diff options
Diffstat (limited to 'jb/views')
| -rw-r--r-- | jb/views/auth.py | 130 |
1 files changed, 90 insertions, 40 deletions
diff --git a/jb/views/auth.py b/jb/views/auth.py index dc63ca3..6f8a3e2 100644 --- a/jb/views/auth.py +++ b/jb/views/auth.py @@ -1,8 +1,9 @@ +import logging from typing import Annotated from urllib.parse import urlencode from fastapi import APIRouter, Depends, HTTPException, Response, status -from fastapi.responses import HTMLResponse +from fastapi.responses import HTMLResponse, RedirectResponse from jb.api.auth import ( SESSION_COOKIE_NAME, @@ -17,6 +18,11 @@ from jb.api.magic_token import ( ) from jb.config import settings from jb.dependencies import get_gr_api_manager +from jb.managers.email_manager import ( + get_or_create_contact, + send_amt_link_email, + send_login_email, +) from jb.managers.gr_api import GRApiManager from jb.models.auth import ( AccountLogin, @@ -30,36 +36,34 @@ auth_router = APIRouter(prefix="/auth", tags=["Auth"]) @auth_router.post("/magic-link/request") -def request_mock_magic_link(body: AccountLogin) -> dict[str, str]: - """Create a magic link without sending email in development.""" - if not settings.debug: - raise HTTPException(status_code=status.HTTP_404_NOT_FOUND) - - # todo: send email here - - user = User(email=body.email) - token = create_magic_token(str(user.email)) - query = urlencode({"token": token}) - return {"magic_link": f"/auth/magic-link/?{query}"} +def request_magic_link(body: AccountLogin) -> dict[str, str]: + """Create a magic link.""" + email = str(body.email) + token = create_magic_token(user_email=email) + if settings.debug: + query = urlencode({"token": token}) + return {"magic_link": f"{settings.base_url}auth/magic-link/?{query}"} -@auth_router.post("/link-amt/request") -def link_amt_account(body: AmtAccountLink) -> dict[str, str]: - """Create a mock AMT account-link email in development.""" - if not settings.debug: - raise HTTPException(status_code=status.HTTP_404_NOT_FOUND) - - # TODO: Derive amt_worker_id from a server-validated AMT assignment and - # send this link by email instead of returning it. - user = User(email=body.email) - token = create_amt_account_link_token(user, body.amt_worker_id) - query = urlencode({"token": token}) - return {"magic_link": f"/auth/link-amt/?{query}"} + send_login_email(email=email, magic_token=token) + return {"detail": "Link sent. Check your inbox and follow the link to log in."} @auth_router.get("/magic-link/", response_class=HTMLResponse, include_in_schema=False) -def magic_link_landing_page() -> HTMLResponse: +def magic_link_landing_page( + gr_api: Annotated[GRApiManager, Depends(get_gr_api_manager)], + token: str | None = None, +) -> Response: """Serve the SPA without redeeming the token; email prefetches are harmless.""" + if settings.debug: + if token is None: + raise HTTPException( + status_code=status.HTTP_400_BAD_REQUEST, + detail="token is required", + ) + response = RedirectResponse(url="/", status_code=status.HTTP_303_SEE_OTHER) + _exchange_magic_link(token, response, gr_api) + return response return HTMLResponse( BASE_HTML, headers={ @@ -70,12 +74,6 @@ def magic_link_landing_page() -> HTMLResponse: ) -@auth_router.get("/link-amt/", response_class=HTMLResponse, include_in_schema=False) -def link_amt_account_landing_page() -> HTMLResponse: - """Serve the account-link SPA without consuming the one-time token.""" - return magic_link_landing_page() - - @auth_router.post("/magic-link/exchange", status_code=status.HTTP_204_NO_CONTENT) def exchange_magic_link( body: MagicLinkExchangeRequest, @@ -83,16 +81,15 @@ def exchange_magic_link( gr_api: Annotated[GRApiManager, Depends(get_gr_api_manager)], ) -> None: """Exchange a magic link only after its landing page makes an explicit POST.""" - user_email = consume_magic_token(body.token) + _exchange_magic_link(body.token, response, gr_api) - user = User.model_validate({"email": user_email}) - # hit thl to make sure this user exists - user = gr_api.ensure_user_exists(user) - session_token = create_session(user.product_user_id) +def _exchange_magic_link(token: str, response: Response, gr_api: GRApiManager) -> None: + user_email = consume_magic_token(token) + user = gr_api.ensure_user_exists(User.model_validate({"email": user_email})) response.set_cookie( key=SESSION_COOKIE_NAME, - value=session_token, + value=create_session(user.product_user_id), max_age=settings.session_token_ttl_seconds, httponly=True, secure=not settings.debug, @@ -101,6 +98,45 @@ def exchange_magic_link( ) +@auth_router.post("/link-amt/request") +def link_amt_account(body: AmtAccountLink) -> dict[str, str]: + """Link an AMT account and login.""" + email = str(body.email) + amt_worker_id = body.amt_worker_id + token = create_amt_account_link_token(email=email, amt_worker_id=amt_worker_id) + + if settings.debug: + query = urlencode({"token": token}) + return {"magic_link": f"{settings.base_url}auth/link-amt/?{query}"} + + send_amt_link_email(email=email, magic_token=token) + return {"detail": "Link sent. Check your inbox and follow the link to log in."} + + +@auth_router.get("/link-amt/", response_class=HTMLResponse, include_in_schema=False) +def link_amt_account_landing_page( + gr_api: Annotated[GRApiManager, Depends(get_gr_api_manager)], + token: str | None = None, +) -> HTMLResponse: + """Serve the account-link SPA without consuming the one-time token.""" + if settings.debug: + if token is None: + raise HTTPException( + status_code=status.HTTP_400_BAD_REQUEST, + detail="token is required", + ) + response = RedirectResponse(url="/", status_code=status.HTTP_303_SEE_OTHER) + _exchange_amt_account_link(token, response, gr_api) + return HTMLResponse( + BASE_HTML, + headers={ + "Cache-Control": "no-store", + "Referrer-Policy": "no-referrer", + "X-Robots-Tag": "noindex, nofollow", + }, + ) + + @auth_router.post("/link-amt/exchange", status_code=status.HTTP_204_NO_CONTENT) def exchange_amt_account_link( body: MagicLinkExchangeRequest, @@ -108,9 +144,23 @@ def exchange_amt_account_link( gr_api: Annotated[GRApiManager, Depends(get_gr_api_manager)], ) -> None: """Validate the email link, then transition the bound AMT account.""" - token_data = consume_amt_account_link_token(body.token) - user = User(email=token_data.email) - user = gr_api.transition_user_from_amt(user, token_data.amt_worker_id) + try: + _exchange_amt_account_link(body.token, response, gr_api) + except ValueError as e: + logging.error(f"Failed to exchange AMT account link: {e}") + raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e)) + + +def _exchange_amt_account_link(token: str, response: Response, gr_api: GRApiManager): + token_data = consume_amt_account_link_token(token) + email = token_data.email + amt_worker_id = token_data.amt_worker_id + + user = User(email=email) + user = gr_api.transition_user_from_amt(user=user, amt_worker_id=amt_worker_id) + + # In Mautic, associate the email with the worker ID (AFTER the user has transitioned) + get_or_create_contact(email=email, amt_worker_id=amt_worker_id) session_token = create_session(user.product_user_id) response.set_cookie( |