存在或密码错误：401
|
||
- 账号已禁用（is_active=false）：401
|
||
"""
|
||
conn = get_connection()
|
||
try:
|
||
with conn.cursor() as cur:
|
||
cur.execute(
|
||
"SELECT id, password_hash, site_id, is_active "
|
||
"FROM admin_users WHERE username = %s",
|
||
(body.username,),
|
||
)
|
||
row = cur.fetchone()
|
||
finally:
|
||
conn.close()
|
||
|
||
if row is None:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_401_UNAUTHORIZED,
|
||
detail="用户名或密码错误",
|
||
)
|
||
|
||
user_id, password_hash, site_id, is_active = row
|
||
|
||
if not is_active:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_401_UNAUTHORIZED,
|
||
detail="账号已被禁用",
|
||
)
|
||
|
||
if not verify_password(body.password, password_hash):
|
||
raise HTTPException(
|
||
status_code=status.HTTP_401_UNAUTHORIZED,
|
||
detail="用户名或密码错误",
|
||
)
|
||
|
||
tokens = create_token_pair(user_id, site_id)
|
||
return TokenResponse(**tokens)
|
||
|
||
|
||
@router.post("/refresh", response_model=TokenResponse)
|
||
async def refresh(body: RefreshRequest):
|
||
"""
|
||
刷新访问令牌。
|
||
|
||
验证 refresh_token 有效性，成功后仅返回新的 access_token
|
||
（refresh_token 保持不变，由客户端继续持有）。
|
||
"""
|
||
try:
|
||
payload = decode_refresh_token(body.refresh_token)
|
||
except JWTError:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_401_UNAUTHORIZED,
|
||
detail="无效的刷新令牌",
|
||
)
|
||
|
||
user_id = int(payload["sub"])
|
||
site_id = payload["site_id"]
|
||
|
||
# 生成新的 access_token，refresh_token 原样返回
|
||
new_access = create_access_token(user_id, site_id)
|
||
return TokenResponse(
|
||
access_token=new_access,
|
||
refresh_token=body.refresh_token,
|
||
token_type="bearer",
|
||
)
|