ok

Dockerfile

@@ -38,8 +38,8 @@ COPY --chown=appuser:appuser . .
 
 RUN mkdir -p /app/models && python3 -c "from huggingface_hub import snapshot_download; snapshot_download(repo_id='ibm-granite/granite-embedding-small-english-r2', local_dir='/app/models/bge-384')" && chown -R appuser:appuser /app/models
 
-RUN mkdir -p /app/logs && \
-    chown -R appuser:appuser /app/logs
+RUN mkdir -p /app/data /app/logs && \
+    chown -R appuser:appuser /app/data /app/logs
 
 RUN chmod +x /app/start.sh
 

app/api/server.py

@@ -8,6 +8,7 @@ from fastapi.middleware.cors import CORSMiddleware
 from fastapi.middleware.gzip import GZipMiddleware
 
 from app.config import get_settings
+from app.core.auth.deps import init_auth_db
 from app.core.database import pool_manager
 from app.core.logger import get_logger
 from app.core.redis_client import create_redis_client, close_redis
@@ -39,6 +40,10 @@ async def _self_ping():
 
 @asynccontextmanager
 async def lifespan(app: FastAPI):
+    _logger.info("Initializing authentication database...")
+    await init_auth_db()
+    _logger.info("Authentication database initialized")
+
     _logger.info("Initializing embedding service (loading 384-dim model)...")
     loop = asyncio.get_running_loop()
     await loop.run_in_executor(None, _embedding_service.load_model, 384)

app/api/v1/auth.py

@@ -0,0 +1,213 @@
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, Request, status
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.config import get_settings
+from app.core.auth.deps import get_current_user, get_db, get_temp_db_warning, require_application_id
+from app.core.auth.models import RefreshSession, User
+from app.core.auth.schemas import (
+    ChangePasswordSchema,
+    ForgotPasswordSchema,
+    LoginSchema,
+    MessageDataResponse,
+    ProfileResponse,
+    RegisterSchema,
+    ResetPasswordSchema,
+    SchemaResponse,
+    SessionListResponse,
+    SessionOut,
+    TokenRefreshSchema,
+    TokenResponse,
+    UpdateProfileSchema,
+    UserSchemaField,
+    UserSchemaResponse,
+    DataResponse,
+)
+from app.services.auth_service import AuthService
+
+router = APIRouter(prefix="/auth", tags=["Authentication"])
+_settings = get_settings()
+
+
+def _build(data, warning):
+    result = {"success": True, "data": data}
+    if _settings.application_id:
+        result["application_id"] = _settings.application_id
+    if warning:
+        result["warning"] = warning
+    return result
+
+
+@router.post("/register", response_model=ProfileResponse, status_code=status.HTTP_201_CREATED)
+async def register(
+    schema: RegisterSchema,
+    db: Annotated[AsyncSession, Depends(get_db)],
+    _: Annotated[bool, Depends(require_application_id)],
+):
+    user = await AuthService.register(db, schema)
+    warning = get_temp_db_warning()
+    return _build(AuthService.user_to_profile(user).model_dump(), warning)
+
+
+@router.post("/login", response_model=TokenResponse)
+async def login(
+    schema: LoginSchema,
+    request: Request,
+    db: Annotated[AsyncSession, Depends(get_db)],
+    _: Annotated[bool, Depends(require_application_id)],
+):
+    tokens = await AuthService.login(db, request, schema)
+    warning = get_temp_db_warning()
+    return _build(tokens.model_dump(), warning)
+
+
+@router.post("/refresh", response_model=TokenResponse)
+async def refresh_token(
+    schema: TokenRefreshSchema,
+    db: Annotated[AsyncSession, Depends(get_db)],
+    _: Annotated[bool, Depends(require_application_id)],
+):
+    tokens = await AuthService.refresh(db, schema.refresh_token)
+    warning = get_temp_db_warning()
+    return _build(tokens.model_dump(), warning)
+
+
+@router.post("/logout", response_model=MessageDataResponse)
+async def logout(
+    schema: TokenRefreshSchema,
+    current_user: Annotated[User, Depends(get_current_user)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+    _: Annotated[bool, Depends(require_application_id)],
+):
+    await AuthService.logout(db, current_user, schema.refresh_token)
+    warning = get_temp_db_warning()
+    return _build({"message": "Logged out successfully"}, warning)
+
+
+@router.post("/logout-all", response_model=MessageDataResponse)
+async def logout_all(
+    current_user: Annotated[User, Depends(get_current_user)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+    _: Annotated[bool, Depends(require_application_id)],
+):
+    await AuthService.logout_all(db, current_user)
+    warning = get_temp_db_warning()
+    return _build({"message": "All sessions revoked"}, warning)
+
+
+@router.post("/forgot-password", response_model=MessageDataResponse)
+async def forgot_password(
+    schema: ForgotPasswordSchema,
+    db: Annotated[AsyncSession, Depends(get_db)],
+    _: Annotated[bool, Depends(require_application_id)],
+):
+    await AuthService.forgot_password(db, schema)
+    warning = get_temp_db_warning()
+    return _build({"message": "If that email exists, a password reset link has been sent."}, warning)
+
+
+@router.post("/reset-password", response_model=MessageDataResponse)
+async def reset_password(
+    schema: ResetPasswordSchema,
+    db: Annotated[AsyncSession, Depends(get_db)],
+    _: Annotated[bool, Depends(require_application_id)],
+):
+    await AuthService.reset_password(db, schema)
+    warning = get_temp_db_warning()
+    return _build({"message": "Password reset successfully"}, warning)
+
+
+@router.post("/change-password", response_model=MessageDataResponse)
+async def change_password(
+    schema: ChangePasswordSchema,
+    current_user: Annotated[User, Depends(get_current_user)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+    _: Annotated[bool, Depends(require_application_id)],
+):
+    await AuthService.change_password(db, current_user, schema)
+    warning = get_temp_db_warning()
+    return _build({"message": "Password changed successfully"}, warning)
+
+
+@router.get("/me", response_model=ProfileResponse)
+async def get_me(
+    current_user: Annotated[User, Depends(get_current_user)],
+    _: Annotated[bool, Depends(require_application_id)],
+):
+    warning = get_temp_db_warning()
+    return _build(AuthService.user_to_profile(current_user).model_dump(), warning)
+
+
+@router.patch("/me", response_model=ProfileResponse)
+async def update_me(
+    schema: UpdateProfileSchema,
+    current_user: Annotated[User, Depends(get_current_user)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+    _: Annotated[bool, Depends(require_application_id)],
+):
+    user = await AuthService.update_profile(db, current_user, schema)
+    warning = get_temp_db_warning()
+    return _build(AuthService.user_to_profile(user).model_dump(), warning)
+
+
+@router.delete("/me", response_model=MessageDataResponse)
+async def delete_me(
+    current_user: Annotated[User, Depends(get_current_user)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+    _: Annotated[bool, Depends(require_application_id)],
+):
+    await AuthService.soft_delete(db, current_user)
+    warning = get_temp_db_warning()
+    return _build({"message": "Account deleted successfully"}, warning)
+
+
+@router.get("/schema", response_model=SchemaResponse)
+async def get_user_schema(
+    _: Annotated[bool, Depends(require_application_id)],
+):
+    columns = [
+        UserSchemaField(field="id", type="string (UUID)", required=True, description="Unique user identifier", constraints="Auto-generated"),
+        UserSchemaField(field="email", type="string", required=True, description="User email address", constraints="Unique, max 255 chars"),
+        UserSchemaField(field="username", type="string", required=False, description="Unique username", constraints="Unique, 2-50 chars, alphanumeric + underscore"),
+        UserSchemaField(field="full_name", type="string", required=False, description="Display name", constraints="Max 100 chars"),
+        UserSchemaField(field="password", type="string", required=True, description="User password (write-only)", constraints="Min 8 chars, uppercase, lowercase, digit"),
+        UserSchemaField(field="password_hash", type="string", required=True, description="Argon2id password hash (internal)", constraints="Auto-generated"),
+        UserSchemaField(field="is_active", type="boolean", required=False, description="Whether the user account is active", constraints="Default: true"),
+        UserSchemaField(field="is_verified", type="boolean", required=False, description="Whether the email is verified", constraints="Default: false"),
+        UserSchemaField(field="failed_login_attempts", type="integer", required=False, description="Consecutive failed login count", constraints="Default: 0"),
+        UserSchemaField(field="locked_until", type="datetime (ISO 8601)", required=False, description="Account lock expiry", constraints="Nullable"),
+        UserSchemaField(field="last_login", type="datetime (ISO 8601)", required=False, description="Last successful login timestamp", constraints="Nullable"),
+        UserSchemaField(field="password_changed_at", type="datetime (ISO 8601)", required=False, description="Last password change", constraints="Nullable"),
+        UserSchemaField(field="created_at", type="datetime (ISO 8601)", required=False, description="Account creation timestamp", constraints="Auto-set"),
+        UserSchemaField(field="updated_at", type="datetime (ISO 8601)", required=False, description="Last update timestamp", constraints="Auto-updated"),
+        UserSchemaField(field="deleted_at", type="datetime (ISO 8601)", required=False, description="Soft delete timestamp", constraints="Nullable"),
+        UserSchemaField(field="roles", type="array[string]", required=False, description="Assigned role names", constraints="Via user_roles association table"),
+    ]
+    warning = get_temp_db_warning()
+    return _build(UserSchemaResponse(table_name="users", columns=columns).model_dump(), warning)
+
+
+@router.get("/sessions", response_model=SessionListResponse)
+async def list_sessions(
+    current_user: Annotated[User, Depends(get_current_user)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+    _: Annotated[bool, Depends(require_application_id)],
+):
+    sessions = await AuthService.list_sessions(db, current_user)
+    warning = get_temp_db_warning()
+    return _build([SessionOut.model_validate(s).model_dump() for s in sessions], warning)
+
+
+@router.delete("/sessions/{session_id}", response_model=MessageDataResponse)
+async def revoke_session(
+    session_id: str,
+    current_user: Annotated[User, Depends(get_current_user)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+    _: Annotated[bool, Depends(require_application_id)],
+):
+    await AuthService.revoke_session(db, current_user, session_id)
+    warning = get_temp_db_warning()
+    return _build({"message": "Session revoked successfully"}, warning)

app/api/v1/router.py

@@ -2,10 +2,11 @@ from __future__ import annotations
 
 from fastapi import APIRouter
 
-from app.api.v1 import batch, chat, code_executor, convert, database, embeddings, reconcile, scraper, semantic_router, sql_validator, system, token_counter, token_generator, web_search
+from app.api.v1 import auth, batch, chat, code_executor, convert, database, embeddings, reconcile, scraper, semantic_router, sql_validator, system, token_counter, token_generator, web_search
 from app.api.verify import router as verify_router
 
 api_v1_router = APIRouter()
+api_v1_router.include_router(auth.router, tags=["Authentication"])
 api_v1_router.include_router(convert.router, tags=["Convert"])
 api_v1_router.include_router(batch.router, tags=["Batch"])
 api_v1_router.include_router(system.router, tags=["System"])

app/config.py

@@ -66,6 +66,14 @@ class Settings(BaseSettings):
     jwt_default_expiry_minutes: int = 30
     jwt_issuer: str = "all-api-collection"
 
+    database_url: str = "sqlite+aiosqlite:///data/auth.db"
+    access_token_expire_minutes: int = 15
+    refresh_token_expire_days: int = 7
+    max_login_attempts: int = 5
+    lockout_minutes: int = 15
+    application_id: str = ""
+    admin_password: str = ""
+
     @property
     def max_upload_mb(self) -> int:
         return self.max_upload_bytes // (1024 * 1024)

app/core/auth/__init__.py

@@ -0,0 +1,27 @@
+from __future__ import annotations
+
+from app.core.auth.models import (
+    Base, Permission, Role, User, RefreshSession,
+    user_roles, role_permissions,
+)
+from app.core.auth.schemas import (
+    RegisterSchema, LoginSchema, TokenResponse, TokenRefreshSchema,
+    UserProfile, UpdateProfileSchema, ChangePasswordSchema,
+    ForgotPasswordSchema, ResetPasswordSchema, SessionOut,
+    MessageResponse, UserSchemaResponse, UserSchemaField,
+)
+from app.core.auth.deps import (
+    get_db, get_current_user, require_permissions,
+    get_temp_db_warning, TempDatabaseWarning,
+)
+
+__all__ = [
+    "Base", "Permission", "Role", "User", "RefreshSession",
+    "user_roles", "role_permissions",
+    "RegisterSchema", "LoginSchema", "TokenResponse", "TokenRefreshSchema",
+    "UserProfile", "UpdateProfileSchema", "ChangePasswordSchema",
+    "ForgotPasswordSchema", "ResetPasswordSchema", "SessionOut",
+    "MessageResponse", "UserSchemaResponse", "UserSchemaField",
+    "get_db", "get_current_user", "require_permissions",
+    "get_temp_db_warning", "TempDatabaseWarning",
+]

app/core/auth/deps.py

@@ -0,0 +1,185 @@
+from __future__ import annotations
+
+import logging
+from datetime import datetime, timedelta, timezone
+from typing import Annotated, Any, AsyncGenerator, Optional
+
+import jwt
+from argon2 import PasswordHasher
+from argon2.exceptions import VerifyMismatchError
+from fastapi import Depends, HTTPException, Request, status
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
+
+from app.config import get_settings
+from app.core.auth.models import Base, Permission, RefreshSession, Role, User
+
+logger = logging.getLogger("auth")
+
+_settings = get_settings()
+
+_is_temp_db = (
+    "sqlite" in _settings.database_url
+    and "localhost" not in _settings.database_url
+    and "postgres" not in _settings.database_url.lower()
+    and "mysql" not in _settings.database_url.lower()
+)
+
+_raw_url: str = getattr(_settings, "database_url", None) or "sqlite+aiosqlite:///data/auth.db"
+
+if "sqlite" in _raw_url and "sqlite+aiosqlite" not in _raw_url:
+    _raw_url = _raw_url.replace("sqlite:///", "sqlite+aiosqlite:///")
+
+DATABASE_URL: str = _raw_url
+
+engine = create_async_engine(DATABASE_URL, echo=False)
+AsyncSessionLocal = async_sessionmaker(engine, class_=AsyncSession, expire_on_commit=False)
+
+ph = PasswordHasher()
+
+
+def _now() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+class TempDatabaseWarning:
+    code: str = "TEMP_DATABASE"
+    message: str = (
+        "No external database configuration was provided. "
+        "The service is currently using its built-in SQLite database intended for development and temporary use. "
+        "Data stored in this database should not be considered permanent."
+    )
+
+
+def get_temp_db_warning() -> Optional[dict]:
+    if _is_temp_db:
+        return {"code": TempDatabaseWarning.code, "message": TempDatabaseWarning.message}
+    return None
+
+
+async def init_auth_db():
+    async with engine.begin() as conn:
+        await conn.run_sync(Base.metadata.create_all)
+
+    async with AsyncSessionLocal() as session:
+        result = await session.execute(select(Role).where(Role.name == "SuperAdmin"))
+        if not result.scalars().first():
+            sa_role = Role(name="SuperAdmin", description="Full system access")
+            admin_role = Role(name="Admin", description="Administrative access")
+            user_role = Role(name="User", description="Standard user access")
+            session.add_all([sa_role, admin_role, user_role])
+
+            perms = []
+            for code, desc in [
+                ("users:read", "Read users"),
+                ("users:write", "Modify users"),
+                ("users:delete", "Delete users"),
+                ("admin:access", "Access admin panel"),
+            ]:
+                p = Permission(code=code, description=desc)
+                perms.append(p)
+                session.add(p)
+
+            sa_role.permissions.extend(perms)
+            admin_role.permissions.extend(perms[:-1])
+            user_role.permissions.append(perms[0])
+
+            await session.commit()
+
+        admin_email = "admin@example.com"
+        result = await session.execute(select(User).where(User.email == admin_email))
+        if not result.scalars().first():
+            admin_password = _settings.admin_password or "Admin123!"
+            admin_user = User(
+                email=admin_email,
+                full_name="System Administrator",
+                password_hash=ph.hash(admin_password),
+                is_verified=True,
+            )
+            role_result = await session.execute(select(Role).where(Role.name == "SuperAdmin"))
+            admin_role = role_result.scalars().first()
+            if admin_role:
+                admin_user.roles.append(admin_role)
+            session.add(admin_user)
+            await session.commit()
+
+        from app.services.auth_service import AuthService
+        await AuthService.cleanup_expired_sessions(session)
+
+
+async def get_db() -> AsyncGenerator[AsyncSession, None]:
+    async with AsyncSessionLocal() as session:
+        try:
+            yield session
+        finally:
+            await session.close()
+
+
+async def get_current_user(
+    request: Request,
+    db: Annotated[AsyncSession, Depends(get_db)],
+) -> User:
+    credentials_exception = HTTPException(
+        status_code=status.HTTP_401_UNAUTHORIZED,
+        detail="Could not validate credentials",
+        headers={"WWW-Authenticate": "Bearer"},
+    )
+
+    auth_header = request.headers.get("Authorization")
+    if not auth_header or not auth_header.startswith("Bearer "):
+        raise credentials_exception
+
+    token = auth_header.split(" ", 1)[1]
+
+    try:
+        payload = jwt.decode(token, _settings.jwt_secret_key, algorithms=[_settings.jwt_algorithm])
+        user_id: str = payload.get("sub")
+        token_type: str = payload.get("type")
+        if user_id is None or token_type != "access":
+            raise credentials_exception
+    except jwt.PyJWTError:
+        raise credentials_exception
+
+    result = await db.execute(select(User).where(User.id == user_id, User.deleted_at.is_(None)))
+    user = result.scalars().first()
+    if user is None or not user.is_active:
+        raise credentials_exception
+    return user
+
+
+def require_application_id(request: Request):
+    app_id = request.headers.get("X-Application-Id")
+    expected = _settings.application_id
+    if not expected:
+        return True
+    if not app_id:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Missing X-Application-Id header",
+        )
+    if app_id != expected:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Invalid application_id",
+        )
+    return True
+
+
+def require_permissions(*required_perms: str):
+    async def permission_checker(
+        user: Annotated[User, Depends(get_current_user)],
+    ) -> User:
+        user_perms = set()
+        for role in user.roles:
+            for perm in role.permissions:
+                user_perms.add(perm.code)
+
+        missing = [p for p in required_perms if p not in user_perms]
+        if missing:
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail=f"Missing required permissions: {', '.join(missing)}",
+            )
+        return user
+
+    return permission_checker

app/core/auth/models.py

@@ -0,0 +1,100 @@
+from __future__ import annotations
+
+import uuid
+from datetime import datetime, timezone
+
+from sqlalchemy import (
+    Boolean, Column, DateTime, ForeignKey, Integer, String, Text, Table,
+)
+from sqlalchemy.orm import DeclarativeBase, Mapped, mapped_column, relationship
+
+
+class Base(DeclarativeBase):
+    pass
+
+
+def _utcnow() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+def _uuid() -> str:
+    return str(uuid.uuid4())
+
+
+user_roles = Table(
+    "user_roles",
+    Base.metadata,
+    Column("user_id", String(36), ForeignKey("users.id", ondelete="CASCADE"), primary_key=True),
+    Column("role_id", String(36), ForeignKey("roles.id", ondelete="CASCADE"), primary_key=True),
+)
+
+role_permissions = Table(
+    "role_permissions",
+    Base.metadata,
+    Column("role_id", String(36), ForeignKey("roles.id", ondelete="CASCADE"), primary_key=True),
+    Column("permission_id", String(36), ForeignKey("permissions.id", ondelete="CASCADE"), primary_key=True),
+)
+
+
+class Permission(Base):
+    __tablename__ = "permissions"
+
+    id: Mapped[str] = mapped_column(String(36), primary_key=True, default=_uuid)
+    code: Mapped[str] = mapped_column(String(100), unique=True, index=True, nullable=False)
+    description: Mapped[str | None] = mapped_column(String(255), nullable=True)
+
+    roles: Mapped[list[Role]] = relationship(secondary=role_permissions, back_populates="permissions", lazy="selectin")
+
+
+class Role(Base):
+    __tablename__ = "roles"
+
+    id: Mapped[str] = mapped_column(String(36), primary_key=True, default=_uuid)
+    name: Mapped[str] = mapped_column(String(50), unique=True, nullable=False)
+    description: Mapped[str | None] = mapped_column(String(255), nullable=True)
+
+    users: Mapped[list[User]] = relationship(secondary=user_roles, back_populates="roles", lazy="selectin")
+    permissions: Mapped[list[Permission]] = relationship(secondary=role_permissions, back_populates="roles", lazy="selectin")
+
+
+class User(Base):
+    __tablename__ = "users"
+
+    id: Mapped[str] = mapped_column(String(36), primary_key=True, default=_uuid)
+    email: Mapped[str] = mapped_column(String(255), unique=True, index=True, nullable=False)
+    username: Mapped[str | None] = mapped_column(String(50), unique=True, index=True, nullable=True)
+    full_name: Mapped[str | None] = mapped_column(String(255), nullable=True)
+    password_hash: Mapped[str] = mapped_column(Text, nullable=False)
+
+    is_active: Mapped[bool] = mapped_column(Boolean, default=True, nullable=False)
+    is_verified: Mapped[bool] = mapped_column(Boolean, default=False, nullable=False)
+
+    failed_login_attempts: Mapped[int] = mapped_column(Integer, default=0, nullable=False)
+    locked_until: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
+    last_login: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
+    password_changed_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
+
+    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_utcnow, nullable=False)
+    updated_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_utcnow, onupdate=_utcnow, nullable=False)
+    deleted_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
+
+    roles: Mapped[list[Role]] = relationship(secondary=user_roles, back_populates="users", lazy="selectin")
+    sessions: Mapped[list[RefreshSession]] = relationship(back_populates="user", cascade="all, delete-orphan", lazy="selectin")
+
+
+class RefreshSession(Base):
+    __tablename__ = "refresh_sessions"
+
+    id: Mapped[str] = mapped_column(String(36), primary_key=True, default=_uuid)
+    user_id: Mapped[str] = mapped_column(String(36), ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True)
+    token_key: Mapped[str] = mapped_column(String(64), unique=True, index=True, nullable=False)
+    token_hash: Mapped[str] = mapped_column(String(255), nullable=False)
+    device_info: Mapped[str | None] = mapped_column(String(255), nullable=True)
+    ip_address: Mapped[str | None] = mapped_column(String(45), nullable=True)
+    expires_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)
+    revoked_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
+
+    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_utcnow, nullable=False)
+    updated_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_utcnow, onupdate=_utcnow, nullable=False)
+
+    user: Mapped[User] = relationship(back_populates="sessions")

app/core/auth/schemas.py

@@ -0,0 +1,159 @@
+from __future__ import annotations
+
+import re
+from datetime import datetime
+from typing import Any, Optional
+
+from pydantic import BaseModel, EmailStr, Field, field_validator
+
+
+def _validate_password(v: str) -> str:
+    if len(v) < 8:
+        raise ValueError("Password must be at least 8 characters")
+    if len(v) > 128:
+        raise ValueError("Password must not exceed 128 characters")
+    if not re.search(r"[A-Z]", v):
+        raise ValueError("Password must contain at least one uppercase letter")
+    if not re.search(r"[a-z]", v):
+        raise ValueError("Password must contain at least one lowercase letter")
+    if not re.search(r"\d", v):
+        raise ValueError("Password must contain at least one digit")
+    return v
+
+
+class RegisterSchema(BaseModel):
+    email: EmailStr
+    password: str
+    username: Optional[str] = Field(None, min_length=2, max_length=50, pattern=r"^[a-zA-Z0-9_]+$")
+    full_name: Optional[str] = Field(None, min_length=1, max_length=100)
+
+    _validate_password = field_validator("password")(_validate_password)
+
+
+class LoginSchema(BaseModel):
+    email: EmailStr
+    password: str
+
+
+class TokenData(BaseModel):
+    access_token: str
+    refresh_token: str
+    token_type: str = "bearer"
+
+
+class TokenRefreshSchema(BaseModel):
+    refresh_token: str
+
+
+class UserProfile(BaseModel):
+    id: str
+    email: str
+    username: Optional[str] = None
+    full_name: Optional[str] = None
+    is_active: bool
+    is_verified: bool
+    roles: list[str]
+    created_at: datetime
+
+    @field_validator("roles", mode="before")
+    @classmethod
+    def _extract_role_names(cls, v: Any) -> list[str]:
+        if not v:
+            return []
+        if isinstance(v[0], str):
+            return v
+        return [r.name for r in v]
+
+    model_config = {"from_attributes": True}
+
+
+class UpdateProfileSchema(BaseModel):
+    username: Optional[str] = Field(None, min_length=2, max_length=50, pattern=r"^[a-zA-Z0-9_]+$")
+    full_name: Optional[str] = Field(None, min_length=1, max_length=100)
+
+
+class ChangePasswordSchema(BaseModel):
+    current_password: str
+    new_password: str
+
+    _validate_new_password = field_validator("new_password")(_validate_password)
+
+
+class ForgotPasswordSchema(BaseModel):
+    email: EmailStr
+
+
+class ResetPasswordSchema(BaseModel):
+    token: str
+    new_password: str
+
+    _validate_new_password = field_validator("new_password")(_validate_password)
+
+
+class SessionOut(BaseModel):
+    id: str
+    device_info: Optional[str] = None
+    ip_address: Optional[str] = None
+    created_at: datetime
+    expires_at: datetime
+
+    model_config = {"from_attributes": True}
+
+
+class MessageResponse(BaseModel):
+    message: str
+
+
+class UserSchemaField(BaseModel):
+    field: str
+    type: str
+    required: bool
+    description: str
+    constraints: Optional[str] = None
+
+
+class UserSchemaResponse(BaseModel):
+    table_name: str = "users"
+    columns: list[UserSchemaField]
+
+
+# --- Wrapped API response schemas ---
+
+class ApiResponse(BaseModel):
+    success: bool = True
+
+
+class DataResponse(ApiResponse):
+    data: dict
+    application_id: Optional[str] = None
+    warning: Optional[dict] = None
+
+
+class TokenResponse(ApiResponse):
+    data: TokenData
+    application_id: Optional[str] = None
+    warning: Optional[dict] = None
+
+
+class ProfileResponse(ApiResponse):
+    data: UserProfile
+    application_id: Optional[str] = None
+    warning: Optional[dict] = None
+
+
+class MessageDataResponse(ApiResponse):
+    data: MessageResponse
+    application_id: Optional[str] = None
+    warning: Optional[dict] = None
+
+
+class SchemaResponse(ApiResponse):
+    data: UserSchemaResponse
+    application_id: Optional[str] = None
+    warning: Optional[dict] = None
+
+
+class SessionListResponse(ApiResponse):
+    data: list[SessionOut]
+    application_id: Optional[str] = None
+    warning: Optional[dict] = None

app/services/auth_service.py

@@ -1,11 +1,376 @@
 from __future__ import annotations
 
+import hashlib
+import logging
+import secrets
+from datetime import datetime, timedelta, timezone
+from typing import Optional
+
+import jwt
+from argon2 import PasswordHasher
+from argon2.exceptions import VerifyMismatchError
+from fastapi import HTTPException, Request, status
+from sqlalchemy import select, update
+from sqlalchemy.ext.asyncio import AsyncSession
+
 from app.config import get_settings
+from app.core.auth.models import RefreshSession, Role, User
+from app.core.auth.schemas import (
+    ChangePasswordSchema,
+    ForgotPasswordSchema,
+    LoginSchema,
+    RegisterSchema,
+    ResetPasswordSchema,
+    TokenData,
+    UpdateProfileSchema,
+    UserProfile,
+)
+
+logger = logging.getLogger("auth_service")
+_settings = get_settings()
+ph = PasswordHasher()
+
+
+def _now() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+def _token_key(raw: str) -> str:
+    return hashlib.sha256(raw.encode("utf-8")).hexdigest()
 
 
 class AuthService:
-    def __init__(self) -> None:
-        self._settings = get_settings()
 
-    def validate_token(self, token: str) -> bool:
-        return token == self._settings.api_key
+    @staticmethod
+    async def register(db: AsyncSession, schema: RegisterSchema) -> User:
+        result = await db.execute(select(User).where(User.email == schema.email))
+        if result.scalars().first():
+            raise HTTPException(status_code=409, detail="Email already registered")
+
+        if schema.username:
+            result = await db.execute(select(User).where(User.username == schema.username))
+            if result.scalars().first():
+                raise HTTPException(status_code=409, detail="Username already taken")
+
+        user = User(
+            email=schema.email,
+            username=schema.username,
+            full_name=schema.full_name,
+            password_hash=ph.hash(schema.password),
+        )
+
+        role_result = await db.execute(select(Role).where(Role.name == "User"))
+        default_role = role_result.scalars().first()
+        if default_role:
+            user.roles.append(default_role)
+
+        db.add(user)
+        await db.commit()
+        await db.refresh(user)
+        return user
+
+    @staticmethod
+    async def login(db: AsyncSession, request: Request, schema: LoginSchema) -> TokenData:
+        result = await db.execute(
+            select(User).where(User.email == schema.email, User.deleted_at.is_(None))
+        )
+        user = result.scalars().first()
+
+        if not user:
+            raise HTTPException(status_code=401, detail="Incorrect email or password")
+
+        if user.locked_until and user.locked_until > _now():
+            raise HTTPException(
+                status_code=403,
+                detail=f"Account locked until {user.locked_until.isoformat()}",
+            )
+
+        if not AuthService._verify_password(schema.password, user.password_hash):
+            user.failed_login_attempts += 1
+            if user.failed_login_attempts >= _settings.max_login_attempts:
+                user.locked_until = _now() + timedelta(minutes=_settings.lockout_minutes)
+            await db.commit()
+            raise HTTPException(status_code=401, detail="Incorrect email or password")
+
+        user.failed_login_attempts = 0
+        user.locked_until = None
+        user.last_login = _now()
+
+        access_token = AuthService._create_access_token(user.id)
+        raw_refresh, refresh_hash, token_key, expires_at = AuthService._create_refresh_token()
+
+        session = RefreshSession(
+            user_id=user.id,
+            token_key=token_key,
+            token_hash=refresh_hash,
+            expires_at=expires_at,
+            device_info=request.headers.get("User-Agent", "Unknown"),
+            ip_address=request.client.host if request.client else "Unknown",
+        )
+        db.add(session)
+        await db.commit()
+
+        return TokenData(access_token=access_token, refresh_token=raw_refresh)
+
+    @staticmethod
+    async def refresh(db: AsyncSession, raw_refresh_token: str) -> TokenData:
+        key = _token_key(raw_refresh_token)
+
+        result = await db.execute(
+            select(RefreshSession).where(
+                RefreshSession.token_key == key,
+                RefreshSession.revoked_at.is_(None),
+                RefreshSession.expires_at > _now(),
+            )
+        )
+        session = result.scalars().first()
+
+        if not session:
+            session = await db.execute(
+                select(RefreshSession).where(RefreshSession.token_key == key)
+            )
+            existing = session.scalars().first()
+            if existing and existing.revoked_at is not None:
+                await db.execute(
+                    update(RefreshSession)
+                    .where(RefreshSession.user_id == existing.user_id, RefreshSession.revoked_at.is_(None))
+                    .values(revoked_at=_now())
+                )
+                await db.commit()
+                raise HTTPException(
+                    status_code=401,
+                    detail="Session compromised. All sessions revoked. Please login again.",
+                )
+            raise HTTPException(status_code=401, detail="Invalid or expired refresh token")
+
+        if not AuthService._verify_token(raw_refresh_token, session.token_hash):
+            raise HTTPException(status_code=401, detail="Invalid refresh token")
+
+        user_result = await db.execute(
+            select(User).where(
+                User.id == session.user_id, User.deleted_at.is_(None), User.is_active.is_(True)
+            )
+        )
+        user = user_result.scalars().first()
+        if not user:
+            raise HTTPException(status_code=401, detail="User not found or inactive")
+
+        session.revoked_at = _now()
+
+        new_access = AuthService._create_access_token(user.id)
+        new_raw_refresh, new_hash, new_key, new_expires = AuthService._create_refresh_token()
+
+        new_session = RefreshSession(
+            user_id=user.id,
+            token_key=new_key,
+            token_hash=new_hash,
+            expires_at=new_expires,
+            device_info=session.device_info,
+            ip_address=session.ip_address,
+        )
+        db.add(new_session)
+
+        user.last_login = _now()
+        await db.commit()
+
+        return TokenData(access_token=new_access, refresh_token=new_raw_refresh)
+
+    @staticmethod
+    async def logout(db: AsyncSession, user: User, raw_refresh_token: str):
+        key = _token_key(raw_refresh_token)
+        result = await db.execute(
+            select(RefreshSession).where(
+                RefreshSession.token_key == key,
+                RefreshSession.user_id == user.id,
+                RefreshSession.revoked_at.is_(None),
+            )
+        )
+        session = result.scalars().first()
+        if not session:
+            raise HTTPException(status_code=404, detail="Session not found")
+        session.revoked_at = _now()
+        await db.commit()
+
+    @staticmethod
+    async def logout_all(db: AsyncSession, user: User):
+        now = _now()
+        await db.execute(
+            update(RefreshSession)
+            .where(
+                RefreshSession.user_id == user.id,
+                RefreshSession.revoked_at.is_(None),
+            )
+            .values(revoked_at=now)
+        )
+        await db.commit()
+
+    @staticmethod
+    async def change_password(db: AsyncSession, user: User, schema: ChangePasswordSchema):
+        if not AuthService._verify_password(schema.current_password, user.password_hash):
+            raise HTTPException(status_code=400, detail="Incorrect current password")
+        user.password_hash = ph.hash(schema.new_password)
+        user.password_changed_at = _now()
+        await db.commit()
+
+    @staticmethod
+    async def forgot_password(db: AsyncSession, schema: ForgotPasswordSchema):
+        result = await db.execute(
+            select(User).where(User.email == schema.email, User.deleted_at.is_(None))
+        )
+        user = result.scalars().first()
+        if user:
+            reset_token = jwt.encode(
+                {
+                    "sub": user.id,
+                    "type": "reset_password",
+                    "exp": _now() + timedelta(hours=1),
+                },
+                _settings.jwt_secret_key,
+                algorithm=_settings.jwt_algorithm,
+            )
+            logger.info("Password reset token for %s: %s", user.email, reset_token)
+
+    @staticmethod
+    async def reset_password(db: AsyncSession, schema: ResetPasswordSchema):
+        try:
+            payload = jwt.decode(
+                schema.token,
+                _settings.jwt_secret_key,
+                algorithms=[_settings.jwt_algorithm],
+            )
+            if payload.get("type") != "reset_password":
+                raise HTTPException(status_code=400, detail="Invalid token type")
+            user_id = payload.get("sub")
+        except jwt.PyJWTError:
+            raise HTTPException(status_code=400, detail="Invalid or expired reset token")
+
+        result = await db.execute(select(User).where(User.id == user_id))
+        user = result.scalars().first()
+        if not user:
+            raise HTTPException(status_code=404, detail="User not found")
+
+        user.password_hash = ph.hash(schema.new_password)
+        user.password_changed_at = _now()
+
+        await db.execute(
+            update(RefreshSession)
+            .where(RefreshSession.user_id == user.id, RefreshSession.revoked_at.is_(None))
+            .values(revoked_at=_now())
+        )
+        await db.commit()
+
+    @staticmethod
+    async def update_profile(db: AsyncSession, user: User, schema: UpdateProfileSchema) -> User:
+        if schema.username is not None:
+            result = await db.execute(
+                select(User).where(User.username == schema.username, User.id != user.id)
+            )
+            if result.scalars().first():
+                raise HTTPException(status_code=409, detail="Username already taken")
+            user.username = schema.username
+        if schema.full_name is not None:
+            user.full_name = schema.full_name
+        await db.commit()
+        await db.refresh(user)
+        return user
+
+    @staticmethod
+    async def soft_delete(db: AsyncSession, user: User):
+        user.deleted_at = _now()
+        user.is_active = False
+        await db.execute(
+            update(RefreshSession)
+            .where(RefreshSession.user_id == user.id, RefreshSession.revoked_at.is_(None))
+            .values(revoked_at=_now())
+        )
+        await db.commit()
+
+    @staticmethod
+    async def list_sessions(db: AsyncSession, user: User) -> list[RefreshSession]:
+        result = await db.execute(
+            select(RefreshSession)
+            .where(
+                RefreshSession.user_id == user.id,
+                RefreshSession.revoked_at.is_(None),
+            )
+            .order_by(RefreshSession.created_at.desc())
+        )
+        return list(result.scalars().all())
+
+    @staticmethod
+    async def revoke_session(db: AsyncSession, user: User, session_id: str):
+        result = await db.execute(
+            select(RefreshSession).where(
+                RefreshSession.id == session_id,
+                RefreshSession.user_id == user.id,
+                RefreshSession.revoked_at.is_(None),
+            )
+        )
+        session = result.scalars().first()
+        if not session:
+            raise HTTPException(status_code=404, detail="Session not found")
+        session.revoked_at = _now()
+        await db.commit()
+
+    @staticmethod
+    async def cleanup_expired_sessions(db: AsyncSession):
+        result = await db.execute(
+            select(RefreshSession).where(RefreshSession.expires_at < _now())
+        )
+        count = 0
+        for s in result.scalars().all():
+            if s.revoked_at is None:
+                s.revoked_at = _now()
+                count += 1
+        if count:
+            await db.commit()
+            logger.info("Cleaned up %s expired sessions", count)
+
+    @staticmethod
+    def _create_access_token(user_id: str) -> str:
+        now = _now()
+        payload = {
+            "sub": user_id,
+            "type": "access",
+            "iat": now,
+            "exp": now + timedelta(minutes=_settings.access_token_expire_minutes),
+            "iss": _settings.jwt_issuer,
+        }
+        return jwt.encode(payload, _settings.jwt_secret_key, algorithm=_settings.jwt_algorithm)
+
+    @staticmethod
+    def _create_refresh_token() -> tuple[str, str, str, datetime]:
+        token = secrets.token_urlsafe(64)
+        token_hash = ph.hash(token)
+        token_key = _token_key(token)
+        expires_at = _now() + timedelta(days=_settings.refresh_token_expire_days)
+        return token, token_hash, token_key, expires_at
+
+    @staticmethod
+    def _verify_password(plain: str, hashed: str) -> bool:
+        try:
+            ph.verify(hashed, plain)
+            return True
+        except VerifyMismatchError:
+            return False
+
+    @staticmethod
+    def _verify_token(raw: str, hashed: str) -> bool:
+        try:
+            ph.verify(hashed, raw)
+            return True
+        except VerifyMismatchError:
+            return False
+
+    @staticmethod
+    def user_to_profile(user: User) -> UserProfile:
+        return UserProfile(
+            id=user.id,
+            email=user.email,
+            username=user.username,
+            full_name=user.full_name,
+            is_active=user.is_active,
+            is_verified=user.is_verified,
+            roles=[r.name for r in user.roles],
+            created_at=user.created_at,
+        )

requirements.txt

@@ -27,7 +27,14 @@ sqlglot>=20.0.0
 tiktoken>=0.9.0
 PyJWT>=2.9.0
 
+# Authentication
+argon2-cffi>=23.1.0
+email-validator>=2.1.0
+slowapi>=0.1.9
+
 # Async database drivers
+aiosqlite>=0.20.0
+sqlalchemy[asyncio]>=2.0.0
 aiomysql>=0.3.2
 asyncpg>=0.31.0
 motor>=3.7.1

start.sh

@@ -9,6 +9,10 @@ log "=== Starting up ==="
 log "Python: $(python --version 2>&1)"
 log "Working dir: $(pwd)"
 
+# Ensure required directories exist
+mkdir -p /app/data /app/logs
+log "Data directories: OK"
+
 # Check core deps
 python -c "import markitdown, fastapi, httpx, pandas" 2>/dev/null
 if [ $? -ne 0 ]; then