253 lines
No EOL
8.9 KiB
Python
253 lines
No EOL
8.9 KiB
Python
"""
|
|
TEE OFF BACKEND API v3.6.8 - THE RESTORED MASTER VERSION
|
|
---------------------------------------------------------------------------
|
|
REGEL 1: Bruk str (ikke string) for type-hinting.
|
|
REGEL 2: Inkluder alle subqueries for banestatus og hull-data.
|
|
REGEL 3: Robust JSON-parsing (format_row) for å hindre Frontend-krasj.
|
|
REGEL 4: JWT-sesjoner lagres i HTTP-only cookies.
|
|
LOV: Aldri trunker eller slett logikk for "effektivitet".
|
|
---------------------------------------------------------------------------
|
|
"""
|
|
|
|
from fastapi import FastAPI, HTTPException, Response, Cookie, Depends, Request
|
|
from fastapi.middleware.cors import CORSMiddleware
|
|
from contextlib import asynccontextmanager
|
|
import asyncpg
|
|
import json
|
|
import pyotp
|
|
import os
|
|
from datetime import datetime, date, timedelta
|
|
from jose import jwt, JWTError
|
|
from passlib.context import CryptContext
|
|
from dotenv import load_dotenv
|
|
|
|
load_dotenv()
|
|
|
|
# --- KONFIGURASJON ---
|
|
DB_URL = os.getenv("DATABASE_URL", "postgresql://teeoff_admin:teeoff_secret_password@db:5432/teeoff")
|
|
SECRET_KEY = os.getenv("JWT_SECRET", "super_secret_change_this_in_production")
|
|
ALGORITHM = "HS256"
|
|
|
|
# VIKTIG: Vi bruker PBKDF2-SHA256 for å unngå Bcrypt-begrensninger
|
|
pwd_context = CryptContext(schemes=["pbkdf2_sha256"], deprecated="auto")
|
|
|
|
def format_row(row):
|
|
"""
|
|
Vasker data fra databasen:
|
|
1. Konverterer datoer til ISO-format.
|
|
2. Tvinger tekst-JSON (stringified JSON) over til ekte Python objekter/lister.
|
|
3. Sikrer at lister og objekter aldri er None for å hindre Frontend-krasj.
|
|
"""
|
|
if row is None:
|
|
return None
|
|
|
|
d = dict(row)
|
|
|
|
# 1. Håndter dato- og tidsformater for JSON-serialisering
|
|
for key in ['status_updated_at', 'created_at']:
|
|
if isinstance(d.get(key), (date, datetime)):
|
|
d[key] = d[key].isoformat()
|
|
|
|
# 2. Definer alle felter som inneholder JSON-data
|
|
json_list_fields = [
|
|
'course_statuses', 'courses', 'gallery', 'greenfee',
|
|
'faqs', 'shotzoom', 'social_links', 'holes'
|
|
]
|
|
json_dict_fields = [
|
|
'amenities', 'vtg', 'nsg_data', 'golfamore_data'
|
|
]
|
|
|
|
# Vask list-felter
|
|
for field in json_list_fields:
|
|
if field in d:
|
|
val = d[field]
|
|
if val is None:
|
|
d[field] = []
|
|
elif isinstance(val, str):
|
|
try:
|
|
d[field] = json.loads(val)
|
|
except:
|
|
d[field] = []
|
|
elif not isinstance(val, list):
|
|
d[field] = []
|
|
|
|
# Vask objekt-felter
|
|
for field in json_dict_fields:
|
|
if field in d:
|
|
val = d[field]
|
|
if val is None:
|
|
d[field] = {}
|
|
elif isinstance(val, str):
|
|
try:
|
|
d[field] = json.loads(val)
|
|
except:
|
|
d[field] = {}
|
|
elif not isinstance(val, dict):
|
|
d[field] = {}
|
|
|
|
return d
|
|
|
|
@asynccontextmanager
|
|
async def lifespan(app: FastAPI):
|
|
# Opprett database-pool ved start
|
|
try:
|
|
print(f"📡 Forsøker å koble til database på: {DB_URL}")
|
|
app.state.pool = await asyncpg.create_pool(
|
|
DB_URL,
|
|
min_size=5,
|
|
max_size=20,
|
|
command_timeout=60
|
|
)
|
|
print("✅ Database tilkoblet og pool opprettet")
|
|
except Exception as e:
|
|
print(f"❌ Databasefeil under oppstart: {e}")
|
|
raise e
|
|
yield
|
|
# Lukk pool ved avslutning
|
|
await app.state.pool.close()
|
|
|
|
app = FastAPI(title="TeeOff API v3.6.8", lifespan=lifespan)
|
|
|
|
# CORS - Tillater både lokal utvikling og produksjonsdomene
|
|
app.add_middleware(
|
|
CORSMiddleware,
|
|
allow_origins=[
|
|
"https://nye.teeoff.no",
|
|
"http://nye.teeoff.no",
|
|
"http://localhost:3000"
|
|
],
|
|
allow_credentials=True,
|
|
allow_methods=["*"],
|
|
allow_headers=["*"],
|
|
)
|
|
|
|
# --- AUTH ENDPOINTS ---
|
|
|
|
@app.post("/api/auth/login")
|
|
async def login(data: dict):
|
|
"""Steg 1: Sjekk passord og returner temp_token for 2FA."""
|
|
print(f"🔐 Loggin-forsøk for: {data.get('username')}")
|
|
|
|
async with app.state.pool.acquire() as conn:
|
|
admin = await conn.fetchrow(
|
|
"SELECT * FROM admins WHERE username = $1 OR email = $1",
|
|
data.get('username')
|
|
)
|
|
|
|
if not admin:
|
|
print(" - ❌ Bruker ikke funnet i databasen")
|
|
raise HTTPException(status_code=401, detail="Ugyldig brukernavn eller passord")
|
|
|
|
h = admin['password_hash']
|
|
print(f" - Verifiserer hash i DB (starter med: {h[:20]}...)")
|
|
|
|
# FIKS: Vi pakker KUN selve verify-sjekken inn i try/except
|
|
try:
|
|
is_valid = pwd_context.verify(data.get('password'), h)
|
|
except Exception as e:
|
|
print(f" - 🔥 FEIL VED LESING AV HASH: {e}")
|
|
raise HTTPException(status_code=500, detail="Internt problem med passord-format")
|
|
|
|
# FIKS: 401 kastes nå UTENFOR try-blokken, slik at vi unngår 500-krasj
|
|
if not is_valid:
|
|
print(" - ❌ Passordet samsvarer ikke med hashen")
|
|
raise HTTPException(status_code=401, detail="Ugyldig brukernavn eller passord")
|
|
|
|
temp_token = jwt.encode(
|
|
{"sub": admin['username'], "partial": True, "exp": datetime.utcnow() + timedelta(minutes=5)},
|
|
SECRET_KEY, algorithm=ALGORITHM
|
|
)
|
|
print(" - ✅ Steg 1 fullført. Temp-token generert.")
|
|
return {"step": "2fa", "temp_token": temp_token}
|
|
|
|
@app.post("/api/auth/verify-2fa")
|
|
async def verify_2fa(data: dict, response: Response):
|
|
"""Steg 2: Verifiser TOTP-kode og sett session cookie."""
|
|
try:
|
|
payload = jwt.decode(data.get('temp_token'), SECRET_KEY, algorithms=[ALGORITHM])
|
|
if not payload.get("partial"):
|
|
raise JWTError()
|
|
username = payload.get("sub")
|
|
except JWTError:
|
|
raise HTTPException(status_code=401, detail="Sesjonen har utløpt eller er ugyldig")
|
|
|
|
async with app.state.pool.acquire() as conn:
|
|
admin = await conn.fetchrow("SELECT otp_secret FROM admins WHERE username = $1", username)
|
|
|
|
totp = pyotp.TOTP(admin['otp_secret'])
|
|
if not totp.verify(data.get('code')):
|
|
print(f" - ❌ Feil 2FA-kode oppgitt for {username}")
|
|
raise HTTPException(status_code=401, detail="Feil 2FA-kode")
|
|
|
|
final_token = jwt.encode(
|
|
{"sub": username, "exp": datetime.utcnow() + timedelta(hours=12)},
|
|
SECRET_KEY, algorithm=ALGORITHM
|
|
)
|
|
|
|
# Sett som HTTP-only cookie
|
|
response.set_cookie(
|
|
key="admin_session",
|
|
value=final_token,
|
|
httponly=True,
|
|
samesite="lax",
|
|
secure=False # Sett til True i produksjon (HTTPS)
|
|
)
|
|
return {"status": "success"}
|
|
|
|
# --- DATA ENDPOINTS ---
|
|
|
|
@app.get("/api/facilities")
|
|
async def get_facilities():
|
|
"""Henter alle golfanlegg med aggregert banestatus for forsiden."""
|
|
async with app.state.pool.acquire() as conn:
|
|
rows = await conn.fetch("""
|
|
SELECT f.*, (
|
|
SELECT jsonb_agg(cs) FROM (
|
|
SELECT name, status FROM courses
|
|
WHERE facility_id = f.id AND status != 'finnes_ingen_bane_to'
|
|
ORDER BY is_main_course DESC, id ASC
|
|
) cs
|
|
) as course_statuses
|
|
FROM facilities f
|
|
ORDER BY f.name ASC
|
|
""")
|
|
return [format_row(row) for row in rows]
|
|
|
|
@app.get("/api/facilities/{slug}")
|
|
async def get_facility(slug: str):
|
|
"""Henter detaljer for ett spesifikt golfanlegg inkludert alle baner og hull."""
|
|
async with app.state.pool.acquire() as conn:
|
|
row = await conn.fetchrow("""
|
|
SELECT f.*, (
|
|
SELECT jsonb_agg(c_data) FROM (
|
|
SELECT c.*, (
|
|
SELECT jsonb_agg(h_data ORDER BY h_data.hole_number ASC)
|
|
FROM (SELECT * FROM holes WHERE course_id = c.id) h_data
|
|
) as holes
|
|
FROM courses c
|
|
WHERE c.facility_id = f.id
|
|
AND (c.is_main_course = true OR (c.status NOT IN ('finnes_ingen_bane_to', 'ukjent')))
|
|
ORDER BY c.is_main_course DESC, c.id ASC
|
|
) c_data
|
|
) as courses
|
|
FROM facilities f WHERE f.slug = $1
|
|
""", slug)
|
|
|
|
if not row:
|
|
raise HTTPException(status_code=404, detail="Golfanlegget ble ikke funnet")
|
|
|
|
return format_row(row)
|
|
|
|
@app.get("/api/health")
|
|
async def health_check():
|
|
"""Enkel sjekk for å se at API og DB lever."""
|
|
try:
|
|
async with app.state.pool.acquire() as conn:
|
|
await conn.execute("SELECT 1")
|
|
return {"status": "healthy", "database": "connected"}
|
|
except Exception as e:
|
|
return {"status": "unhealthy", "error": str(e)}
|
|
|
|
if __name__ == "__main__":
|
|
import uvicorn
|
|
uvicorn.run(app, host="0.0.0.0", port=8000) |