978 lines
30 KiB
Python
978 lines
30 KiB
Python
"""
|
||
认证相关 API 路由：注册、登录、刷新令牌、登出
|
||
"""
|
||
import uuid
|
||
import io
|
||
import os
|
||
import logging
|
||
import traceback
|
||
import secrets
|
||
from datetime import datetime, timezone
|
||
from pathlib import Path
|
||
from typing import Optional
|
||
from fastapi import APIRouter, Body, Depends, File, HTTPException, UploadFile, status
|
||
from fastapi.security import OAuth2PasswordRequestForm
|
||
from fastapi.responses import FileResponse
|
||
from pydantic import BaseModel, Field
|
||
from sqlalchemy.ext.asyncio import AsyncSession
|
||
from sqlalchemy import select
|
||
from PIL import Image
|
||
|
||
logger = logging.getLogger(__name__)
|
||
|
||
from database import get_async_db
|
||
from database.models import User, RefreshToken
|
||
from services.auth_service import (
|
||
hash_password,
|
||
verify_password,
|
||
create_access_token,
|
||
create_refresh_token,
|
||
get_token_expires_at
|
||
)
|
||
from services.sms_service import send_verification_code, verify_code
|
||
from middleware.auth import get_current_user
|
||
|
||
router = APIRouter(prefix="/api/auth", tags=["auth"])
|
||
|
||
|
||
# 请求模型
|
||
class RegisterRequest(BaseModel):
|
||
"""用户注册请求"""
|
||
phone: str = Field(..., min_length=11, max_length=11, description="手机号（11位）")
|
||
password: str = Field(..., min_length=6, description="密码（至少6位）")
|
||
nickname: str = Field(..., min_length=1, max_length=50, description="昵称")
|
||
email: Optional[str] = Field(None, description="邮箱（可选）")
|
||
agreed_to_terms: bool = Field(..., description="是否同意用户协议和隐私政策")
|
||
|
||
|
||
class LoginRequest(BaseModel):
|
||
"""用户登录请求"""
|
||
phone: str = Field(..., min_length=11, max_length=11, description="手机号（11位）")
|
||
password: str = Field(..., min_length=1, description="密码")
|
||
agreed_to_terms: bool = Field(..., description="是否同意用户协议和隐私政策")
|
||
|
||
|
||
class RefreshTokenRequest(BaseModel):
|
||
"""刷新令牌请求"""
|
||
refresh_token: str = Field(..., description="刷新令牌")
|
||
|
||
|
||
class SmsRequest(BaseModel):
|
||
"""发送短信验证码请求"""
|
||
phone: str = Field(..., min_length=11, max_length=11, description="手机号（11位）")
|
||
purpose: str = Field(..., description="用途：register/login/reset_password/change_phone")
|
||
|
||
|
||
class SmsLoginRequest(BaseModel):
|
||
"""验证码登录/注册请求（统一接口）"""
|
||
phone: str = Field(..., min_length=11, max_length=11, description="手机号（11位）")
|
||
code: str = Field(..., min_length=6, max_length=6, description="验证码（6位）")
|
||
agreed_to_terms: bool = Field(..., description="是否同意用户协议和隐私政策")
|
||
nickname: Optional[str] = Field(None, max_length=50, description="昵称（注册时必填，登录时可选）")
|
||
|
||
|
||
class SmsRegisterRequest(BaseModel):
|
||
"""验证码注册请求"""
|
||
phone: str = Field(..., min_length=11, max_length=11, description="手机号（11位）")
|
||
code: str = Field(..., min_length=6, max_length=6, description="验证码（6位）")
|
||
password: str = Field(..., min_length=6, description="密码（至少6位）")
|
||
nickname: str = Field(..., min_length=1, max_length=50, description="昵称")
|
||
email: Optional[str] = Field(None, description="邮箱（可选）")
|
||
agreed_to_terms: bool = Field(..., description="是否同意用户协议和隐私政策")
|
||
|
||
|
||
class ResetPasswordRequest(BaseModel):
|
||
"""重置密码请求"""
|
||
phone: str = Field(..., min_length=11, max_length=11, description="手机号（11位）")
|
||
code: str = Field(..., min_length=6, max_length=6, description="验证码（6位）")
|
||
new_password: str = Field(..., min_length=6, description="新密码（至少6位）")
|
||
|
||
|
||
class ChangePasswordRequest(BaseModel):
|
||
"""修改密码请求"""
|
||
old_password: str = Field(..., min_length=1, description="旧密码")
|
||
new_password: str = Field(..., min_length=6, description="新密码（至少6位）")
|
||
|
||
|
||
class ChangePhoneRequest(BaseModel):
|
||
"""修改手机号请求"""
|
||
new_phone: str = Field(..., min_length=11, max_length=11, description="新手机号（11位）")
|
||
code: str = Field(..., min_length=6, max_length=6, description="验证码（6位）")
|
||
|
||
|
||
class UpdateNicknameRequest(BaseModel):
|
||
"""更新昵称请求"""
|
||
nickname: str = Field(..., min_length=1, max_length=50, description="昵称（1-50个字符）")
|
||
|
||
|
||
# 响应模型
|
||
class TokenResponse(BaseModel):
|
||
"""令牌响应"""
|
||
access_token: str
|
||
refresh_token: str
|
||
token_type: str = "bearer"
|
||
|
||
|
||
class UserResponse(BaseModel):
|
||
"""用户信息响应"""
|
||
id: str
|
||
phone: str
|
||
email: Optional[str]
|
||
nickname: str
|
||
avatar_url: Optional[str]
|
||
subscription_type: str
|
||
created_at: str
|
||
|
||
|
||
@router.post("/register", response_model=TokenResponse, status_code=status.HTTP_201_CREATED)
|
||
async def register(
|
||
request: RegisterRequest,
|
||
db: AsyncSession = Depends(get_async_db)
|
||
):
|
||
"""
|
||
用户注册
|
||
|
||
注册成功后返回访问令牌和刷新令牌
|
||
"""
|
||
# 验证是否同意用户协议和隐私政策
|
||
if not request.agreed_to_terms:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_400_BAD_REQUEST,
|
||
detail="请先阅读并同意用户协议和隐私政策"
|
||
)
|
||
|
||
# 检查手机号是否已存在
|
||
stmt = select(User).where(User.phone == request.phone)
|
||
result = await db.execute(stmt)
|
||
existing_user = result.scalar_one_or_none()
|
||
|
||
if existing_user:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_400_BAD_REQUEST,
|
||
detail="该手机号已被注册"
|
||
)
|
||
|
||
# 检查邮箱是否已存在（如果提供了邮箱）
|
||
if request.email:
|
||
stmt = select(User).where(User.email == request.email)
|
||
result = await db.execute(stmt)
|
||
existing_email = result.scalar_one_or_none()
|
||
|
||
if existing_email:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_400_BAD_REQUEST,
|
||
detail="该邮箱已被注册"
|
||
)
|
||
|
||
# 创建新用户
|
||
user_id = str(uuid.uuid4())
|
||
password_hash = hash_password(request.password)
|
||
|
||
user = User(
|
||
id=user_id,
|
||
phone=request.phone,
|
||
password_hash=password_hash,
|
||
email=request.email,
|
||
nickname=request.nickname,
|
||
subscription_type="free",
|
||
created_at=datetime.now(timezone.utc)
|
||
)
|
||
|
||
db.add(user)
|
||
|
||
# 创建刷新令牌
|
||
refresh_token_str = create_refresh_token()
|
||
refresh_token = RefreshToken(
|
||
id=str(uuid.uuid4()),
|
||
user_id=user_id,
|
||
token=refresh_token_str,
|
||
expires_at=get_token_expires_at(),
|
||
created_at=datetime.now(timezone.utc)
|
||
)
|
||
|
||
db.add(refresh_token)
|
||
await db.commit()
|
||
await db.refresh(user)
|
||
|
||
# 生成访问令牌
|
||
access_token = create_access_token(data={"sub": user_id})
|
||
|
||
return TokenResponse(
|
||
access_token=access_token,
|
||
refresh_token=refresh_token_str,
|
||
token_type="bearer"
|
||
)
|
||
|
||
|
||
@router.post("/login", response_model=TokenResponse)
|
||
async def login(
|
||
request: LoginRequest = Body(...),
|
||
db: AsyncSession = Depends(get_async_db)
|
||
):
|
||
"""
|
||
用户登录
|
||
|
||
验证手机号和密码，返回访问令牌和刷新令牌。
|
||
|
||
请求格式：
|
||
- JSON: {"phone": "13800138000", "password": "xxx", "agreed_to_terms": true}
|
||
"""
|
||
# 验证是否同意用户协议和隐私政策
|
||
if not request.agreed_to_terms:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_400_BAD_REQUEST,
|
||
detail="请先阅读并同意用户协议和隐私政策"
|
||
)
|
||
|
||
phone = request.phone
|
||
password = request.password
|
||
|
||
# 验证手机号格式（简单验证）
|
||
if not phone or len(phone) != 11 or not phone.isdigit():
|
||
raise HTTPException(
|
||
status_code=status.HTTP_400_BAD_REQUEST,
|
||
detail="手机号格式不正确，应为11位数字"
|
||
)
|
||
|
||
# 验证密码不为空
|
||
if not password:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_400_BAD_REQUEST,
|
||
detail="密码不能为空"
|
||
)
|
||
|
||
# 查找用户
|
||
stmt = select(User).where(User.phone == phone)
|
||
result = await db.execute(stmt)
|
||
user = result.scalar_one_or_none()
|
||
|
||
if not user:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_401_UNAUTHORIZED,
|
||
detail="手机号或密码错误"
|
||
)
|
||
|
||
# 验证密码
|
||
if not verify_password(password, user.password_hash):
|
||
raise HTTPException(
|
||
status_code=status.HTTP_401_UNAUTHORIZED,
|
||
detail="手机号或密码错误"
|
||
)
|
||
|
||
# 创建新的刷新令牌
|
||
refresh_token_str = create_refresh_token()
|
||
refresh_token = RefreshToken(
|
||
id=str(uuid.uuid4()),
|
||
user_id=user.id,
|
||
token=refresh_token_str,
|
||
expires_at=get_token_expires_at(),
|
||
created_at=datetime.now(timezone.utc)
|
||
)
|
||
|
||
db.add(refresh_token)
|
||
await db.commit()
|
||
|
||
# 生成访问令牌
|
||
access_token = create_access_token(data={"sub": user.id})
|
||
|
||
return TokenResponse(
|
||
access_token=access_token,
|
||
refresh_token=refresh_token_str,
|
||
token_type="bearer"
|
||
)
|
||
|
||
|
||
@router.post("/refresh", response_model=TokenResponse)
|
||
async def refresh_token(
|
||
request: RefreshTokenRequest,
|
||
db: AsyncSession = Depends(get_async_db)
|
||
):
|
||
"""
|
||
刷新访问令牌
|
||
|
||
使用刷新令牌获取新的访问令牌
|
||
"""
|
||
# 查找刷新令牌
|
||
stmt = select(RefreshToken).where(RefreshToken.token == request.refresh_token)
|
||
result = await db.execute(stmt)
|
||
refresh_token = result.scalar_one_or_none()
|
||
|
||
if not refresh_token:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_401_UNAUTHORIZED,
|
||
detail="无效的刷新令牌"
|
||
)
|
||
|
||
# 检查是否已撤销
|
||
if refresh_token.is_revoked:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_401_UNAUTHORIZED,
|
||
detail="刷新令牌已撤销"
|
||
)
|
||
|
||
# 检查是否过期
|
||
if refresh_token.expires_at < datetime.now(timezone.utc):
|
||
raise HTTPException(
|
||
status_code=status.HTTP_401_UNAUTHORIZED,
|
||
detail="刷新令牌已过期"
|
||
)
|
||
|
||
# 验证用户是否存在
|
||
user = await db.get(User, refresh_token.user_id)
|
||
if not user:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_401_UNAUTHORIZED,
|
||
detail="用户不存在"
|
||
)
|
||
|
||
# 生成新的访问令牌
|
||
access_token = create_access_token(data={"sub": user.id})
|
||
|
||
return TokenResponse(
|
||
access_token=access_token,
|
||
refresh_token=request.refresh_token, # 返回相同的刷新令牌
|
||
token_type="bearer"
|
||
)
|
||
|
||
|
||
@router.post("/logout", status_code=status.HTTP_200_OK)
|
||
async def logout(
|
||
request: RefreshTokenRequest,
|
||
current_user: User = Depends(get_current_user),
|
||
db: AsyncSession = Depends(get_async_db)
|
||
):
|
||
"""
|
||
用户登出
|
||
|
||
撤销刷新令牌
|
||
"""
|
||
# 查找刷新令牌
|
||
stmt = select(RefreshToken).where(
|
||
RefreshToken.token == request.refresh_token,
|
||
RefreshToken.user_id == current_user.id
|
||
)
|
||
result = await db.execute(stmt)
|
||
refresh_token = result.scalar_one_or_none()
|
||
|
||
if refresh_token:
|
||
refresh_token.is_revoked = True
|
||
await db.commit()
|
||
|
||
return {"message": "登出成功"}
|
||
|
||
|
||
@router.get("/me", response_model=UserResponse)
|
||
async def get_me(
|
||
current_user: User = Depends(get_current_user)
|
||
):
|
||
"""
|
||
获取当前用户信息
|
||
"""
|
||
return UserResponse(
|
||
id=current_user.id,
|
||
phone=current_user.phone,
|
||
email=current_user.email,
|
||
nickname=current_user.nickname,
|
||
avatar_url=current_user.avatar_url,
|
||
subscription_type=current_user.subscription_type,
|
||
created_at=current_user.created_at.isoformat()
|
||
)
|
||
|
||
|
||
# 头像存储目录
|
||
AVATAR_DIR = Path("uploads/avatars")
|
||
AVATAR_DIR.mkdir(parents=True, exist_ok=True)
|
||
|
||
|
||
@router.post("/me/avatar", response_model=UserResponse)
|
||
async def upload_avatar(
|
||
file: UploadFile = File(...),
|
||
current_user: User = Depends(get_current_user),
|
||
db: AsyncSession = Depends(get_async_db)
|
||
):
|
||
"""
|
||
上传用户头像
|
||
|
||
支持格式：JPEG, PNG, WebP
|
||
最大大小：5MB
|
||
自动裁剪为正方形并压缩
|
||
"""
|
||
# 验证文件类型
|
||
allowed_types = ["image/jpeg", "image/png", "image/webp"]
|
||
logger.info(f"上传头像 - 文件名: {file.filename}, Content-Type: {file.content_type}, Size: {file.size if hasattr(file, 'size') else 'unknown'}")
|
||
|
||
if file.content_type not in allowed_types:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_400_BAD_REQUEST,
|
||
detail=f"不支持的文件类型。仅支持: {', '.join(allowed_types)}"
|
||
)
|
||
|
||
# 验证文件大小（5MB）
|
||
file_content = await file.read()
|
||
logger.info(f"读取文件内容 - 大小: {len(file_content)} bytes")
|
||
|
||
# 验证文件内容不为空
|
||
if not file_content or len(file_content) == 0:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_400_BAD_REQUEST,
|
||
detail="文件内容为空"
|
||
)
|
||
|
||
if len(file_content) > 5 * 1024 * 1024:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_400_BAD_REQUEST,
|
||
detail="文件大小超过5MB限制"
|
||
)
|
||
|
||
try:
|
||
# 确保目录存在
|
||
AVATAR_DIR.mkdir(parents=True, exist_ok=True)
|
||
|
||
# 创建BytesIO对象并确保位置在开头
|
||
image_bytes = io.BytesIO(file_content)
|
||
image_bytes.seek(0)
|
||
|
||
# 验证文件是否为有效的图片格式（通过检查文件头）
|
||
image_bytes.seek(0)
|
||
header = image_bytes.read(16) # 读取更多字节以确保能检测WebP
|
||
image_bytes.seek(0)
|
||
|
||
# 检查常见图片格式的文件头
|
||
is_valid_image = False
|
||
if header.startswith(b'\xff\xd8\xff'): # JPEG
|
||
is_valid_image = True
|
||
logger.info("检测到JPEG格式")
|
||
elif header.startswith(b'\x89PNG\r\n\x1a\n'): # PNG
|
||
is_valid_image = True
|
||
logger.info("检测到PNG格式")
|
||
elif header.startswith(b'RIFF') and b'WEBP' in header[:12]: # WebP (RIFF...WEBP)
|
||
is_valid_image = True
|
||
logger.info("检测到WebP格式")
|
||
else:
|
||
logger.warning(f"无法识别的文件头: {header[:12].hex()}")
|
||
|
||
if not is_valid_image:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_400_BAD_REQUEST,
|
||
detail=f"无效的图片文件格式。文件头: {header[:12].hex()}"
|
||
)
|
||
|
||
# 打开并处理图片
|
||
image = Image.open(image_bytes)
|
||
logger.info(f"成功打开图片 - 格式: {image.format}, 模式: {image.mode}, 尺寸: {image.size}")
|
||
|
||
# 转换为RGB模式（处理RGBA等格式）
|
||
if image.mode != "RGB":
|
||
image = image.convert("RGB")
|
||
|
||
# 裁剪为正方形（取中心部分）
|
||
width, height = image.size
|
||
size = min(width, height)
|
||
left = (width - size) // 2
|
||
top = (height - size) // 2
|
||
right = left + size
|
||
bottom = top + size
|
||
image = image.crop((left, top, right, bottom))
|
||
|
||
# 调整大小（最大512x512）
|
||
if size > 512:
|
||
image = image.resize((512, 512), Image.Resampling.LANCZOS)
|
||
|
||
# 生成文件名（使用用户ID）
|
||
file_extension = "jpg"
|
||
filename = f"{current_user.id}.{file_extension}"
|
||
file_path = AVATAR_DIR / filename
|
||
|
||
# 保存图片（JPEG格式，质量85%）
|
||
image.save(file_path, "JPEG", quality=85, optimize=True)
|
||
|
||
# 生成URL（相对路径，前端需要拼接BASE_URL）
|
||
avatar_url = f"/api/auth/avatars/{filename}"
|
||
|
||
# 更新数据库
|
||
current_user.avatar_url = avatar_url
|
||
await db.commit()
|
||
await db.refresh(current_user)
|
||
|
||
return UserResponse(
|
||
id=current_user.id,
|
||
phone=current_user.phone,
|
||
email=current_user.email,
|
||
nickname=current_user.nickname,
|
||
avatar_url=current_user.avatar_url,
|
||
subscription_type=current_user.subscription_type,
|
||
created_at=current_user.created_at.isoformat()
|
||
)
|
||
except Exception as e:
|
||
error_msg = f"处理图片失败: {str(e)}"
|
||
logger.error(f"头像上传失败: {error_msg}\n{traceback.format_exc()}")
|
||
raise HTTPException(
|
||
status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
|
||
detail=error_msg
|
||
)
|
||
|
||
|
||
@router.get("/avatars/{filename}")
|
||
async def get_avatar(filename: str):
|
||
"""
|
||
获取用户头像
|
||
|
||
返回头像文件，如果不存在则返回404
|
||
"""
|
||
file_path = AVATAR_DIR / filename
|
||
|
||
if not file_path.exists():
|
||
raise HTTPException(
|
||
status_code=status.HTTP_404_NOT_FOUND,
|
||
detail="头像不存在"
|
||
)
|
||
|
||
return FileResponse(
|
||
file_path,
|
||
media_type="image/jpeg"
|
||
)
|
||
|
||
|
||
# ============================================================================
|
||
# 短信验证码相关路由
|
||
# ============================================================================
|
||
|
||
@router.post("/sms/send")
|
||
async def send_sms_code(
|
||
request: SmsRequest,
|
||
db: AsyncSession = Depends(get_async_db)
|
||
):
|
||
"""
|
||
发送短信验证码
|
||
|
||
用途：
|
||
- login: 登录/注册（统一接口，用户不存在时自动注册）
|
||
- register: 注册（保留兼容，建议使用login）
|
||
- reset_password: 重置密码
|
||
- change_phone: 修改手机号
|
||
"""
|
||
# 验证手机号格式
|
||
if not request.phone.isdigit():
|
||
raise HTTPException(
|
||
status_code=status.HTTP_400_BAD_REQUEST,
|
||
detail="手机号格式不正确"
|
||
)
|
||
|
||
# 验证用途
|
||
valid_purposes = ["register", "login", "reset_password", "change_phone"]
|
||
if request.purpose not in valid_purposes:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_400_BAD_REQUEST,
|
||
detail=f"无效的用途，必须是: {', '.join(valid_purposes)}"
|
||
)
|
||
|
||
# 对于注册，检查手机号是否已存在
|
||
if request.purpose == "register":
|
||
stmt = select(User).where(User.phone == request.phone)
|
||
result = await db.execute(stmt)
|
||
existing_user = result.scalar_one_or_none()
|
||
if existing_user:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_400_BAD_REQUEST,
|
||
detail="该手机号已被注册"
|
||
)
|
||
|
||
# 对于重置密码，检查手机号是否存在
|
||
if request.purpose == "reset_password":
|
||
stmt = select(User).where(User.phone == request.phone)
|
||
result = await db.execute(stmt)
|
||
user = result.scalar_one_or_none()
|
||
if not user:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_404_NOT_FOUND,
|
||
detail="该手机号未注册"
|
||
)
|
||
|
||
# 对于登录，不再检查用户是否存在，允许自动注册
|
||
# 发送验证码时统一使用login目的，登录接口会自动处理注册逻辑
|
||
|
||
# 发送验证码
|
||
success, message, expires_in = await send_verification_code(
|
||
db=db,
|
||
phone=request.phone,
|
||
purpose=request.purpose,
|
||
ip_address=None # TODO: 从request中获取IP地址
|
||
)
|
||
|
||
if not success:
|
||
# 根据错误类型返回适当的HTTP状态码
|
||
if "频繁" in message:
|
||
status_code = status.HTTP_429_TOO_MANY_REQUESTS
|
||
elif "配置" in message or "配置错误" in message or "授权失败" in message:
|
||
# 配置错误或授权失败，返回503服务不可用
|
||
status_code = status.HTTP_503_SERVICE_UNAVAILABLE
|
||
else:
|
||
# 其他错误返回500内部服务器错误
|
||
status_code = status.HTTP_500_INTERNAL_SERVER_ERROR
|
||
|
||
raise HTTPException(
|
||
status_code=status_code,
|
||
detail=message
|
||
)
|
||
|
||
return {"message": message, "expires_in": expires_in}
|
||
|
||
|
||
@router.post("/login/sms", response_model=TokenResponse)
|
||
async def login_with_sms(
|
||
request: SmsLoginRequest,
|
||
db: AsyncSession = Depends(get_async_db)
|
||
):
|
||
"""
|
||
验证码登录/注册（统一接口）
|
||
|
||
使用手机号和验证码登录，如果用户不存在则自动注册。
|
||
注册时需要提供昵称。
|
||
"""
|
||
# 验证是否同意用户协议和隐私政策
|
||
if not request.agreed_to_terms:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_400_BAD_REQUEST,
|
||
detail="请先阅读并同意用户协议和隐私政策"
|
||
)
|
||
|
||
# 验证验证码（支持login和register两种目的，兼容旧流程）
|
||
# 先尝试用login验证，如果失败再尝试register验证
|
||
success = False
|
||
message = ""
|
||
|
||
for purpose in ["login", "register"]:
|
||
success, message = await verify_code(
|
||
db=db,
|
||
phone=request.phone,
|
||
code=request.code,
|
||
purpose=purpose
|
||
)
|
||
if success:
|
||
break
|
||
|
||
if not success:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_400_BAD_REQUEST,
|
||
detail=message
|
||
)
|
||
|
||
# 查找用户
|
||
stmt = select(User).where(User.phone == request.phone)
|
||
result = await db.execute(stmt)
|
||
user = result.scalar_one_or_none()
|
||
|
||
# 如果用户不存在，自动注册
|
||
if not user:
|
||
# 创建新用户
|
||
user_id = str(uuid.uuid4())
|
||
# 生成一个随机密码（用户不会用到，但数据库要求必填）
|
||
random_password = secrets.token_urlsafe(32)
|
||
password_hash = hash_password(random_password)
|
||
|
||
# 如果提供了昵称就使用，否则使用空字符串（表示需要后续设置）
|
||
nickname = request.nickname.strip() if request.nickname else ""
|
||
|
||
user = User(
|
||
id=user_id,
|
||
phone=request.phone,
|
||
password_hash=password_hash,
|
||
email=None,
|
||
nickname=nickname,
|
||
subscription_type="free",
|
||
created_at=datetime.now(timezone.utc)
|
||
)
|
||
|
||
db.add(user)
|
||
await db.commit()
|
||
await db.refresh(user)
|
||
|
||
# 创建刷新令牌
|
||
refresh_token_str = create_refresh_token()
|
||
refresh_token = RefreshToken(
|
||
id=str(uuid.uuid4()),
|
||
user_id=user.id,
|
||
token=refresh_token_str,
|
||
expires_at=get_token_expires_at(),
|
||
created_at=datetime.now(timezone.utc)
|
||
)
|
||
|
||
db.add(refresh_token)
|
||
await db.commit()
|
||
|
||
# 生成访问令牌
|
||
access_token = create_access_token(data={"sub": user.id})
|
||
|
||
return TokenResponse(
|
||
access_token=access_token,
|
||
refresh_token=refresh_token_str,
|
||
token_type="bearer"
|
||
)
|
||
|
||
|
||
@router.post("/register/sms", response_model=TokenResponse, status_code=status.HTTP_201_CREATED)
|
||
async def register_with_sms(
|
||
request: SmsRegisterRequest,
|
||
db: AsyncSession = Depends(get_async_db)
|
||
):
|
||
"""
|
||
验证码注册
|
||
|
||
使用验证码验证后完成注册
|
||
"""
|
||
# 验证是否同意用户协议和隐私政策
|
||
if not request.agreed_to_terms:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_400_BAD_REQUEST,
|
||
detail="请先阅读并同意用户协议和隐私政策"
|
||
)
|
||
|
||
# 验证验证码
|
||
success, message = await verify_code(
|
||
db=db,
|
||
phone=request.phone,
|
||
code=request.code,
|
||
purpose="register"
|
||
)
|
||
|
||
if not success:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_400_BAD_REQUEST,
|
||
detail=message
|
||
)
|
||
|
||
# 检查手机号是否已存在（双重验证）
|
||
stmt = select(User).where(User.phone == request.phone)
|
||
result = await db.execute(stmt)
|
||
existing_user = result.scalar_one_or_none()
|
||
|
||
if existing_user:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_400_BAD_REQUEST,
|
||
detail="该手机号已被注册"
|
||
)
|
||
|
||
# 检查邮箱是否已存在（如果提供了邮箱）
|
||
if request.email:
|
||
stmt = select(User).where(User.email == request.email)
|
||
result = await db.execute(stmt)
|
||
existing_email = result.scalar_one_or_none()
|
||
|
||
if existing_email:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_400_BAD_REQUEST,
|
||
detail="该邮箱已被注册"
|
||
)
|
||
|
||
# 创建新用户
|
||
user_id = str(uuid.uuid4())
|
||
password_hash = hash_password(request.password)
|
||
|
||
user = User(
|
||
id=user_id,
|
||
phone=request.phone,
|
||
password_hash=password_hash,
|
||
email=request.email,
|
||
nickname=request.nickname,
|
||
subscription_type="free",
|
||
created_at=datetime.now(timezone.utc)
|
||
)
|
||
|
||
db.add(user)
|
||
|
||
# 创建刷新令牌
|
||
refresh_token_str = create_refresh_token()
|
||
refresh_token = RefreshToken(
|
||
id=str(uuid.uuid4()),
|
||
user_id=user_id,
|
||
token=refresh_token_str,
|
||
expires_at=get_token_expires_at(),
|
||
created_at=datetime.now(timezone.utc)
|
||
)
|
||
|
||
db.add(refresh_token)
|
||
await db.commit()
|
||
await db.refresh(user)
|
||
|
||
# 生成访问令牌
|
||
access_token = create_access_token(data={"sub": user_id})
|
||
|
||
return TokenResponse(
|
||
access_token=access_token,
|
||
refresh_token=refresh_token_str,
|
||
token_type="bearer"
|
||
)
|
||
|
||
|
||
@router.post("/password/reset")
|
||
async def reset_password(
|
||
request: ResetPasswordRequest,
|
||
db: AsyncSession = Depends(get_async_db)
|
||
):
|
||
"""
|
||
重置密码（忘记密码）
|
||
|
||
使用验证码重置密码
|
||
"""
|
||
# 验证验证码
|
||
success, message = await verify_code(
|
||
db=db,
|
||
phone=request.phone,
|
||
code=request.code,
|
||
purpose="reset_password"
|
||
)
|
||
|
||
if not success:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_400_BAD_REQUEST,
|
||
detail=message
|
||
)
|
||
|
||
# 查找用户
|
||
stmt = select(User).where(User.phone == request.phone)
|
||
result = await db.execute(stmt)
|
||
user = result.scalar_one_or_none()
|
||
|
||
if not user:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_404_NOT_FOUND,
|
||
detail="用户不存在"
|
||
)
|
||
|
||
# 更新密码
|
||
user.password_hash = hash_password(request.new_password)
|
||
await db.commit()
|
||
|
||
return {"message": "密码重置成功"}
|
||
|
||
|
||
@router.post("/password/change")
|
||
async def change_password(
|
||
request: ChangePasswordRequest,
|
||
current_user: User = Depends(get_current_user),
|
||
db: AsyncSession = Depends(get_async_db)
|
||
):
|
||
"""
|
||
修改密码（已登录）
|
||
|
||
需要验证旧密码
|
||
"""
|
||
# 验证旧密码
|
||
if not verify_password(request.old_password, current_user.password_hash):
|
||
raise HTTPException(
|
||
status_code=status.HTTP_400_BAD_REQUEST,
|
||
detail="旧密码错误"
|
||
)
|
||
|
||
# 更新密码
|
||
current_user.password_hash = hash_password(request.new_password)
|
||
await db.commit()
|
||
|
||
return {"message": "密码修改成功"}
|
||
|
||
|
||
@router.post("/phone/change", response_model=UserResponse)
|
||
async def change_phone(
|
||
request: ChangePhoneRequest,
|
||
current_user: User = Depends(get_current_user),
|
||
db: AsyncSession = Depends(get_async_db)
|
||
):
|
||
"""
|
||
修改手机号
|
||
|
||
需要验证新手机号的验证码
|
||
"""
|
||
# 验证验证码
|
||
success, message = await verify_code(
|
||
db=db,
|
||
phone=request.new_phone,
|
||
code=request.code,
|
||
purpose="change_phone"
|
||
)
|
||
|
||
if not success:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_400_BAD_REQUEST,
|
||
detail=message
|
||
)
|
||
|
||
# 检查新手机号是否已被使用
|
||
stmt = select(User).where(User.phone == request.new_phone)
|
||
result = await db.execute(stmt)
|
||
existing_user = result.scalar_one_or_none()
|
||
|
||
if existing_user and existing_user.id != current_user.id:
|
||
raise HTTPException(
|
||
status_code=status.HTTP_400_BAD_REQUEST,
|
||
detail="该手机号已被其他用户使用"
|
||
)
|
||
|
||
# 更新手机号
|
||
current_user.phone = request.new_phone
|
||
await db.commit()
|
||
await db.refresh(current_user)
|
||
|
||
return UserResponse(
|
||
id=current_user.id,
|
||
phone=current_user.phone,
|
||
email=current_user.email,
|
||
nickname=current_user.nickname,
|
||
avatar_url=current_user.avatar_url,
|
||
subscription_type=current_user.subscription_type,
|
||
created_at=current_user.created_at.isoformat()
|
||
)
|
||
|
||
|
||
@router.put("/me/nickname", response_model=UserResponse)
|
||
async def update_nickname(
|
||
request: UpdateNicknameRequest,
|
||
current_user: User = Depends(get_current_user),
|
||
db: AsyncSession = Depends(get_async_db)
|
||
):
|
||
"""
|
||
更新用户昵称
|
||
|
||
用于首次登录后设置昵称，或修改现有昵称
|
||
"""
|
||
# 更新昵称
|
||
current_user.nickname = request.nickname.strip()
|
||
await db.commit()
|
||
await db.refresh(current_user)
|
||
|
||
return UserResponse(
|
||
id=current_user.id,
|
||
phone=current_user.phone,
|
||
email=current_user.email,
|
||
nickname=current_user.nickname,
|
||
avatar_url=current_user.avatar_url,
|
||
subscription_type=current_user.subscription_type,
|
||
created_at=current_user.created_at.isoformat()
|
||
)
|
||
|
||
|
||
@router.post("/logout/all")
|
||
async def logout_all_devices(
|
||
current_user: User = Depends(get_current_user),
|
||
db: AsyncSession = Depends(get_async_db)
|
||
):
|
||
"""
|
||
登出所有设备
|
||
|
||
撤销当前用户的所有刷新令牌
|
||
"""
|
||
# 查找用户的所有刷新令牌
|
||
stmt = select(RefreshToken).where(
|
||
RefreshToken.user_id == current_user.id,
|
||
RefreshToken.is_revoked == False
|
||
)
|
||
result = await db.execute(stmt)
|
||
tokens = result.scalars().all()
|
||
|
||
# 撤销所有令牌
|
||
for token in tokens:
|
||
token.is_revoked = True
|
||
|
||
await db.commit()
|
||
|
||
return {"message": f"已登出所有设备，共撤销 {len(tokens)} 个令牌"}
|