login passwd

backend/app/main.py

@@ -1,9 +1,17 @@
 from contextlib import asynccontextmanager
+import os
 from fastapi import Depends, FastAPI, File, HTTPException, Response, UploadFile
 from fastapi.middleware.cors import CORSMiddleware
 from sqlalchemy.orm import Session
 from .database import Base, engine, get_db
 from . import models, schemas
+from .auth import (
+    AUTH_COOKIE_NAME,
+    create_access_token,
+    get_current_user,
+    seed_admin_user,
+    verify_password,
+)
 from .curriculum import QUESTIONS
 from .services import (
     build_llm_reply,
@@ -23,6 +31,7 @@ async def lifespan(app: FastAPI):
     db = next(get_db())
     try:
         seed_skills(db)
+        seed_admin_user(db)
     finally:
         db.close()
     yield
@@ -47,6 +56,36 @@ def health():
     return {"status": "ok"}
 
 
+@app.post("/auth/login", response_model=schemas.LoginResponse)
+def login(payload: schemas.LoginRequest, response: Response, db: Session = Depends(get_db)):
+    user = db.query(models.User).filter_by(username=payload.username).first()
+    if not user or not verify_password(payload.password, user.password_hash):
+        raise HTTPException(status_code=401, detail="Identifiants invalides")
+
+    token = create_access_token(user)
+    response.set_cookie(
+        key=AUTH_COOKIE_NAME,
+        value=token,
+        httponly=True,
+        secure=os.getenv("AUTH_COOKIE_SECURE", "false").lower() == "true",
+        samesite=os.getenv("AUTH_COOKIE_SAMESITE", "lax"),
+        max_age=int(os.getenv("ACCESS_TOKEN_EXPIRE_MINUTES", "720")) * 60,
+        path="/",
+    )
+    return schemas.LoginResponse(access_token=token, user=user)
+
+
+@app.get("/auth/me", response_model=schemas.UserRead)
+def auth_me(current_user: models.User = Depends(get_current_user)):
+    return current_user
+
+
+@app.post("/auth/logout")
+def logout(response: Response):
+    response.delete_cookie(key=AUTH_COOKIE_NAME, path="/")
+    return {"status": "ok"}
+
+
 @app.get("/students", response_model=list[schemas.StudentRead])
 def list_students(db: Session = Depends(get_db)):
     return db.query(models.Student).order_by(models.Student.id.asc()).all()