siftlode/backend/app/auth.py

import logging
import re
from datetime import datetime, timezone

from authlib.integrations.starlette_client import OAuth, OAuthError
from fastapi import APIRouter, BackgroundTasks, Depends, HTTPException, Request
from fastapi.responses import JSONResponse, RedirectResponse
from sqlalchemy import select
from sqlalchemy.orm import Session

from app import email as email_mod
from app.config import settings
from app.db import get_db
from app.models import Invite, OAuthToken, User
from app.security import encrypt

_EMAIL_RE = re.compile(r"^[^@\s]+@[^@\s]+\.[^@\s]+$")

# YouTube's full scope (read + write: unsubscribe, playlist export) and its read-only
# counterpart. Default login asks for read-only; write is an explicit opt-in via
# /auth/upgrade (incremental consent), so friends who won't grant write can still browse.
WRITE_SCOPE = "https://www.googleapis.com/auth/youtube"
READ_SCOPES = f"openid email profile {WRITE_SCOPE}.readonly"
WRITE_SCOPES = f"openid email profile {WRITE_SCOPE}"

log = logging.getLogger("subfeed.auth")

router = APIRouter(prefix="/auth", tags=["auth"])

oauth = OAuth()
oauth.register(
    name="google",
    client_id=settings.google_client_id,
    client_secret=settings.google_client_secret,
    server_metadata_url="https://accounts.google.com/.well-known/openid-configuration",
    client_kwargs={"scope": READ_SCOPES},
)


def has_write_scope(user: User) -> bool:
    """Whether the user's stored grant includes YouTube write (unsubscribe / export)."""
    tok = user.token
    if tok is None or not tok.scopes:
        return False
    return WRITE_SCOPE in tok.scopes.split()


def is_allowed(db: Session, email: str) -> bool:
    """May this email sign in? An approved Invite is the source of truth; the env
    ALLOWED_EMAILS/ADMIN_EMAILS remain a bootstrap fallback (e.g. a fresh DB)."""
    if not email:
        return False
    email = email.lower()
    inv = db.execute(select(Invite).where(Invite.email == email)).scalar_one_or_none()
    if inv is not None:
        return inv.status == "approved"
    return email in settings.allowed_email_set or email in settings.admin_email_set


def upsert_pending_invite(db: Session, email: str) -> Invite | None:
    """Idempotently record an access request. Returns the Invite if a *new* pending row
    was created (so the caller can notify admins), else None for already-known emails."""
    email = (email or "").lower()
    if not _EMAIL_RE.match(email):
        return None
    inv = db.execute(select(Invite).where(Invite.email == email)).scalar_one_or_none()
    if inv is not None:
        # Let a previously-denied person ask again; don't disturb approved/pending rows.
        if inv.status == "denied":
            inv.status = "pending"
            inv.requested_at = datetime.now(timezone.utc)
            inv.decided_at = None
            inv.decided_by = None
            db.commit()
            return inv
        return None
    inv = Invite(email=email, status="pending")
    db.add(inv)
    db.commit()
    return inv


@router.get("/login")
async def login(request: Request):
    # access_type=offline ensures a refresh_token on first authorization. We avoid
    # prompt=consent so returning users get a quick sign-in; the stored refresh token
    # is kept when Google doesn't re-issue one (see the callback).
    return await oauth.google.authorize_redirect(
        request,
        settings.oauth_redirect_url,
        access_type="offline",
        prompt="select_account",
        include_granted_scopes="true",
        scope=READ_SCOPES,
    )


@router.get("/callback")
async def callback(
    request: Request,
    background: BackgroundTasks,
    db: Session = Depends(get_db),
):
    try:
        token = await oauth.google.authorize_access_token(request)
    except OAuthError as exc:
        raise HTTPException(status_code=400, detail=f"OAuth error: {exc.error}")

    userinfo = token.get("userinfo")
    if not userinfo or not userinfo.get("sub"):
        raise HTTPException(status_code=400, detail="No user info returned by Google")

    email = (userinfo.get("email") or "").lower()
    if not is_allowed(db, email):
        log.warning("Login denied (not approved): %s", email or "<no email>")
        # A denied Google login doubles as an access request: record it for the admin and
        # land the user on a friendly "request received" screen instead of a raw 403.
        if email:
            inv = upsert_pending_invite(db, email)
            if inv is not None and settings.admin_email_set:
                background.add_task(
                    email_mod.send_admin_new_request,
                    sorted(settings.admin_email_set),
                    email,
                )
            return RedirectResponse(url="/?access=requested")
        return RedirectResponse(url="/?access=denied")

    user = db.query(User).filter(User.google_sub == userinfo["sub"]).one_or_none()
    if user is None:
        user = User(google_sub=userinfo["sub"], email=email)
        db.add(user)
    user.email = email
    user.display_name = userinfo.get("name")
    user.avatar_url = userinfo.get("picture")
    user.role = "admin" if email in settings.admin_email_set else "user"
    db.flush()

    tok = user.token or OAuthToken(user=user)
    # Google only returns a refresh_token on (re)consent; keep the previous one otherwise.
    if token.get("refresh_token"):
        tok.refresh_token_enc = encrypt(token["refresh_token"])
    tok.access_token = token.get("access_token")
    expires_at = token.get("expires_at")
    tok.expiry = (
        datetime.fromtimestamp(expires_at, tz=timezone.utc) if expires_at else None
    )
    tok.scopes = token.get("scope") or READ_SCOPES
    db.add(tok)
    db.commit()

    request.session["user_id"] = user.id
    log.info("Login: %s (id=%s, role=%s)", email, user.id, user.role)
    return RedirectResponse(url="/")


@router.post("/logout")
async def logout(request: Request):
    request.session.clear()
    return JSONResponse({"ok": True})


@router.post("/request-access")
async def request_access(
    payload: dict,
    background: BackgroundTasks,
    db: Session = Depends(get_db),
) -> dict:
    """Public: ask for access. Idempotent — repeat requests for the same email don't
    duplicate or re-spam admins (upsert returns None for an already-pending row)."""
    email = (payload.get("email") or "").strip().lower()
    if not _EMAIL_RE.match(email):
        raise HTTPException(status_code=400, detail="Enter a valid email address.")
    if is_allowed(db, email):
        return {"status": "approved"}  # already allowed — just sign in
    inv = upsert_pending_invite(db, email)
    if inv is not None and settings.admin_email_set:
        background.add_task(
            email_mod.send_admin_new_request, sorted(settings.admin_email_set), email
        )
    return {"status": "pending"}


def current_user(request: Request, db: Session = Depends(get_db)) -> User:
    user_id = request.session.get("user_id")
    if not user_id:
        raise HTTPException(status_code=401, detail="Not authenticated")
    user = db.get(User, user_id)
    if user is None:
        request.session.clear()
        raise HTTPException(status_code=401, detail="Not authenticated")
    return user


@router.get("/upgrade")
async def upgrade(request: Request, user: User = Depends(current_user)):
    """Incremental consent: re-authorize with the full YouTube (write) scope. The shared
    callback stores the new scope set, so `can_write` flips on once Google grants it."""
    return await oauth.google.authorize_redirect(
        request,
        settings.oauth_redirect_url,
        access_type="offline",
        prompt="consent",
        include_granted_scopes="true",
        scope=WRITE_SCOPES,
    )


@router.get("/me")
async def me(user: User = Depends(current_user)) -> dict:
    return {
        "id": user.id,
        "email": user.email,
        "display_name": user.display_name,
        "avatar_url": user.avatar_url,
        "role": user.role,
    }