remake apis 0.151

server/backend/endpoints/endpoints.py

@@ -1,16 +1,21 @@
-from fastapi import FastAPI, Depends, HTTPException,status
+from fastapi import FastAPI, Depends, HTTPException,status, Response, Cookie
 from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
 import server.backend.schema.pydantic as pydantic
 import server.backend.database.db as db
 from server.backend.auth.JWT import signJWT, decodeJWT
 api = FastAPI(openapi_url="/api/openapi.json",docs_url="/api/docs", redoc_url="/api/redoc")
-security = HTTPBearer()
+security = HTTPBearer(auto_error=False)
 
-async def get_current_user(credentials: HTTPAuthorizationCredentials = Depends(security)):
-    token = credentials.credentials
+async def get_current_user(
+    credentials: HTTPAuthorizationCredentials = Depends(security),
+    token_cookie: str = Cookie(default=None)
+):
+    token = credentials.credentials if credentials else token_cookie
+    if not token:
+        raise HTTPException(status_code=401, detail="Not authenticated")
     user = decodeJWT(token)
     if not user:
-        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid token")
+        raise HTTPException(status_code=401, detail="Invalid token")
     return user
 async def check_roles(user=Depends(get_current_user)):
     user_check = await db.list_user(user["user_id"])
@@ -58,10 +63,29 @@ async def list_users(user=Depends(check_roles)):
     list_of_users = await db.list_users()
     return list_of_users
 
-@api.post("/api/auth",response_model=pydantic.Token)
-async def auth(code:pydantic.UserAccess):
+@api.post("/api/auth")
+async def auth(code: pydantic.UserAccess, response: Response):
     login = await db.login_user(code)
-    if login == None:
-        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Forbidden")
+    if login is None:
+        raise HTTPException(status_code=401, detail="Forbidden")
     token = signJWT(login)
+    response.set_cookie(
+        key="token",
+        value=token,
+        httponly=True,     
+        secure=True,        
+        samesite="strict"
+    )
     return {"access_token": token, "token_type": "bearer"}
+@api.get("/api/verify")
+async def verify(token: str = Cookie(default=None)):
+    if not token:
+        raise HTTPException(status_code=401, detail="No token")
+    user = decodeJWT(token)
+    if not user:
+        raise HTTPException(status_code=401, detail="Invalid token")
+    return {"status": "ok"}
+@api.post("/api/logout")
+async def logout(response: Response):
+    response.delete_cookie(key="token")
+    return {"status": "ok"}