
    u֞iQ'                    Z   U d Z ddlmZ ddlZddlZddlmZmZmZ ddl	m
Z
mZmZmZmZ ddlmZmZ ddlmZmZ ddlmZmZ dd	lmZ  ej4                  e      Z e
d
dg      Zdaded<   d6dZ  G d de      Z! G d de      Z" G d de      Z# G d de      Z$ G d de      Z% G d de      Z&ejO                  de&ejP                  d       ee       f	 	 	 	 	 d7d       Z)ejO                  d e&d!"       ee       f	 	 	 	 	 d8d#       Z*ejO                  d$ejV                  d%&       ee       f	 	 	 	 	 d9d'       Z,ejO                  d(ejV                  d)&       e ed*+             ee       f	 	 	 	 	 d:d,       Z-ej]                  d-ejV                  d.&       ee      f	 	 	 d;d/       Z/ejO                  d0ejV                  d1&       ee       f	 	 	 	 	 d<d2       Z0ejc                  d3ejV                  d4&       ee       e ed*+             ee       f	 	 	 	 	 	 	 	 	 d=d5       Z2y)>u  
Genesis Customer Auth — FastAPI Routes
=======================================
Module 5, Story 5.03: Auth API router

Provides all customer-facing authentication endpoints for ReceptionistAI:

  POST   /auth/signup          Register new customer
  POST   /auth/login           Email + password login
  POST   /auth/magic-link      Send magic link
  POST   /auth/logout          Invalidate session
  GET    /auth/me              Get own profile
  POST   /auth/reset-password  Request password reset
  PUT    /auth/profile         Update own profile

Subscription tier hierarchy (locked, Kinan 2026-02-21):
  starter ($497) / professional ($997) / enterprise ($1,497) / queen ($20K+)

VERIFICATION_STAMP
Story: 5.03
Verified By: parallel-builder
Verified At: 2026-02-25
Tests: 7/7
Coverage: 100%
    )annotationsN)AnyDictOptional)	APIRouterDependsHTTPExceptionRequeststatus)HTTPAuthorizationCredentials
HTTPBearer)	BaseModelEmailStr)get_current_userrequire_auth)SupabaseAuthz/authauth)prefixtagszOptional[SupabaseAuth]_authc                 B    t         t        j                         a t         S )z<Lazy singleton. Tests override via app.dependency_overrides.)r   r   from_env     (/mnt/e/genesis-system/api/auth/routes.py	_get_authr   6   s     }%%'Lr   c                  0    e Zd ZU ded<   ded<   dZded<   y)SignUpRequestr   emailstrpasswordNOptional[str]name)__name__
__module____qualname____annotations__r#   r   r   r   r   r   B   s    OMD-r   r   c                  "    e Zd ZU ded<   ded<   y)LoginRequestr   r   r    r!   Nr$   r%   r&   r'   r   r   r   r)   r)   H   s    OMr   r)   c                      e Zd ZU ded<   y)MagicLinkRequestr   r   Nr*   r   r   r   r,   r,   M       Or   r,   c                      e Zd ZU ded<   y)ResetPasswordRequestr   r   Nr*   r   r   r   r/   r/   Q   r-   r   r/   c                  2    e Zd ZU dZded<   dZded<   ddiZy)ProfileUpdateRequestNr"   r#   subscription_tierextraallow)r$   r%   r&   r#   r'   r2   model_configr   r   r   r1   r1   U   s!    D-'+}+W%Lr   r1   c                  F    e Zd ZU dZded<   dZded<   dZded<   dZded<   y)AuthResponseNzOptional[Dict[str, Any]]usersessionr"   access_tokenmessage)r$   r%   r&   r8   r'   r9   r:   r;   r   r   r   r7   r7   \   s,    %)D
")(,G%,"&L-&!G]!r   r7   z/signupzRegister a new customer account)response_modelstatus_codesummaryc                J  K   ddi}| j                   r| j                   |d<   	 |j                  | j                  | j                  |       d{   }|S 7 # t        $ r@}t
        j                  d|       t        t        j                  t        |            |d}~ww xY ww)z
    Create a new ReceptionistAI customer account.

    Default subscription tier is ``starter`` ($497 AUD/mo).
    Returns the created user and session (if email auto-confirm is enabled).
    r2   starterr#   )metadataNzsignup error: %sr=   detail)r#   sign_upr   r!   	Exceptionloggererrorr	   r   HTTP_400_BAD_REQUESTr    )bodyr   rA   resultexcs        r   signuprL   g   s       !4Y?Hyy99||DJJ|QQ M R '-33s8
 	s:    B#+A AA B#A 	B  ;BB  B#z/loginz$Authenticate with email and password)r<   r>   c                   K   	 |j                  | j                  | j                         d{   }|S 7 # t        $ r:}t        j                  d|       t        t        j                  dddi      |d}~ww xY ww)z
    Authenticate an existing customer.

    Returns user profile, full session object, and ``access_token``
    at the top level for convenience.
    Nzlogin error: %szInvalid email or passwordzWWW-AuthenticateBearer)r=   rC   headers)	sign_inr   r!   rE   rF   rG   r	   r   HTTP_401_UNAUTHORIZEDrI   r   rJ   rK   s       r   loginrS      sv     ||DJJ>> M ? &,44.'2
 		s0   A<)6 46 A<6 	A95A44A99A<z/magic-linkzSend a magic-link login email)r=   r>   c                   K   	 |j                  | j                         d{   }|S 7 # t        $ r@}t        j	                  d|       t        t        j                  t        |            |d}~ww xY ww)zk
    Send a passwordless magic-link (OTP) to the customer's email.
    Returns a confirmation message.
    Nzmagic_link error: %srB   )	sign_in_magic_linkr   rE   rF   rG   r	   r   rH   r    rR   s       r   
magic_linkrV      sn     ..tzz:: M ; +S133s8
 	s0   A7+ )+ A7+ 	A4;A//A44A7z/logoutzInvalidate the current sessionT)
auto_errorc                   K   | j                   }	 |j                  |       d{    ddiS 7 # t        $ r@}t        j	                  d|       t        t        j                  t        |            |d}~ww xY ww)z
    Server-side session invalidation.

    Requires a valid ``Authorization: Bearer <token>`` header.
    Returns ``{"success": true}`` on success.
    Nzlogout error: %srB   successT)	credentialssign_outrE   rF   rG   r	   r   rH   r    )rZ   r   tokenrK   s       r   logoutr]      s|      ##EmmE""" t 	# '-33s8
 	s0   A;/ -/ A;/ 	A8;A33A88A;z/mezGet own profilec                   K   | S w)z
    Return the authenticated customer's profile.

    Requires ``Authorization: Bearer <token>`` header.
    Returns: id, email, subscription_tier, metadata, created_at, updated_at.
    r   )r8   s    r   mer_      s      Ks   z/reset-passwordzSend a password reset emailc                   K   	 |j                  | j                         d{    ddiS 7 # t        $ r#}t        j	                  d|       Y d}~ddiS d}~ww xY ww)z
    Trigger a password reset email for the given address.

    Always returns a success message (even if email not found) to prevent
    user enumeration attacks.
    Nz$reset_password error (non-fatal): %sr;   z8If that email is registered, a reset link has been sent.)reset_passwordr   rE   rF   warning)rI   r   rK   s      r   ra   ra      sf     D!!$**--- QRR	 	. D=sCCQRRDs6   A- +- A- 	AAAAAz/profilezUpdate own profilec                  K   |j                   }i }i }| j                  d      }|r|j                  |       |r||d<   |s|S 	 |j                  ||       d{   }|S 7 # t        $ r*}	t        t        j                  t        |	            |	d}	~	wt        $ r@}	t        j                  d|	       t        t        j                  t        |	            |	d}	~	ww xY ww)z
    Update the authenticated customer's profile metadata.

    Requires ``Authorization: Bearer <token>`` header.
    Allowed fields: name, subscription_tier, any extra metadata.
    Returns the updated user profile.
    T)exclude_unsetdataNrB   zupdate_profile error: %s)rZ   
model_dumpupdateupdate_user
ValueErrorr	   r   rQ   r    rE   rF   rG   rH   )
rI   r8   rZ   r   r\   updatesrA   	body_dataupdatedrK   s
             r   update_profilerm     s     ( ##E G Hd3I	""((88 N 9 44s8
 	  /533s8
 	sH   ACA" A A" C A" "	C+%BC;CCC)returnr   )rI   r   r   r   rn   Dict[str, Any])rI   r)   r   r   rn   ro   )rI   r,   r   r   rn   ro   )rZ   r   r   r   rn   ro   )r8   ro   rn   ro   )rI   r/   r   r   rn   ro   )
rI   r1   r8   ro   rZ   r   r   r   rn   ro   )3__doc__
__future__r   loggingostypingr   r   r   fastapir   r   r	   r
   r   fastapi.securityr   r   pydanticr   r   core.auth.middlewarer   r   core.auth.supabase_clientr   	getLoggerr$   rF   auth_routerr   r'   r   r   r)   r,   r/   r1   r7   postHTTP_201_CREATEDrL   rS   HTTP_200_OKrV   r]   getr_   ra   putrm   r   r   r   <module>r      s;  4 #  	 & & F F E ( ? 2			8	$
 wfX6
 !% $I 9 
y 9 &9 &"9 " ''-	   !+

 < 2   !+

 
6 ""+   !+

 
0 "",   18
d8S0T +-
 
6 	""   ##34	
		
	  "")   !+S
S
S S
S, ""    ##3407d#1 !+,
,
, ., , ,
,r   