auth.py

from datetime import datetime, timedelta
from jose import JWTError, jwt
from passlib.context import CryptContext
from fastapi import Depends, HTTPException, status
from fastapi.security import OAuth2PasswordBearer
from sqlalchemy.orm import Session
import models
from database import get_db


# PASSWORD HASHING SETUP 
# This creates a "password context" using argon2 algorithm
pwd_context = CryptContext(schemes=["argon2"], deprecated="auto")


#  JWT TOKEN SETTINGS 

# Secret key to sign JWT tokens (like a password for creating tokens)
#  IMPORTANT: In production, use a real secret key and keep it secret!
SECRET_KEY = "09d25e094faa6ca2556c818166b7a9563b93f7099f6f0f4caa6cf63b88e8d3e7"
ALGORITHM = "HS256"  # Algorithm to sign tokens
ACCESS_TOKEN_EXPIRE_MINUTES = 30  # Token expires after 30 minutes


# This tells FastAPI where to look for the token
# tokenUrl="login" means tokens come from POST /login endpoint
oauth2_scheme = OAuth2PasswordBearer(tokenUrl="login")


#PASSWORD FUNCTIONS 

def verify_password(plain_password: str, hashed_password: str) -> bool:
    """
    Check if plain password matches hashed password
    
    Args:
        plain_password: Password user typed (e.g., "secret123")
        hashed_password: Hashed password from database (e.g., "$2b$12$...")
    
    Returns:
        True if passwords match, False otherwise
    
    Example:
        verify_password("secret123", "$2b$12$Eix...") → True
        verify_password("wrong", "$2b$12$Eix...") → False
    """
    return pwd_context.verify(plain_password, hashed_password)


def get_password_hash(password: str) -> str:
    """
    Hash a plain password for secure storage
    
    Args:
        password: Plain password (e.g., "secret123")
    
    Returns:
        Hashed password (e.g., "$2b$12$EixZaYVK1fsbw1ZfbX3OXe...")
    
    Example:
        get_password_hash("secret123") → "$2b$12$Eix..."
    
    Note: Same password will create different hashes each time (salt)!
    """
    return pwd_context.hash(password)


# JWT TOKEN FUNCTION

def create_access_token(data: dict) -> str:
    """
    Create a JWT access token
    
    Args:
        data: Dictionary with data to encode in token (usually {"sub": username})
    
    Returns:
        JWT token as a string
    
    Example:
        create_access_token({"sub": "mukesh"}) 
        → "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
    
    The token includes:
        - The data you provide
        - Expiration time (30 minutes from now)
        - Signature (so it can't be faked!)
    """
    to_encode = data.copy()
    
    # Add expiration time to token
    expire = datetime.utcnow() + timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
    to_encode.update({"exp": expire})
    
    # Create and sign the token
    encoded_jwt = jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)
    return encoded_jwt


def decode_token(token: str) -> dict:
    """
    Decode and verify a JWT token
    
    Args:
        token: JWT token string
    
    Returns:
        Dictionary with decoded data
    
    Raises:
        JWTError: If token is invalid or expired
    """
    try:
        payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
        return payload
    except JWTError:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Could not validate credentials",
            headers={"WWW-Authenticate": "Bearer"},
        )


#  GET CURRENT USER 
def get_current_user(
    token: str = Depends(oauth2_scheme), 
    db: Session = Depends(get_db)
) -> models.User:
    """
    Get the current logged-in user from JWT token
    
    This is the MAGIC function that protects your endpoints!
    
    How it works:
    1. FastAPI extracts token from Authorization header
    2. We decode the token to get username
    3. We look up user in database
    4. We return the user object
    
    Args:
        token: JWT token (automatically extracted from header)
        db: Database session (automatically injected)
    
    Returns:
        User object of the logged-in user
    
    Raises:
        HTTPException 401: If token is invalid or user not found
    
    Usage in endpoints:
        @app.get("/tasks/")
        def get_tasks(current_user: User = Depends(get_current_user)):
            # current_user is now the logged-in user!
            return current_user.tasks
    """
    credentials_exception = HTTPException(
        status_code=status.HTTP_401_UNAUTHORIZED,
        detail="Could not validate credentials",
        headers={"WWW-Authenticate": "Bearer"},
    )
    
    try:
        # Decode the token
        payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
        username: str = payload.get("sub")
        
        if username is None:
            raise credentials_exception
            
    except JWTError:
        raise credentials_exception
    
    # Look up user in database
    user = db.query(models.User).filter(models.User.username == username).first()
    
    if user is None:
        raise credentials_exception
    
    return user