attocode-code-intel 0.1.0__py3-none-any.whl

attocode_intel/api/routes/auth.py

@@ -0,0 +1,428 @@
+"""Authentication endpoints (service mode only)."""
+
+from __future__ import annotations
+
+import secrets
+import time
+import uuid
+from urllib.parse import urlencode
+
+from fastapi import APIRouter, Depends, HTTPException, Query
+from pydantic import BaseModel
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+from starlette.responses import RedirectResponse
+
+from attocode_intel.api.auth import resolve_auth
+from attocode_intel.api.auth.context import AuthContext
+from attocode_intel.api.auth.jwt import create_access_token, create_refresh_token, decode_token
+from attocode_intel.api.auth.passwords import hash_password, verify_password
+from attocode_intel.api.deps import get_config, get_db_session
+from attocode_intel.db.models import OrgMembership, User
+
+router = APIRouter(prefix="/api/v1/auth", tags=["auth"])
+
+
+# --- OAuth state store (single-instance, 10 min TTL) ---
+
+_oauth_states: dict[str, float] = {}
+
+
+def _store_state(state: str) -> None:
+    """Store an OAuth state token with the current timestamp."""
+    now = time.time()
+    expired = [k for k, v in _oauth_states.items() if now - v > 600]
+    for k in expired:
+        del _oauth_states[k]
+    _oauth_states[state] = now
+
+
+def _validate_state(state: str) -> bool:
+    """Validate and consume an OAuth state token (single-use)."""
+    ts = _oauth_states.pop(state, None)
+    if ts is None:
+        return False
+    return time.time() - ts < 600
+
+
+# --- Request/Response models ---
+
+
+class RegisterRequest(BaseModel):
+    email: str
+    password: str
+    name: str = ""
+    registration_key: str = ""
+
+
+class LoginRequest(BaseModel):
+    email: str
+    password: str
+
+
+class TokenResponse(BaseModel):
+    access_token: str
+    refresh_token: str
+    token_type: str = "bearer"
+
+
+class RefreshRequest(BaseModel):
+    refresh_token: str
+
+
+class UserProfile(BaseModel):
+    id: str
+    email: str
+    name: str
+    avatar_url: str | None = None
+    auth_provider: str
+    orgs: list[dict]
+
+
+# --- Endpoints ---
+
+
+@router.post("/register", response_model=TokenResponse)
+async def register(
+    req: RegisterRequest,
+    session: AsyncSession = Depends(get_db_session),
+) -> TokenResponse:
+    """Register a new user with email + password."""
+    config = get_config()
+    if config.registration_key and req.registration_key != config.registration_key:
+        raise HTTPException(status_code=403, detail="Invalid registration key")
+
+    # Check if email already exists
+    existing = await session.execute(select(User).where(User.email == req.email))
+    if existing.scalar_one_or_none():
+        raise HTTPException(status_code=409, detail="Email already registered")
+
+    user = User(
+        email=req.email,
+        name=req.name or req.email.split("@")[0],
+        password_hash=hash_password(req.password),
+        auth_provider="email",
+    )
+    session.add(user)
+    await session.commit()
+    await session.refresh(user)
+
+    config = get_config()
+    return TokenResponse(
+        access_token=create_access_token(user.id, expires_minutes=config.jwt_expiry_minutes),
+        refresh_token=create_refresh_token(user.id, expires_days=config.refresh_expiry_days),
+    )
+
+
+@router.post("/login", response_model=TokenResponse)
+async def login(
+    req: LoginRequest,
+    session: AsyncSession = Depends(get_db_session),
+) -> TokenResponse:
+    """Login with email + password, returns JWT tokens."""
+    result = await session.execute(select(User).where(User.email == req.email))
+    user = result.scalar_one_or_none()
+    if user is None or not user.password_hash or not verify_password(req.password, user.password_hash):
+        raise HTTPException(status_code=401, detail="Invalid email or password")
+
+    config = get_config()
+    return TokenResponse(
+        access_token=create_access_token(user.id, expires_minutes=config.jwt_expiry_minutes),
+        refresh_token=create_refresh_token(user.id, expires_days=config.refresh_expiry_days),
+    )
+
+
+@router.post("/refresh", response_model=TokenResponse)
+async def refresh(
+    req: RefreshRequest,
+    session: AsyncSession = Depends(get_db_session),
+) -> TokenResponse:
+    """Exchange a refresh token for a new access token."""
+    payload = decode_token(req.refresh_token)
+    if payload is None or payload.get("type") != "refresh":
+        raise HTTPException(status_code=401, detail="Invalid refresh token")
+
+    user_id = uuid.UUID(payload["sub"])
+    result = await session.execute(select(User).where(User.id == user_id))
+    user = result.scalar_one_or_none()
+    if user is None:
+        raise HTTPException(status_code=401, detail="User not found")
+
+    config = get_config()
+    return TokenResponse(
+        access_token=create_access_token(user.id, expires_minutes=config.jwt_expiry_minutes),
+        refresh_token=create_refresh_token(user.id, expires_days=config.refresh_expiry_days),
+    )
+
+
+@router.get("/github")
+async def github_authorize() -> dict:
+    """Redirect URL for GitHub OAuth authorization."""
+    from attocode_intel.api.auth.oauth import get_github_auth_url
+
+    config = get_config()
+    if not config.github_client_id:
+        raise HTTPException(status_code=501, detail="GitHub OAuth not configured")
+
+    state = secrets.token_urlsafe(32)
+    _store_state(state)
+    url = await get_github_auth_url(
+        client_id=config.github_client_id,
+        redirect_uri=f"{config.effective_base_url}/api/v1/auth/github/callback",
+        state=state,
+    )
+    return {"authorize_url": url, "state": state}
+
+
+@router.get("/github/callback")
+async def github_callback(
+    code: str = Query(...),
+    state: str = Query(""),
+    session: AsyncSession = Depends(get_db_session),
+) -> RedirectResponse:
+    """Handle GitHub OAuth callback — create/link user, redirect with JWT."""
+    if not _validate_state(state):
+        raise HTTPException(status_code=400, detail="Invalid or expired OAuth state")
+
+    from attocode_intel.api.auth.oauth import exchange_github_code
+
+    config = get_config()
+    if not config.github_client_id or not config.github_client_secret:
+        raise HTTPException(status_code=501, detail="GitHub OAuth not configured")
+
+    gh_user = await exchange_github_code(
+        code=code,
+        client_id=config.github_client_id,
+        client_secret=config.github_client_secret,
+    )
+
+    # Try to find existing user by github_id
+    result = await session.execute(
+        select(User).where(User.github_id == gh_user["github_id"])
+    )
+    user = result.scalar_one_or_none()
+
+    if user is None:
+        # Try by email
+        result = await session.execute(
+            select(User).where(User.email == gh_user["email"])
+        )
+        user = result.scalar_one_or_none()
+        if user:
+            # Link GitHub to existing account
+            user.github_id = gh_user["github_id"]
+            user.avatar_url = user.avatar_url or gh_user["avatar_url"]
+        else:
+            # Create new user
+            user = User(
+                email=gh_user["email"],
+                name=gh_user["name"],
+                github_id=gh_user["github_id"],
+                avatar_url=gh_user["avatar_url"],
+                auth_provider="github",
+            )
+            session.add(user)
+
+    await session.commit()
+    await session.refresh(user)
+
+    access_token = create_access_token(user.id, expires_minutes=config.jwt_expiry_minutes)
+    refresh_token = create_refresh_token(user.id, expires_days=config.refresh_expiry_days)
+    fragment = urlencode({"access_token": access_token, "refresh_token": refresh_token})
+    return RedirectResponse(url=f"/auth/callback#{fragment}", status_code=302)
+
+
+@router.get("/google")
+async def google_authorize() -> dict:
+    """Redirect URL for Google OAuth authorization."""
+    from attocode_intel.api.auth.oauth import get_google_auth_url
+
+    config = get_config()
+    if not config.google_client_id:
+        raise HTTPException(status_code=501, detail="Google OAuth not configured")
+
+    state = secrets.token_urlsafe(32)
+    _store_state(state)
+    url = await get_google_auth_url(
+        client_id=config.google_client_id,
+        redirect_uri=f"{config.effective_base_url}/api/v1/auth/google/callback",
+        state=state,
+    )
+    return {"authorize_url": url, "state": state}
+
+
+@router.get("/google/callback")
+async def google_callback(
+    code: str = Query(...),
+    state: str = Query(""),
+    session: AsyncSession = Depends(get_db_session),
+) -> RedirectResponse:
+    """Handle Google OAuth callback — create/link user, redirect with JWT."""
+    if not _validate_state(state):
+        raise HTTPException(status_code=400, detail="Invalid or expired OAuth state")
+
+    from attocode_intel.api.auth.oauth import exchange_google_code
+
+    config = get_config()
+    if not config.google_client_id or not config.google_client_secret:
+        raise HTTPException(status_code=501, detail="Google OAuth not configured")
+
+    g_user = await exchange_google_code(
+        code=code,
+        client_id=config.google_client_id,
+        client_secret=config.google_client_secret,
+        redirect_uri=f"{config.effective_base_url}/api/v1/auth/google/callback",
+    )
+
+    # Lookup by google_id -> email -> create new
+    result = await session.execute(select(User).where(User.google_id == g_user["google_id"]))
+    user = result.scalar_one_or_none()
+
+    if user is None:
+        result = await session.execute(select(User).where(User.email == g_user["email"]))
+        user = result.scalar_one_or_none()
+        if user:
+            user.google_id = g_user["google_id"]
+            user.avatar_url = user.avatar_url or g_user["avatar_url"]
+        else:
+            user = User(
+                email=g_user["email"],
+                name=g_user["name"],
+                google_id=g_user["google_id"],
+                avatar_url=g_user["avatar_url"],
+                auth_provider="google",
+            )
+            session.add(user)
+
+    await session.commit()
+    await session.refresh(user)
+
+    access_token = create_access_token(user.id, expires_minutes=config.jwt_expiry_minutes)
+    refresh_token = create_refresh_token(user.id, expires_days=config.refresh_expiry_days)
+    fragment = urlencode({"access_token": access_token, "refresh_token": refresh_token})
+    return RedirectResponse(url=f"/auth/callback#{fragment}", status_code=302)
+
+
+@router.get("/providers")
+async def list_providers() -> dict:
+    """List available auth providers. No auth required — called from login page."""
+    config = get_config()
+    providers = ["email"]
+    if config.github_client_id:
+        providers.append("github")
+    if config.google_client_id:
+        providers.append("google")
+    return {
+        "providers": providers,
+        "registration_enabled": True,
+        "registration_key_required": bool(config.registration_key),
+    }
+
+
+class UpdateProfileRequest(BaseModel):
+    name: str | None = None
+    avatar_url: str | None = None
+
+
+class ChangePasswordRequest(BaseModel):
+    current_password: str
+    new_password: str
+
+
+@router.patch("/me", response_model=UserProfile)
+async def update_profile(
+    req: UpdateProfileRequest,
+    auth: AuthContext = Depends(resolve_auth),
+    session: AsyncSession = Depends(get_db_session),
+) -> UserProfile:
+    """Update current user's profile (name, avatar_url)."""
+    if not auth.user_id:
+        raise HTTPException(status_code=401, detail="Authentication required")
+
+    result = await session.execute(select(User).where(User.id == auth.user_id))
+    user = result.scalar_one_or_none()
+    if user is None:
+        raise HTTPException(status_code=404, detail="User not found")
+
+    if req.name is not None:
+        user.name = req.name
+    if req.avatar_url is not None:
+        user.avatar_url = req.avatar_url
+
+    await session.commit()
+    await session.refresh(user)
+
+    memberships = await session.execute(
+        select(OrgMembership).where(OrgMembership.user_id == user.id)
+    )
+    orgs = [{"org_id": str(m.org_id), "role": m.role} for m in memberships.scalars()]
+
+    return UserProfile(
+        id=str(user.id),
+        email=user.email,
+        name=user.name,
+        avatar_url=user.avatar_url,
+        auth_provider=user.auth_provider,
+        orgs=orgs,
+    )
+
+
+@router.post("/me/password")
+async def change_password(
+    req: ChangePasswordRequest,
+    auth: AuthContext = Depends(resolve_auth),
+    session: AsyncSession = Depends(get_db_session),
+) -> dict:
+    """Change password (requires current password)."""
+    if not auth.user_id:
+        raise HTTPException(status_code=401, detail="Authentication required")
+
+    result = await session.execute(select(User).where(User.id == auth.user_id))
+    user = result.scalar_one_or_none()
+    if user is None:
+        raise HTTPException(status_code=404, detail="User not found")
+
+    if not user.password_hash:
+        raise HTTPException(status_code=400, detail="Account uses OAuth — no password to change")
+
+    if not verify_password(req.current_password, user.password_hash):
+        raise HTTPException(status_code=401, detail="Current password is incorrect")
+
+    if len(req.new_password) < 8:
+        raise HTTPException(status_code=400, detail="New password must be at least 8 characters")
+
+    user.password_hash = hash_password(req.new_password)
+    await session.commit()
+    return {"detail": "Password changed"}
+
+
+@router.get("/me", response_model=UserProfile)
+async def me(
+    auth: AuthContext = Depends(resolve_auth),
+    session: AsyncSession = Depends(get_db_session),
+) -> UserProfile:
+    """Get current user profile with org memberships."""
+    if not auth.user_id:
+        raise HTTPException(status_code=401, detail="Not authenticated")
+
+    result = await session.execute(select(User).where(User.id == auth.user_id))
+    user = result.scalar_one_or_none()
+    if user is None:
+        raise HTTPException(status_code=404, detail="User not found")
+
+    # Get org memberships
+    memberships = await session.execute(
+        select(OrgMembership).where(OrgMembership.user_id == user.id)
+    )
+    orgs = []
+    for m in memberships.scalars():
+        orgs.append({"org_id": str(m.org_id), "role": m.role})
+
+    return UserProfile(
+        id=str(user.id),
+        email=user.email,
+        name=user.name,
+        avatar_url=user.avatar_url,
+        auth_provider=user.auth_provider,
+        orgs=orgs,
+    )

attocode_intel/api/routes/branches.py

@@ -0,0 +1,262 @@
+"""Branch management and comparison endpoints (service mode only)."""
+
+from __future__ import annotations
+
+import uuid
+
+from fastapi import APIRouter, Depends, HTTPException, Query
+from pydantic import BaseModel
+from sqlalchemy import func, select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from attocode_intel.api.auth import resolve_auth
+from attocode_intel.api.auth.context import AuthContext
+from attocode_intel.api.deps import get_db_session
+from attocode_intel.db.models import Branch, Repository
+
+router = APIRouter(prefix="/api/v1/repos/{repo_id}/branches", tags=["branches"])
+
+
+class BranchResponse(BaseModel):
+    id: str
+    name: str
+    head_commit: str | None = None
+    is_default: bool
+    last_indexed_at: str | None = None
+    overlay_stats: dict = {}
+
+
+class BranchListResponse(BaseModel):
+    branches: list[BranchResponse]
+    total: int = 0
+    limit: int = 20
+    offset: int = 0
+    has_more: bool = False
+
+
+class BranchCompareRequest(BaseModel):
+    base_branch: str
+    compare_branch: str
+
+
+class BranchCompareResponse(BaseModel):
+    base: str
+    compare: str
+    files_changed: dict  # path → change_type
+
+
+async def _get_repo(repo_id: uuid.UUID, session: AsyncSession) -> Repository:
+    result = await session.execute(select(Repository).where(Repository.id == repo_id))
+    repo = result.scalar_one_or_none()
+    if repo is None:
+        raise HTTPException(status_code=404, detail="Repository not found")
+    return repo
+
+
+@router.get("", response_model=BranchListResponse)
+async def list_branches(
+    repo_id: uuid.UUID,
+    limit: int = Query(20, ge=1, le=100),
+    offset: int = Query(0, ge=0),
+    auth: AuthContext = Depends(resolve_auth),
+    session: AsyncSession = Depends(get_db_session),
+) -> BranchListResponse:
+    """List branches with overlay stats."""
+    await _get_repo(repo_id, session)
+
+    from attocode_intel.storage.branch_overlay import BranchOverlay
+
+    overlay = BranchOverlay(session)
+
+    count_result = await session.execute(
+        select(func.count()).select_from(
+            select(Branch).where(Branch.repo_id == repo_id).subquery()
+        )
+    )
+    total = count_result.scalar() or 0
+
+    result = await session.execute(
+        select(Branch).where(Branch.repo_id == repo_id)
+        .offset(offset).limit(limit)
+    )
+    branches = []
+    for b in result.scalars():
+        stats = await overlay.get_overlay_stats(b.id)
+        branches.append(BranchResponse(
+            id=str(b.id),
+            name=b.name,
+            head_commit=b.head_commit,
+            is_default=b.is_default,
+            last_indexed_at=b.last_indexed_at.isoformat() if b.last_indexed_at else None,
+            overlay_stats=stats,
+        ))
+    return BranchListResponse(
+        branches=branches, total=total, limit=limit, offset=offset,
+        has_more=(offset + limit < total),
+    )
+
+
+@router.get("/{branch_name}", response_model=BranchResponse)
+async def get_branch(
+    repo_id: uuid.UUID,
+    branch_name: str,
+    auth: AuthContext = Depends(resolve_auth),
+    session: AsyncSession = Depends(get_db_session),
+) -> BranchResponse:
+    """Get branch detail."""
+    await _get_repo(repo_id, session)
+
+    result = await session.execute(
+        select(Branch).where(Branch.repo_id == repo_id, Branch.name == branch_name)
+    )
+    branch = result.scalar_one_or_none()
+    if branch is None:
+        raise HTTPException(status_code=404, detail=f"Branch '{branch_name}' not found")
+
+    from attocode_intel.storage.branch_overlay import BranchOverlay
+
+    overlay = BranchOverlay(session)
+    stats = await overlay.get_overlay_stats(branch.id)
+
+    return BranchResponse(
+        id=str(branch.id),
+        name=branch.name,
+        head_commit=branch.head_commit,
+        is_default=branch.is_default,
+        last_indexed_at=branch.last_indexed_at.isoformat() if branch.last_indexed_at else None,
+        overlay_stats=stats,
+    )
+
+
+@router.post("/compare", response_model=BranchCompareResponse)
+async def compare_branches(
+    repo_id: uuid.UUID,
+    req: BranchCompareRequest,
+    auth: AuthContext = Depends(resolve_auth),
+    session: AsyncSession = Depends(get_db_session),
+) -> BranchCompareResponse:
+    """Compare two branches — returns file-level diff."""
+    await _get_repo(repo_id, session)
+
+    base_result = await session.execute(
+        select(Branch).where(Branch.repo_id == repo_id, Branch.name == req.base_branch)
+    )
+    base = base_result.scalar_one_or_none()
+    if base is None:
+        raise HTTPException(status_code=404, detail=f"Branch '{req.base_branch}' not found")
+
+    compare_result = await session.execute(
+        select(Branch).where(Branch.repo_id == repo_id, Branch.name == req.compare_branch)
+    )
+    compare = compare_result.scalar_one_or_none()
+    if compare is None:
+        raise HTTPException(status_code=404, detail=f"Branch '{req.compare_branch}' not found")
+
+    from attocode_intel.storage.branch_overlay import BranchOverlay
+
+    overlay = BranchOverlay(session)
+    diff = await overlay.diff_branches(base.id, compare.id)
+
+    return BranchCompareResponse(
+        base=req.base_branch,
+        compare=req.compare_branch,
+        files_changed=diff,
+    )
+
+
+class BranchMergeRequest(BaseModel):
+    source_branch: str
+    target_branch: str
+    delete_source: bool = True
+
+
+class BranchMergeResponse(BaseModel):
+    source: str
+    target: str
+    added: int = 0
+    modified: int = 0
+    deleted: int = 0
+    total: int = 0
+
+
+@router.post("/merge", response_model=BranchMergeResponse)
+async def merge_branches(
+    repo_id: uuid.UUID,
+    req: BranchMergeRequest,
+    auth: AuthContext = Depends(resolve_auth),
+    session: AsyncSession = Depends(get_db_session),
+) -> BranchMergeResponse:
+    """Merge source branch overlay into target branch."""
+    await _get_repo(repo_id, session)
+
+    source_result = await session.execute(
+        select(Branch).where(Branch.repo_id == repo_id, Branch.name == req.source_branch)
+    )
+    source = source_result.scalar_one_or_none()
+    if source is None:
+        raise HTTPException(status_code=404, detail=f"Branch '{req.source_branch}' not found")
+
+    target_result = await session.execute(
+        select(Branch).where(Branch.repo_id == repo_id, Branch.name == req.target_branch)
+    )
+    target = target_result.scalar_one_or_none()
+    if target is None:
+        raise HTTPException(status_code=404, detail=f"Branch '{req.target_branch}' not found")
+
+    if source.is_default:
+        raise HTTPException(status_code=400, detail="Cannot merge the default branch as source")
+
+    from attocode_intel.storage.branch_overlay import BranchOverlay
+
+    overlay = BranchOverlay(session)
+    stats = await overlay.merge_branch(
+        source.id, target.id, delete_source=req.delete_source,
+    )
+
+    from attocode_intel.audit import log_event
+
+    repo = await _get_repo(repo_id, session)
+    await log_event(
+        session, repo.org_id, "branch.merged", repo_id=repo_id,
+        detail={"source": req.source_branch, "target": req.target_branch, "stats": stats},
+    )
+
+    await session.commit()
+
+    return BranchMergeResponse(
+        source=req.source_branch,
+        target=req.target_branch,
+        **stats,
+    )
+
+
+@router.delete("/{branch_name}")
+async def delete_branch(
+    repo_id: uuid.UUID,
+    branch_name: str,
+    auth: AuthContext = Depends(resolve_auth),
+    session: AsyncSession = Depends(get_db_session),
+) -> dict:
+    """Delete a branch overlay (not the git branch)."""
+    await _get_repo(repo_id, session)
+
+    result = await session.execute(
+        select(Branch).where(Branch.repo_id == repo_id, Branch.name == branch_name)
+    )
+    branch = result.scalar_one_or_none()
+    if branch is None:
+        raise HTTPException(status_code=404, detail=f"Branch '{branch_name}' not found")
+
+    if branch.is_default:
+        raise HTTPException(status_code=400, detail="Cannot delete the default branch overlay")
+
+    repo = await _get_repo(repo_id, session)
+
+    await session.delete(branch)
+
+    from attocode_intel.audit import log_event
+
+    await log_event(session, repo.org_id, "branch.deleted", repo_id=repo_id, detail={"branch_name": branch_name})
+
+    await session.commit()
+    return {"detail": f"Branch overlay '{branch_name}' deleted"}