This repository has been archived on 2026-06-09. You can view files and clone it, but cannot push or open issues or pull requests.
wedding-app/infra/wedding_photo/apps/api/app/lib/ids.py

23 lines
452 B
Python
Raw Normal View History

feat: rewrite backend in Python (FastAPI + SQLAlchemy + boto3) Same routes, same Docker topology, same env vars. Frontend untouched. Backend swap: - Hono on Node -> FastAPI on Python 3.12, served by uvicorn behind Caddy. - Drizzle on Node -> SQLAlchemy 2.0 async (asyncpg driver) with declarative models that mirror the previous schema 1:1. Migrations are still plain SQL files (apps/api/app/migrations/) run idempotently at startup by app/db/migrate.py via asyncpg, tracking each file's sha256 in a schema_migrations table. - aws4fetch -> boto3 wrapped in asyncio.to_thread so the async routes do not block on MinIO/S3 calls. The presign_put / init_multipart / complete_multipart / head / delete contract is unchanged so the React client sees the same /api/uploads/* payloads. - Cookie+JWT admin auth -> pyjwt + FastAPI Cookie() dependency. constant-time password compare. Same 7-day HttpOnly cookie shape. - QR code: qrcode lib + reportlab. /api/qrcode keeps format=png|svg|pdf; the PDF is still A6 with the couple's names + 'Aponte a câmera' CTA. - Pydantic-settings replaces the zod env loader and still fails fast on missing required vars. Routes ported with identical paths and JSON shapes: - public: /api/event, /api/gallery, /api/qrcode, /api/stats - uploads: /api/uploads/init, /{id}/confirm, /{id}/abort - admin: /login, /logout, /me, /event (GET+PATCH), /uploads (GET with ?status, ?kind=photo|video, ?q= for search), /uploads/{id} (PATCH for author/message edit), /uploads/{id}/{approve,reject,cover}, /uploads/{id} (DELETE), /event/cover (DELETE), /uploads/bulk, /stats. Build pipeline: - Dockerfile: stage 1 builds the React/Vite SPA with pnpm; stage 2 is python:3.12-slim that installs deps via uv (fast, reproducible), copies the app/, and copies the SPA dist from stage 1 into /app/public so the FastAPI process serves both /api/* and the SPA assets. - docker-compose.yml unchanged: postgres + minio + minio-init + app + caddy. Same env vars (DATABASE_URL, S3_*, ADMIN_PASSWORD, SESSION_SECRET, ALLOWED_ADMIN_EMAILS, AUTO_MIGRATE). - Removed apps/api from the pnpm workspace; root package.json now only scripts the web. Makefile centralizes dev/build/docker commands so the Python side has the same DX as the Node side did.
2026-06-07 19:45:20 -03:00
import hashlib
import secrets
_ALPHABET = "0123456789abcdefghijklmnopqrstuvwxyz"
def _nanoid(size: int = 16) -> str:
n = len(_ALPHABET)
return "".join(_ALPHABET[secrets.randbelow(n)] for _ in range(size))
def upload_id() -> str:
return f"up_{_nanoid()}"
def audit_id() -> str:
return f"au_{_nanoid()}"
def hash_ip(ip: str, salt: str) -> str:
h = hashlib.sha256(f"{salt}:{ip}".encode("utf-8")).hexdigest()
return h[:32]