hr-portal/backend/app/api/v1/auth.py

"""
認證 API
處理登入、登出、Token 管理
"""
from typing import Dict, Any
from fastapi import APIRouter, Depends, HTTPException, status, Request
from sqlalchemy.orm import Session

from app.db.session import get_db
from app.schemas.auth import LoginRequest, TokenResponse, UserInfo
from app.schemas.response import MessageResponse
from app.api.deps import get_current_user, require_auth
from app.services.keycloak_service import keycloak_service
from app.services.audit_service import audit_service

router = APIRouter()


@router.post("/login", response_model=TokenResponse)
def login(
    login_data: LoginRequest,
    request: Request,
    db: Session = Depends(get_db),
):
    """
    用戶登入

    使用 Keycloak Direct Access Grant (Resource Owner Password Credentials)
    獲取 Access Token 和 Refresh Token

    Args:
        login_data: 登入憑證 (username, password)
        request: HTTP Request (用於獲取 IP)
        db: 資料庫 Session

    Returns:
        TokenResponse: Access Token 和 Refresh Token

    Raises:
        HTTPException: 登入失敗時拋出 401
    """
    try:
        # 使用 Keycloak 進行認證
        token_response = keycloak_service.openid.token(
            login_data.username,
            login_data.password
        )

        # 記錄登入成功的審計日誌
        audit_service.log_login(
            db=db,
            username=login_data.username,
            ip_address=audit_service.get_client_ip(request),
            success=True
        )

        return TokenResponse(
            access_token=token_response["access_token"],
            token_type=token_response["token_type"],
            expires_in=token_response["expires_in"],
            refresh_token=token_response.get("refresh_token")
        )

    except Exception as e:
        # 記錄登入失敗的審計日誌
        audit_service.log_login(
            db=db,
            username=login_data.username,
            ip_address=audit_service.get_client_ip(request),
            success=False
        )

        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid username or password",
            headers={"WWW-Authenticate": "Bearer"},
        )


@router.post("/logout", response_model=MessageResponse)
def logout(
    request: Request,
    current_user: Dict[str, Any] = Depends(require_auth),
    db: Session = Depends(get_db),
):
    """
    用戶登出

    記錄登出審計日誌

    Args:
        request: HTTP Request
        current_user: 當前用戶資訊
        db: 資料庫 Session

    Returns:
        MessageResponse: 登出成功訊息
    """
    # 記錄登出審計日誌
    audit_service.log_logout(
        db=db,
        username=current_user["username"],
        ip_address=audit_service.get_client_ip(request)
    )

    # TODO: 可選擇在 Keycloak 端撤銷 Token
    # keycloak_service.openid.logout(refresh_token)

    return MessageResponse(
        message=f"User {current_user['username']} logged out successfully"
    )


@router.post("/refresh", response_model=TokenResponse)
def refresh_token(
    refresh_token: str,
):
    """
    刷新 Access Token

    使用 Refresh Token 獲取新的 Access Token

    Args:
        refresh_token: Refresh Token

    Returns:
        TokenResponse: 新的 Access Token 和 Refresh Token

    Raises:
        HTTPException: Refresh Token 無效時拋出 401
    """
    try:
        # 使用 Refresh Token 獲取新的 Access Token
        token_response = keycloak_service.openid.refresh_token(refresh_token)

        return TokenResponse(
            access_token=token_response["access_token"],
            token_type=token_response["token_type"],
            expires_in=token_response["expires_in"],
            refresh_token=token_response.get("refresh_token")
        )

    except Exception as e:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid or expired refresh token",
            headers={"WWW-Authenticate": "Bearer"},
        )


@router.get("/me", response_model=UserInfo)
def get_current_user_info(
    current_user: Dict[str, Any] = Depends(require_auth),
    db: Session = Depends(get_db)
):
    """
    獲取當前用戶資訊

    從 JWT Token 解析用戶資訊，並查詢租戶資訊

    Args:
        current_user: 當前用戶資訊 (從 Token 解析)
        db: 資料庫 Session

    Returns:
        UserInfo: 用戶詳細資訊（包含租戶資訊）
    """
    # 查詢用戶所屬租戶
    from app.models.tenant import Tenant
    from app.models.employee import Employee

    tenant_info = None

    # 從 email 查詢員工,取得租戶資訊
    email = current_user.get("email")
    if email:
        employee = db.query(Employee).filter(Employee.email == email).first()
        if employee and employee.tenant_id:
            tenant = db.query(Tenant).filter(Tenant.id == employee.tenant_id).first()
            if tenant:
                tenant_info = {
                    "id": tenant.id,
                    "code": tenant.code,
                    "name": tenant.name,
                    "is_sysmana": tenant.is_sysmana
                }

    return UserInfo(
        sub=current_user.get("sub", ""),
        username=current_user.get("username", ""),
        email=current_user.get("email", ""),
        first_name=current_user.get("first_name"),
        last_name=current_user.get("last_name"),
        email_verified=current_user.get("email_verified", False),
        tenant=tenant_info
    )


@router.post("/change-password", response_model=MessageResponse)
def change_password(
    old_password: str,
    new_password: str,
    current_user: Dict[str, Any] = Depends(require_auth),
    db: Session = Depends(get_db),
    request: Request = None,
):
    """
    修改密碼

    用戶修改自己的密碼

    Args:
        old_password: 舊密碼
        new_password: 新密碼
        current_user: 當前用戶資訊
        db: 資料庫 Session
        request: HTTP Request

    Returns:
        MessageResponse: 成功訊息

    Raises:
        HTTPException: 舊密碼錯誤或修改失敗時拋出錯誤
    """
    username = current_user["username"]

    try:
        # 1. 驗證舊密碼
        try:
            keycloak_service.openid.token(username, old_password)
        except:
            raise HTTPException(
                status_code=status.HTTP_400_BAD_REQUEST,
                detail="Old password is incorrect"
            )

        # 2. 獲取用戶 Keycloak ID
        user = keycloak_service.get_user_by_username(username)
        if not user:
            raise HTTPException(
                status_code=status.HTTP_404_NOT_FOUND,
                detail="User not found in Keycloak"
            )

        user_id = user["id"]

        # 3. 重設密碼 (非臨時密碼)
        success = keycloak_service.reset_password(
            user_id=user_id,
            new_password=new_password,
            temporary=False
        )

        if not success:
            raise HTTPException(
                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
                detail="Failed to change password"
            )

        # 4. 記錄審計日誌
        audit_service.log(
            db=db,
            action="change_password",
            resource_type="authentication",
            performed_by=username,
            details={"success": True},
            ip_address=audit_service.get_client_ip(request) if request else None
        )

        return MessageResponse(
            message="Password changed successfully"
        )

    except HTTPException:
        raise
    except Exception as e:
        raise HTTPException(
            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
            detail=f"Failed to change password: {str(e)}"
        )


@router.post("/reset-password/{username}", response_model=MessageResponse)
def reset_user_password(
    username: str,
    new_password: str,
    temporary: bool = True,
    current_user: Dict[str, Any] = Depends(require_auth),
    db: Session = Depends(get_db),
    request: Request = None,
):
    """
    重設用戶密碼 (管理員功能)

    管理員為其他用戶重設密碼

    Args:
        username: 目標用戶名稱
        new_password: 新密碼
        temporary: 是否為臨時密碼 (用戶首次登入需修改)
        current_user: 當前用戶資訊 (管理員)
        db: 資料庫 Session
        request: HTTP Request

    Returns:
        MessageResponse: 成功訊息

    Raises:
        HTTPException: 權限不足或重設失敗時拋出錯誤
    """
    # TODO: 檢查是否為管理員
    # 目前暫時允許所有已認證用戶

    try:
        # 1. 獲取目標用戶
        user = keycloak_service.get_user_by_username(username)
        if not user:
            raise HTTPException(
                status_code=status.HTTP_404_NOT_FOUND,
                detail=f"User {username} not found"
            )

        user_id = user["id"]

        # 2. 重設密碼
        success = keycloak_service.reset_password(
            user_id=user_id,
            new_password=new_password,
            temporary=temporary
        )

        if not success:
            raise HTTPException(
                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
                detail="Failed to reset password"
            )

        # 3. 記錄審計日誌
        audit_service.log(
            db=db,
            action="reset_password",
            resource_type="authentication",
            performed_by=current_user["username"],
            details={
                "target_user": username,
                "temporary": temporary,
                "success": True
            },
            ip_address=audit_service.get_client_ip(request) if request else None
        )

        return MessageResponse(
            message=f"Password reset for user {username}"
        )

    except HTTPException:
        raise
    except Exception as e:
        raise HTTPException(
            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
            detail=f"Failed to reset password: {str(e)}"
        )