Merge: accept incoming changes for conflicted files

Author: talbarr14

.claude/settings.local.json

@@ -6,6 +6,8 @@ __pycache__/
 # C extensions
 *.so
 
+.claude
+
 # Distribution / packaging
 .Python
 build/

.gitignore

@@ -47,10 +47,12 @@ dependencies = [
     "typing-inspection==0.4.2",
     "urllib3==2.6.3",
     "uvicorn==0.42.0",
+    "pytest-cov>=7.1.0",
 ]
 
 [tool.pytest.ini_options]
 pythonpath = ["."]
+addopts = "--cov=src --cov-report=term-missing --cov-fail-under=50"
 filterwarnings = [
     "ignore:datetime.datetime.utcnow\\(\\) is deprecated:DeprecationWarning",
     "ignore:The `dict` method is deprecated:DeprecationWarning",

.tmp_enum_check.py

@@ -6,7 +6,7 @@
 from fastapi.middleware.cors import CORSMiddleware
 
 from src import config
-from src.api.dependencies import get_account_from_bearer
+from src.api.dependencies import get_active_account
 from src.database.session import get_session
 from src.database.account.models import Account, Notification
 
@@ -20,10 +20,10 @@
 from src.api.roles.client.client import router as client_router
 from src.api.roles.shared.fitness import router as shared_fitness_router
 from src.api.roles.shared.account import router as shared_account_router
-from src.api.roles.shared.chat import router as shared_chat_router
-from src.api.roles.shared.client_coach_relationship import router as shared_client_coach_relationship_router
-from src.api.roles.shared.notifications import router as shared_notifications_router
-from src.api.roles.client.fitness import router as client_fitness_router
+from src.api.roles.shared.chat import router as shared_chat_router
+from src.api.roles.shared.client_coach_relationship import router as shared_client_coach_relationship_router
+from src.api.roles.shared.notifications import router as shared_notifications_router
+from src.api.roles.client.fitness import router as client_fitness_router
 from src.api.roles.client.telemetry import router as client_telemetry_router
 from src.api.roles.coach.fitness import router as coach_fitness_router
 from src.api.roles.admin.admin import router as admin_router
@@ -43,16 +43,16 @@
 app.include_router(client_router)
 app.include_router(shared_fitness_router)
 app.include_router(shared_account_router)
-app.include_router(shared_chat_router)
-app.include_router(shared_client_coach_relationship_router)
-app.include_router(shared_notifications_router)
-app.include_router(client_fitness_router)
+app.include_router(shared_chat_router)
+app.include_router(shared_client_coach_relationship_router)
+app.include_router(shared_notifications_router)
+app.include_router(client_fitness_router)
 app.include_router(client_telemetry_router)
 app.include_router(coach_fitness_router)
 app.include_router(admin_router)
 
 @app.get("/me")  # get_current_account assumes they pass a valid jwt as bearer
-def read_current_account(user = Depends(get_account_from_bearer)):
+def read_current_account(user = Depends(get_active_account)):
     return serialize_account(user)
 
 @app.get("/")

pyproject.toml

@@ -5,11 +5,14 @@
 import os
 import secrets
 import requests
+from jose import JWTError, jwt
+from datetime import datetime, timedelta
+from src import config
 
 from src.api.auth.domain import AuthTokenResponse, LoginRequest, SignupRequest
 from src.api.auth.services import create_account
 from src.api.dependencies import authenticate_user, create_jwt_token
-from src.api.dependencies import get_account_from_bearer
+from src.api.dependencies import get_account_even_if_inactive
 
 from src.database.account.models import Account
 from src.database.session import get_session
@@ -23,10 +26,13 @@ def issue_token(user: Account) -> AuthTokenResponse:
     return AuthTokenResponse(access_token=token)
 
 @router.get("/roles")
-def read_current_roles(user = Depends(get_account_from_bearer), db = Depends(get_session)):
+def read_current_roles(user: Account = Depends(get_account_even_if_inactive), db = Depends(get_session)):
     """Returns a list of the current user's roles. Mainly for frontend role-based rendering."""
     roles: list[str] = []
 
+    if not user.is_active:
+        return ["deactivated"]
+
     if user.client_id is not None:
         roles.append("client")
 
@@ -97,45 +103,62 @@ def token(
     return issue_token(user)
 
 
-@router.get("/google")
-def google_oauth(request: Request, code: str | None = None, state: str | None = None, db: Session = Depends(get_session)):
-    """
-    OAuth2 Authorization Code flow for Google.
+from fastapi.responses import JSONResponse
 
-    - Calling GET /auth/google with no query params redirects to Google's consent screen.
+@router.get("/google/url")
+def google_oauth_url():
+    """
+    Returns the Google OAuth login URL and sets the OAuth state cookie.
     """
-
     client_id = os.getenv("GCP_CLIENT_ID")
     client_secret = os.getenv("GCP_CLIENT_SECRET")
     if not client_id or not client_secret:
         raise HTTPException(status_code=500, detail="GCP_CLIENT_ID and GCP_CLIENT_SECRET must be configured")
 
-    redirect_uri =  "https://api.till-failure.us/auth/google"
+    redirect_uri = os.getenv("OAUTH_REDIRECT_URI", "https://api.till-failure.us/auth/google")
 
-    if code is None:
-        oauth_state = secrets.token_urlsafe(16)
-        params = {
-            "client_id": client_id,
-            "response_type": "code",
-            "scope": "openid email profile",
-            "redirect_uri": redirect_uri,
-            "state": oauth_state,
-            "access_type": "offline",
-            "prompt": "consent",
-        }
-        url = "https://accounts.google.com/o/oauth2/v2/auth"
-        qs = "?" + "&".join(f"{k}={requests.utils.requote_uri(str(v))}" for k, v in params.items())
-        resp = RedirectResponse(url + qs)
-        
-        #  store state in a cookie to verify on callback
-        resp.set_cookie("oauth_state", oauth_state, httponly=True, secure=True, samesite="lax")
-        return resp
+    oauth_state = secrets.token_urlsafe(16)
+    # create signed state to make flow completely stateless
+    to_encode = {"state": oauth_state, "exp": datetime.utcnow() + timedelta(minutes=15)}
+    signed_state = jwt.encode(to_encode, config.JWT_SECRET, algorithm=config.ALGORITHM)
+
+    params = {
+        "client_id": client_id,
+        "response_type": "code",
+        "scope": "openid email profile",
+        "redirect_uri": redirect_uri,
+        "state": signed_state,
+        "access_type": "offline",
+        "prompt": "consent",
+    }
+    url = "https://accounts.google.com/o/oauth2/v2/auth"
+    qs = "?" + "&".join(f"{k}={requests.utils.requote_uri(str(v))}" for k, v in params.items())
+    
+    return JSONResponse({"url": url + qs})
 
-    # Verify state from callback
-    cookie_state = request.cookies.get("oauth_state")
-    if cookie_state is None or state is None or cookie_state != state:
+@router.get("/google")
+def google_oauth_callback(request: Request, code: str | None = None, state: str | None = None, db: Session = Depends(get_session)):
+    """
+    OAuth2 Authorization Code flow callback for Google.
+    """
+    if code is None:
+        raise HTTPException(status_code=400, detail="Missing code parameter")
+    if state is None:
+        raise HTTPException(status_code=400, detail="Missing state parameter")
+
+    # Verify stateless signed state
+    try:
+        jwt.decode(state, config.JWT_SECRET, algorithms=[config.ALGORITHM])
+    except JWTError:
         raise HTTPException(status_code=400, detail="Invalid OAuth state")
 
+    # Re-declare credentials needed for token exchange
+    client_id = os.getenv("GCP_CLIENT_ID")
+    client_secret = os.getenv("GCP_CLIENT_SECRET")
+    if not client_id or not client_secret:
+        raise HTTPException(status_code=500, detail="GCP_CLIENT_ID and GCP_CLIENT_SECRET must be configured")
+    redirect_uri = os.getenv("OAUTH_REDIRECT_URI", "https://api.till-failure.us/auth/google")
+
     # Exchange code for tokens
     token_url = "https://oauth2.googleapis.com/token"
     data = {
@@ -192,22 +215,24 @@ def google_oauth(request: Request, code: str | None = None, state: str | None =
     token_resp = issue_token(user)
     jwt_token = token_resp.access_token
 
-    redirect_to = "https://till-failure.us/onboarding"
+    frontend_url = os.getenv("FRONTEND_URL", "https://till-failure.us")
+    redirect_to = f"{frontend_url}/onboarding"
     resp = RedirectResponse(redirect_to)
 
     cookie_value = requests.utils.requote_uri(jwt_token)
     cookie_args = {
         "httponly": False,
         "secure": True,
         "samesite": "none",
-        "domain": ".till-failure.us",
         "max_age": 60 * 60 * 24 * 30,  # 30 days
     }
+    
+    cookie_domain = os.getenv("COOKIE_DOMAIN", ".till-failure.us")
+
+    if cookie_domain:
+        cookie_args["domain"] = cookie_domain
 
     # Set the readable cookie `jwt` so frontend JS can access it if needed.
     resp.set_cookie("jwt", cookie_value, **cookie_args)
 
-    # cleanup
-    resp.delete_cookie("oauth_state")
-
     return resp

src/api/app.py

@@ -58,44 +58,18 @@ def get_account_from_bearer(
 
     if user is None:
         raise credentials_exception
-    
-    if not user.is_active:
-        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="account deactivated")
 
     return user
 
-def get_active_account(account: Account = Depends(get_account_from_bearer)) -> Account:
-    if not account.is_active:
-        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="account deactivated")
-    return account
+def get_active_account(account: Account = Depends(get_account_from_bearer)) -> Account:
+    if not account.is_active:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="account deactivated")
+    return account
 
 def get_account_even_if_inactive(
-    token: str = Depends(oauth2_scheme),
-    db: Session = Depends(get_session),
+    acc: Account = Depends(get_account_from_bearer),
 ) -> Account:
-    credentials_exception = HTTPException(
-        status_code=status.HTTP_401_UNAUTHORIZED,
-        detail="Could not validate credentials",
-        headers={"WWW-Authenticate": "Bearer"},
-    )
-
-    try:
-        payload = jwt.decode(token, config.JWT_SECRET, algorithms=[config.ALGORITHM])
-        account_id_str = payload.get("sub")
-
-        if account_id_str is None:
-            raise credentials_exception
-
-        account_id = int(account_id_str)
-    except (JWTError, ValueError):
-        raise credentials_exception
-
-    user = db.get(Account, account_id)
-
-    if user is None:
-        raise credentials_exception
-
-    return user
+    return acc
 
 
 """

src/api/auth/auth.py

@@ -1,24 +1,73 @@
-from fastapi import APIRouter, Depends, HTTPException
-from sqlmodel import Session, select
-from sqlalchemy import delete
-from datetime import datetime
-from typing import List
+from fastapi import APIRouter, Depends, HTTPException, Query
+from sqlmodel import Session, select
+from sqlalchemy import delete
+from datetime import datetime
+from typing import List, Literal
 
 from src.database.session import get_session
 from src.database.account.models import Account
 from src.database.coach.models import Coach, Experience, Certifications, CoachExperience, CoachCertifications
 from src.database.admin.models import Admin
-from src.api.dependencies import get_admin_account, PaginationParams
-from src.database.role_management.models import CoachRequest, RolePromotionResolution, Roles
-from src.database.payment.models import Invoice
-from src.api.roles.admin.domain import ResolveCoachRequestInput, PotentialCoachItem, AdminTransactionsResponse
+from src.api.dependencies import get_admin_account, PaginationParams
+from src.database.role_management.models import CoachRequest, RolePromotionResolution, Roles
+from src.database.payment.models import Invoice
+from src.api.roles.admin.domain import AdminAccountItem, ResolveCoachRequestInput, PotentialCoachItem, AdminTransactionsResponse
 
 from sqlmodel import func
 
-router = APIRouter(prefix="/roles/admin", tags=["admin"])
-
-@router.get("/total_transactions", response_model=AdminTransactionsResponse)
-def get_total_transactions(db = Depends(get_session), acc: Account = Depends(get_admin_account)):
+router = APIRouter(prefix="/roles/admin", tags=["admin"])
+
+def admin_account_role(account: Account) -> str:
+    if account.admin_id is not None:
+        return "admin"
+    if account.coach_id is not None:
+        return "coach"
+    return "client"
+
+def admin_account_roles(account: Account) -> List[str]:
+    roles: List[str] = []
+    if account.client_id is not None:
+        roles.append("client")
+    if account.coach_id is not None:
+        roles.append("coach")
+    if account.admin_id is not None:
+        roles.append("admin")
+    return roles or ["client"]
+
+def serialize_admin_account(account: Account) -> AdminAccountItem:
+    return AdminAccountItem(
+        id=account.id,
+        name=account.name,
+        email=str(account.email),
+        role=admin_account_role(account),
+        roles=admin_account_roles(account),
+        status="active" if account.is_active else "deactivated",
+        is_active=account.is_active,
+        created_at=account.created_at,
+        last_active=None,
+    )
+
+@router.get("/accounts", response_model=List[AdminAccountItem])
+def query_accounts(
+    pagination: PaginationParams = Depends(PaginationParams),
+    sort_by: Literal["name", "email"] = Query("name", description="Account field to sort by"),
+    sort_dir: Literal["asc", "desc"] = Query("asc", description="Sort direction"),
+    db: Session = Depends(get_session),
+    acc: Account = Depends(get_admin_account),
+):
+    sort_column = Account.name if sort_by == "name" else Account.email
+    sort_expression = sort_column.desc() if sort_dir == "desc" else sort_column.asc()
+    accounts = db.exec(
+        select(Account)
+        .order_by(sort_expression, Account.id.asc())
+        .offset(pagination.skip)
+        .limit(pagination.limit)
+    ).all()
+
+    return [serialize_admin_account(account) for account in accounts if account.id is not None]
+
+@router.get("/total_transactions", response_model=AdminTransactionsResponse)
+def get_total_transactions(db = Depends(get_session), acc: Account = Depends(get_admin_account)):
     """
     Get all money transacted on the website (sum of all paid invoice amounts minus their outstanding balance)
     """
@@ -130,4 +179,4 @@ def resolve_coach_request(
 
     db.commit()
 
-    return {"message": "Coach request resolved successfully", "resolution_id": resolution.id}
+    return {"message": "Coach request resolved successfully", "resolution_id": resolution.id}