Initial Claude implementation

app/api/auth.py

@@ -0,0 +1,82 @@
+from fastapi import APIRouter, Depends, HTTPException, status
+from fastapi.security import OAuth2PasswordRequestForm
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.database import get_db
+from app.crud import role as role_crud
+from app.crud import token as token_crud
+from app.crud import user as user_crud
+from app.deps import get_current_user
+from app.models.user import User
+from app.schemas.token import LogoutRequest, Token, TokenRefreshRequest
+from app.schemas.user import RegisterRequest, UserRead
+from app.services.auth import RefreshError, issue_token_pair, rotate_refresh_token
+
+router = APIRouter()
+
+DEFAULT_USER_ROLE = "user"
+
+
+@router.post("/register", response_model=UserRead, status_code=status.HTTP_201_CREATED)
+async def register(payload: RegisterRequest, db: AsyncSession = Depends(get_db)):
+    if await user_crud.get_by_email(db, payload.email):
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="Email already registered"
+        )
+    default_role = await role_crud.get_by_name(db, DEFAULT_USER_ROLE)
+    role_ids = [default_role.id] if default_role else []
+    user = await user_crud.create(
+        db,
+        email=payload.email,
+        password=payload.password,
+        full_name=payload.full_name,
+        role_ids=role_ids,
+    )
+    return user
+
+
+@router.post("/login", response_model=Token)
+async def login(
+    form: OAuth2PasswordRequestForm = Depends(),
+    db: AsyncSession = Depends(get_db),
+):
+    # OAuth2 form uses ``username``; we treat it as the email.
+    user = await user_crud.authenticate(db, form.username, form.password)
+    if user is None:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Incorrect email or password",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+    access, refresh = await issue_token_pair(db, user)
+    return Token(access_token=access, refresh_token=refresh)
+
+
+@router.post("/refresh", response_model=Token)
+async def refresh(payload: TokenRefreshRequest, db: AsyncSession = Depends(get_db)):
+    try:
+        access, refresh, _ = await rotate_refresh_token(db, payload.refresh_token)
+    except RefreshError as exc:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED, detail=str(exc)
+        ) from exc
+    return Token(access_token=access, refresh_token=refresh)
+
+
+@router.post("/logout", status_code=status.HTTP_204_NO_CONTENT)
+async def logout(
+    payload: LogoutRequest,
+    user: User = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+):
+    if payload.refresh_token:
+        try:
+            from app.core.security import decode_token
+
+            jti = decode_token(payload.refresh_token).get("jti")
+            if jti:
+                await token_crud.revoke_by_jti(db, jti)
+        except Exception:  # noqa: BLE001 - best-effort revocation of a single token
+            pass
+    else:
+        await token_crud.revoke_all_for_user(db, user.id)

app/api/roles.py

@@ -0,0 +1,81 @@
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.database import get_db
+from app.crud import role as role_crud
+from app.deps import require_permission
+from app.models.user import User
+from app.schemas.rbac import PermissionRead, RoleCreate, RoleRead, RoleUpdate
+
+router = APIRouter()
+
+
+@router.get("", response_model=list[RoleRead])
+async def list_roles(
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(require_permission("roles:read")),
+):
+    return await role_crud.list_roles(db)
+
+
+@router.post("", response_model=RoleRead, status_code=status.HTTP_201_CREATED)
+async def create_role(
+    payload: RoleCreate,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(require_permission("roles:write")),
+):
+    if await role_crud.get_by_name(db, payload.name):
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="Role already exists"
+        )
+    return await role_crud.create(
+        db,
+        name=payload.name,
+        description=payload.description,
+        permission_ids=payload.permission_ids,
+    )
+
+
+@router.get("/permissions", response_model=list[PermissionRead])
+async def list_permissions(
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(require_permission("roles:read")),
+):
+    return await role_crud.list_permissions(db)
+
+
+@router.get("/{role_id}", response_model=RoleRead)
+async def get_role(
+    role_id: int,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(require_permission("roles:read")),
+):
+    role = await role_crud.get(db, role_id)
+    if role is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Role not found")
+    return role
+
+
+@router.patch("/{role_id}", response_model=RoleRead)
+async def update_role(
+    role_id: int,
+    payload: RoleUpdate,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(require_permission("roles:write")),
+):
+    role = await role_crud.get(db, role_id)
+    if role is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Role not found")
+    return await role_crud.update(db, role, payload.model_dump(exclude_unset=True))
+
+
+@router.delete("/{role_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_role(
+    role_id: int,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(require_permission("roles:write")),
+):
+    role = await role_crud.get(db, role_id)
+    if role is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Role not found")
+    await role_crud.delete(db, role)

app/api/router.py

@@ -0,0 +1,8 @@
+from fastapi import APIRouter
+
+from app.api import auth, roles, users
+
+api_router = APIRouter()
+api_router.include_router(auth.router, prefix="/auth", tags=["auth"])
+api_router.include_router(users.router, prefix="/users", tags=["users"])
+api_router.include_router(roles.router, prefix="/roles", tags=["roles"])

app/api/users.py

@@ -0,0 +1,82 @@
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.database import get_db
+from app.crud import user as user_crud
+from app.deps import get_current_user, require_permission
+from app.models.user import User
+from app.schemas.user import UserCreate, UserRead, UserUpdate
+
+router = APIRouter()
+
+
+@router.get("/me", response_model=UserRead)
+async def read_me(user: User = Depends(get_current_user)):
+    return user
+
+
+@router.get("", response_model=list[UserRead])
+async def list_users(
+    skip: int = 0,
+    limit: int = 100,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(require_permission("users:read")),
+):
+    return await user_crud.list_users(db, skip=skip, limit=limit)
+
+
+@router.post("", response_model=UserRead, status_code=status.HTTP_201_CREATED)
+async def create_user(
+    payload: UserCreate,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(require_permission("users:write")),
+):
+    if await user_crud.get_by_email(db, payload.email):
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="Email already registered"
+        )
+    return await user_crud.create(
+        db,
+        email=payload.email,
+        password=payload.password,
+        full_name=payload.full_name,
+        is_superuser=payload.is_superuser,
+        role_ids=payload.role_ids,
+    )
+
+
+@router.get("/{user_id}", response_model=UserRead)
+async def get_user(
+    user_id: int,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(require_permission("users:read")),
+):
+    user = await user_crud.get(db, user_id)
+    if user is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="User not found")
+    return user
+
+
+@router.patch("/{user_id}", response_model=UserRead)
+async def update_user(
+    user_id: int,
+    payload: UserUpdate,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(require_permission("users:write")),
+):
+    user = await user_crud.get(db, user_id)
+    if user is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="User not found")
+    return await user_crud.update(db, user, payload.model_dump(exclude_unset=True))
+
+
+@router.delete("/{user_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_user(
+    user_id: int,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(require_permission("users:delete")),
+):
+    user = await user_crud.get(db, user_id)
+    if user is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="User not found")
+    await user_crud.delete(db, user)