Jonathan Kirkwood
f0f8fd15c6
Snapshot commit bringing the uncommitted phase-2 work into version control
together with four new features and the 0.2.22 version bump.
New features:
- Investor capital-over-time chart (value, paid-in, distributions per
quarter), rendered from existing capital-account history.
- Admin Investor View: read-only reconstruction of an investor's portal
(GET /api/users/{id}/investor-view), reusing the investor portal UI.
- Document upload scoped to the selected fund's own investors, with an
explicit upload-target confirmation to prevent mis-attaching.
- GP/mgmt entities gain an Assets tab listing their stakes in the funds
they manage (new entity_stakes table + /api/entities/{id}/stakes).
- Edit-entity form (change type/status/etc.), so GP entities can be
categorized correctly.
Verified: 11/11 backend tests pass; alembic upgrades to head b8c9d0e1f2a3;
frontend tsc + vite build clean; s9pk packs at 0.2.22:0 (x86_64).
Also: ignore .DS_Store and *.s9pk artifacts.
66 lines
2.5 KiB
Python
66 lines
2.5 KiB
Python
"""Authentication endpoints."""
|
|
|
|
from fastapi import APIRouter, Depends, HTTPException, Request
|
|
from sqlmodel import Session, select
|
|
|
|
from ten31portal.auth import get_current_user, hash_password, verify_password
|
|
from ten31portal.database import get_session
|
|
from ten31portal.models import User
|
|
from ten31portal.schemas import ChangePasswordRequest, LoginRequest, UserResponse
|
|
|
|
router = APIRouter(prefix="/api/auth", tags=["auth"])
|
|
|
|
|
|
@router.post("/login")
|
|
def login(
|
|
body: LoginRequest,
|
|
request: Request,
|
|
session: Session = Depends(get_session),
|
|
) -> UserResponse:
|
|
# Accept either a username or an email in the login field.
|
|
handle = body.login.strip()
|
|
user = session.exec(select(User).where(User.username == handle)).first()
|
|
if user is None:
|
|
user = session.exec(select(User).where(User.email == handle)).first()
|
|
if user is None or not verify_password(body.password, user.password_hash):
|
|
raise HTTPException(status_code=401, detail="Invalid username or password")
|
|
if user.primary_account_id is not None:
|
|
raise HTTPException(
|
|
status_code=401,
|
|
detail="This account signs in under another login. Use that account's credentials.",
|
|
)
|
|
if not user.login_enabled:
|
|
raise HTTPException(status_code=401, detail="This account does not have a login yet.")
|
|
if not user.is_active:
|
|
raise HTTPException(status_code=401, detail="Account disabled")
|
|
request.session["user_id"] = user.id
|
|
return UserResponse.model_validate(user, from_attributes=True)
|
|
|
|
|
|
@router.post("/logout")
|
|
def logout(request: Request) -> dict[str, str]:
|
|
request.session.clear()
|
|
return {"status": "ok"}
|
|
|
|
|
|
@router.get("/me")
|
|
def me(user: User = Depends(get_current_user)) -> UserResponse:
|
|
return UserResponse.model_validate(user, from_attributes=True)
|
|
|
|
|
|
@router.post("/change-password")
|
|
def change_password(
|
|
body: ChangePasswordRequest,
|
|
user: User = Depends(get_current_user),
|
|
session: Session = Depends(get_session),
|
|
) -> dict[str, str]:
|
|
"""Let the signed-in user set their own password (after confirming the current one)."""
|
|
if not verify_password(body.current_password, user.password_hash):
|
|
raise HTTPException(status_code=400, detail="Current password is incorrect.")
|
|
if len(body.new_password) < 4:
|
|
raise HTTPException(status_code=400, detail="New password must be at least 4 characters.")
|
|
user.password_hash = hash_password(body.new_password)
|
|
session.add(user)
|
|
session.commit()
|
|
return {"status": "ok"}
|