
    b6i                         d dl mZmZ d dlmZ d dlmZmZ d dlm	Z	 d dl
mZmZmZ d dlmZmZ d dlmZ d dlmZmZmZmZmZ  G d	 d
      Zy)    )HTTPExceptionstatus)Session)UserRole)
UserCreate)create_access_tokencreate_refresh_tokendecode_token)hash_passwordverify_password)UserRepository)ERR_EMAIL_REGISTEREDERR_INVALID_CREDENTIALSERR_INVALID_TOKENERR_REFRESH_TOKEN%ERR_ONLY_SUPERADMIN_CAN_CREATE_ADMINSc                       e Zd ZdZededefd       Zedededefd       Z	ededefd	       Z
ed
edefd       Zedededefd       Zy)AuthServicez2Service exposing auth-related business operations.datasessionc                    t        j                  || j                        }|rt        t        j
                  t              t        | j                  | j                  | j                  t        | j                        | j                  t        j                        }t        j                  ||      }t!        |j                        }t#        |j                        }||_        |j'                          ||ddS )z-Create a new standard user and return tokens.status_codedetail)email
first_name	last_namehashed_passwordphonerolesubbeareraccess_tokenrefresh_token
token_type)r   get_by_emailr   r   r   HTTP_400_BAD_REQUESTr   r   r   r   r   passwordr    r   USERScreater	   r
   r'   commit)r   r   existinguseraccessrefreshs         K/var/www/html/story-book/Story-Book-python-api/app/services/auth_service.pysignupzAuthService.signup   s     "..w

CF,G,GPdee**nn)$--8**
 $$Wd3$4&4::6$ &PXYY    r   r+   c                 .   t        j                  ||       }|rt        ||j                        st	        t
        j                  t              t        |j                        }t        |j                        }||_        |j                          ||ddS )zAuthenticate and return tokens.r   r"   r$   r%   )r   r)   r   r   r   r   HTTP_401_UNAUTHORIZEDr   r	   r   r
   r'   r.   )r   r+   r   r0   r1   r2   s         r3   loginzAuthService.login-   sx     **7E:?8T5I5IJF,H,HQhii$4&4::6$ &PXYYr5   r'   c                    t        |       }|j                  d      dk7  rt        t        j                  t
              |j                  d      }t        j                  ||      }|r|j                  | k7  rt        t        j                  t              t        |j                        }t        |j                        }||_        |j                          ||ddS )z4Exchange a valid refresh token for a new token pair.typer2   r   r#   r"   r$   r%   )r   getr   r   r7   r   r   r)   r'   r   r	   r   r
   r.   )r'   r   payloadr   r0   
new_accessnew_refreshs          r3   r'   zAuthService.refresh_token<   s     }-;;v)+F,H,HQbccE"**7E:t))]:F,H,HQbcc(TZZ8
*tzz:( *[X`aar5   r0   c                 8    d| _         |j                          ddiS )z7Revoke refresh token -> user logged out on all devices.NmessagezSuccessfully logged out.)r'   r.   )r0   r   s     r3   logoutzAuthService.logoutQ   s"     "566r5   current_superc           	         |j                   t        j                  k7  rt        t        j
                  t              t        j                  || j                        }|rt        t        j                  t              t        | j                  | j                  | j                  t        | j                         | j"                  t        j$                  d      }t        j&                  ||      }|S )z
        SUPERADMIN-only: create an ADMIN user.
        'current_super' param is passed from dependency checks in routes.
        r   T)r   r   r   r   r    r!   	is_active)r!   r   
SUPERADMINr   r   HTTP_403_FORBIDDENr   r   r)   r   r*   r   r   r   r   r   r+   r    ADMINr-   )r   r   rB   r/   admins        r3   register_adminzAuthService.register_adminX   s     0F,E,ENstt!..w

CF,G,GPdee**nn)$--8**
 %%gu5r5   N)__name__
__module____qualname____doc__staticmethodr   r   r4   strr8   r'   r   rA   rI    r5   r3   r   r      s    <ZZ Z' Z Z0 ZS ZC Z' Z Z bS b7 b b( 7T 7G 7 7 Z ' $  r5   r   N)fastapir   r   sqlmodelr   app.models.userr   r   app.schemas.userr   app.utils.tokensr	   r
   r   app.core.securityr   r   app.repositories.user_repor   app.core.constantsr   r   r   r   r   r   rP   r5   r3   <module>rY      s3    )  & ' T T < 5 ^ ^r5   