several changes:

* api calls for auth

* exchange now bind to user

backend/trading_journal/crud.py

@@ -274,9 +274,10 @@ def get_exchange_by_id(session: Session, exchange_id: int) -> models.Exchanges |
     return session.get(models.Exchanges, exchange_id)
 
 
-def get_exchange_by_name(session: Session, name: str) -> models.Exchanges | None:
+def get_exchange_by_name_and_user_id(session: Session, name: str, user_id: int) -> models.Exchanges | None:
     statement = select(models.Exchanges).where(
         models.Exchanges.name == name,
+        models.Exchanges.user_id == user_id,
     )
     return session.exec(statement).first()
 
@@ -286,6 +287,13 @@ def get_all_exchanges(session: Session) -> list[models.Exchanges]:
     return session.exec(statement).all()
 
 
+def get_all_exchanges_by_user_id(session: Session, user_id: int) -> list[models.Exchanges]:
+    statement = select(models.Exchanges).where(
+        models.Exchanges.user_id == user_id,
+    )
+    return session.exec(statement).all()
+
+
 def update_exchange(session: Session, exchange_id: int, update_data: Mapping) -> models.Exchanges:
     exchange: models.Exchanges | None = session.get(models.Exchanges, exchange_id)
     if exchange is None:

backend/trading_journal/db.py

@@ -8,8 +8,6 @@ from sqlalchemy import event
 from sqlalchemy.pool import StaticPool
 from sqlmodel import Session, create_engine
 
-from trading_journal import db_migration
-
 if TYPE_CHECKING:
     from collections.abc import Generator
     from sqlite3 import Connection as DBAPIConnection
@@ -59,7 +57,6 @@ class Database:
             event.listen(self._engine, "connect", _enable_sqlite_pragmas)
 
     def init_db(self) -> None:
-        # db_migration.run_migrations(self._engine)
         pass
 
     def get_session(self) -> Generator[Session, None, None]:
@@ -74,7 +71,7 @@ class Database:
             session.close()
 
     @contextmanager
-    def get_session_ctx_manager(self) -> Session:
+    def get_session_ctx_manager(self) -> Generator[Session, None, None]:
         session = Session(self._engine)
         try:
             yield session

backend/trading_journal/db_migration.py

@@ -27,6 +27,7 @@ def _mig_0_1(engine: Engine) -> None:
             models_v1.Cycles.__table__,
             models_v1.Users.__table__,
             models_v1.Sessions.__table__,
+            models_v1.Exchanges.__table__,
         ],
     )
 

backend/trading_journal/dto.py

@@ -1,12 +1,12 @@
 from __future__ import annotations
 
+from datetime import date, datetime  # noqa: TC003
 from typing import TYPE_CHECKING
 
+from pydantic import BaseModel
 from sqlmodel import SQLModel
 
 if TYPE_CHECKING:
-    from datetime import date, datetime
-
     from trading_journal.models import TradeStrategy, TradeType, UnderlyingCurrency
 
 
@@ -52,5 +52,33 @@ class UserCreate(UserBase):
     password: str
 
 
+class UserLogin(BaseModel):
+    username: str
+    password: str
+
+
 class UserRead(UserBase):
     id: int
+
+
+class SessionsBase(SQLModel):
+    user_id: int
+
+
+class SessionRead(SessionsBase):
+    id: int
+    expires_at: datetime
+    last_seen_at: datetime | None
+    last_used_ip: str | None
+    user_agent: str | None
+
+
+class SessionsCreate(SessionsBase):
+    expires_at: datetime
+
+
+class SessionsUpdate(SQLModel):
+    expires_at: datetime | None = None
+    last_seen_at: datetime | None = None
+    last_used_ip: str | None = None
+    user_agent: str | None = None

backend/trading_journal/models.py

@@ -117,11 +117,14 @@ class Cycles(SQLModel, table=True):
 
 class Exchanges(SQLModel, table=True):
     __tablename__ = "exchanges"
+    __table_args__ = (UniqueConstraint("user_id", "name", name="uq_exchanges_user_name"),)
     id: int | None = Field(default=None, primary_key=True)
-    name: str = Field(sa_column=Column(Text, nullable=False, unique=True))
+    user_id: int = Field(foreign_key="users.id", nullable=False, index=True)
+    name: str = Field(sa_column=Column(Text, nullable=False))
     notes: str | None = Field(default=None, sa_column=Column(Text, nullable=True))
     trades: list["Trades"] = Relationship(back_populates="exchange")
     cycles: list["Cycles"] = Relationship(back_populates="exchange")
+    user: "Users" = Relationship(back_populates="exchanges")
 
 
 class Users(SQLModel, table=True):
@@ -131,6 +134,8 @@ class Users(SQLModel, table=True):
     username: str = Field(sa_column=Column(Text, nullable=False, unique=True))
     password_hash: str = Field(sa_column=Column(Text, nullable=False))
     is_active: bool = Field(default=True, nullable=False)
+    sessions: list["Sessions"] = Relationship(back_populates="user")
+    exchanges: list["Exchanges"] = Relationship(back_populates="user")
 
 
 class Sessions(SQLModel, table=True):
@@ -144,3 +149,4 @@ class Sessions(SQLModel, table=True):
     last_used_ip: str | None = Field(default=None, sa_column=Column(Text, nullable=True))
     user_agent: str | None = Field(default=None, sa_column=Column(Text, nullable=True))
     device_name: str | None = Field(default=None, sa_column=Column(Text, nullable=True))
+    user: "Users" = Relationship(back_populates="sessions")

backend/trading_journal/models_v1.py

@@ -117,11 +117,14 @@ class Cycles(SQLModel, table=True):
 
 class Exchanges(SQLModel, table=True):
     __tablename__ = "exchanges"
+    __table_args__ = (UniqueConstraint("user_id", "name", name="uq_exchanges_user_name"),)
     id: int | None = Field(default=None, primary_key=True)
-    name: str = Field(sa_column=Column(Text, nullable=False, unique=True))
+    user_id: int = Field(foreign_key="users.id", nullable=False, index=True)
+    name: str = Field(sa_column=Column(Text, nullable=False))
     notes: str | None = Field(default=None, sa_column=Column(Text, nullable=True))
     trades: list["Trades"] = Relationship(back_populates="exchange")
     cycles: list["Cycles"] = Relationship(back_populates="exchange")
+    user: "Users" = Relationship(back_populates="exchanges")
 
 
 class Users(SQLModel, table=True):
@@ -131,6 +134,8 @@ class Users(SQLModel, table=True):
     username: str = Field(sa_column=Column(Text, nullable=False, unique=True))
     password_hash: str = Field(sa_column=Column(Text, nullable=False))
     is_active: bool = Field(default=True, nullable=False)
+    sessions: list["Sessions"] = Relationship(back_populates="user")
+    exchanges: list["Exchanges"] = Relationship(back_populates="user")
 
 
 class Sessions(SQLModel, table=True):
@@ -144,3 +149,4 @@ class Sessions(SQLModel, table=True):
     last_used_ip: str | None = Field(default=None, sa_column=Column(Text, nullable=True))
     user_agent: str | None = Field(default=None, sa_column=Column(Text, nullable=True))
     device_name: str | None = Field(default=None, sa_column=Column(Text, nullable=True))
+    user: "Users" = Relationship(back_populates="sessions")

backend/trading_journal/service.py

@@ -1,3 +1,7 @@
+from __future__ import annotations
+
+import logging
+from datetime import datetime, timedelta, timezone
 from typing import Callable
 
 from fastapi import Request, Response, status
@@ -8,17 +12,23 @@ from starlette.middleware.base import BaseHTTPMiddleware
 import settings
 from trading_journal import crud, security
 from trading_journal.db import Database
-from trading_journal.dto import UserCreate, UserRead
+from trading_journal.dto import SessionsCreate, SessionsUpdate, UserCreate, UserLogin, UserRead
 from trading_journal.models import Sessions
 
+SessionsCreate.model_rebuild()
+
+
 EXCEPT_PATHS = [
     f"{settings.settings.api_base}/status",
     f"{settings.settings.api_base}/register",
+    f"{settings.settings.api_base}/login",
 ]
 
+logger = logging.getLogger(__name__)
+
 
 class AuthMiddleWare(BaseHTTPMiddleware):
-    async def dispatch(self, request: Request, call_next: Callable[[Request], Response]) -> Response:
+    async def dispatch(self, request: Request, call_next: Callable[[Request], Response]) -> Response:  # noqa: PLR0911
         if request.url.path in EXCEPT_PATHS:
             return await call_next(request)
 
@@ -42,10 +52,32 @@ class AuthMiddleWare(BaseHTTPMiddleware):
                 hashed_token = security.hash_session_token_sha256(token)
                 request.state.db_session = request_session
                 login_session: Sessions | None = crud.get_login_session_by_token_hash(request.state.db_session, hashed_token)
-        except Exception:  # noqa: BLE001
-            return JSONResponse(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, content={"detail": "db error"})
+                if not login_session:
+                    return JSONResponse(status_code=status.HTTP_401_UNAUTHORIZED, content={"detail": "Unauthorized"})
+                session_expires_utc = login_session.expires_at.replace(tzinfo=timezone.utc)
+                if session_expires_utc < datetime.now(timezone.utc):
+                    crud.delete_login_session(request.state.db_session, login_session)
+                    return JSONResponse(status_code=status.HTTP_401_UNAUTHORIZED, content={"detail": "Unauthorized"})
+                if login_session.user.is_active is False:
+                    return JSONResponse(status_code=status.HTTP_401_UNAUTHORIZED, content={"detail": "Unauthorized"})
+                if session_expires_utc - datetime.now(timezone.utc) < timedelta(seconds=3600):
+                    updated_expiry = datetime.now(timezone.utc) + timedelta(seconds=settings.settings.session_expiry_seconds)
+                else:
+                    updated_expiry = session_expires_utc
+                updated_session: SessionsUpdate = SessionsUpdate(
+                    last_seen_at=datetime.now(timezone.utc),
+                    last_used_ip=request.client.host if request.client else None,
+                    user_agent=request.headers.get("User-Agent"),
+                    expires_at=updated_expiry,
+                )
+                user_id = login_session.user_id
+                request.state.user_id = user_id
+                crud.update_login_session(request.state.db_session, hashed_token, update_session=updated_session)
+        except Exception:
+            logger.exception("Failed to authenticate user: \n")
+            return JSONResponse(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, content={"detail": "Internal server error"})
 
-        return None
+        return await call_next(request)
 
 
 class ServiceError(Exception):
@@ -60,13 +92,46 @@ def register_user_service(db_session: Session, user_in: UserCreate) -> UserRead:
     if crud.get_user_by_username(db_session, user_in.username):
         raise UserAlreadyExistsError("username already exists")
     hashed = security.hash_password(user_in.password)
+    user_data: dict = {
+        "username": user_in.username,
+        "password_hash": hashed,
+    }
     try:
-        user = crud.create_user(db_session, username=user_in.username, hashed_password=hashed)
+        user = crud.create_user(db_session, user_data=user_data)
         try:
             # prefer pydantic's from_orm if DTO supports orm_mode
             user = UserRead.model_validate(user)
         except Exception as e:
+            logger.exception("Failed to convert user to UserRead: %s", e)
             raise ServiceError("Failed to convert user to UserRead") from e
     except Exception as e:
+        logger.exception("Failed to create user:")
         raise ServiceError("Failed to create user") from e
     return user
+
+
+def authenticate_user_service(db_session: Session, user_in: UserLogin) -> tuple[SessionsCreate, str] | None:
+    user = crud.get_user_by_username(db_session, user_in.username)
+    if not user:
+        return None
+
+    if not security.verify_password(user_in.password, user.password_hash):
+        return None
+
+    token = security.generate_session_token()
+    token_hashed = security.hash_session_token_sha256(token)
+    try:
+        session = crud.create_login_session(
+            session=db_session,
+            user_id=user.id,
+            session_token_hash=token_hashed,
+            session_length_seconds=settings.settings.session_expiry_seconds,
+        )
+    except Exception as e:
+        logger.exception("Failed to create login session: \n")
+        raise ServiceError("Failed to create login session") from e
+    return SessionsCreate.model_validate(session), token
+
+
+def get_trades_service(db_session: Session, user_id: int) -> list:
+    return crud.get_trades_by_user_id(db_session, user_id)