Jonathan
85455f3271
- Add root .gitignore to prevent btc_wallet.py (with RPC credentials) from being committed - Load JWT SECRET_KEY from environment variable instead of hardcoded value - Restrict CORS to explicit methods/headers instead of wildcards - Add Pydantic Field validation (gt=0) to purchase amounts and user credentials - Add logging to all silent exception handlers in btc.py - Run backend and frontend Docker containers as non-root appuser - Add .dockerignore for both backend and frontend - Pass SECRET_KEY env var through docker-compose; add healthchecks to both services - Update bcrypt from pinned 3.2.2 to >=4.0.0 - Capture error objects in frontend catch blocks; check admin delete response Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
46 lines
1.5 KiB
Python
46 lines
1.5 KiB
Python
from fastapi import APIRouter, Depends, HTTPException, status
|
|
from sqlalchemy.orm import Session
|
|
from pydantic import BaseModel, Field
|
|
|
|
from ..database import get_db
|
|
from .. import models
|
|
from ..auth import hash_password, verify_password, create_access_token
|
|
|
|
router = APIRouter()
|
|
|
|
|
|
class UserCreate(BaseModel):
|
|
username: str = Field(min_length=3, max_length=50)
|
|
password: str = Field(min_length=8)
|
|
|
|
|
|
class Token(BaseModel):
|
|
access_token: str
|
|
token_type: str
|
|
is_admin: bool
|
|
|
|
|
|
@router.post("/register", status_code=status.HTTP_201_CREATED)
|
|
def register(user_in: UserCreate, db: Session = Depends(get_db)):
|
|
existing = db.query(models.User).filter(models.User.username == user_in.username).first()
|
|
if existing:
|
|
raise HTTPException(status_code=400, detail="Username already taken")
|
|
no_users_yet = db.query(models.User).first() is None
|
|
user = models.User(
|
|
username=user_in.username,
|
|
password=hash_password(user_in.password),
|
|
is_admin=no_users_yet,
|
|
)
|
|
db.add(user)
|
|
db.commit()
|
|
return {"message": "User created"}
|
|
|
|
|
|
@router.post("/login", response_model=Token)
|
|
def login(user_in: UserCreate, db: Session = Depends(get_db)):
|
|
user = db.query(models.User).filter(models.User.username == user_in.username).first()
|
|
if not user or not verify_password(user_in.password, user.password):
|
|
raise HTTPException(status_code=401, detail="Invalid credentials")
|
|
token = create_access_token({"sub": user.username})
|
|
return {"access_token": token, "token_type": "bearer", "is_admin": user.is_admin}
|