2fa17e5feb
Same routes, same Docker topology, same env vars. Frontend untouched.
Backend swap:
- Hono on Node -> FastAPI on Python 3.12, served by uvicorn behind Caddy.
- Drizzle on Node -> SQLAlchemy 2.0 async (asyncpg driver) with declarative
models that mirror the previous schema 1:1. Migrations are still plain
SQL files (apps/api/app/migrations/) run idempotently at startup by
app/db/migrate.py via asyncpg, tracking each file's sha256 in a
schema_migrations table.
- aws4fetch -> boto3 wrapped in asyncio.to_thread so the async routes
do not block on MinIO/S3 calls. The presign_put / init_multipart /
complete_multipart / head / delete contract is unchanged so the React
client sees the same /api/uploads/* payloads.
- Cookie+JWT admin auth -> pyjwt + FastAPI Cookie() dependency.
constant-time password compare. Same 7-day HttpOnly cookie shape.
- QR code: qrcode lib + reportlab. /api/qrcode keeps format=png|svg|pdf;
the PDF is still A6 with the couple's names + 'Aponte a câmera' CTA.
- Pydantic-settings replaces the zod env loader and still fails fast
on missing required vars.
Routes ported with identical paths and JSON shapes:
- public: /api/event, /api/gallery, /api/qrcode, /api/stats
- uploads: /api/uploads/init, /{id}/confirm, /{id}/abort
- admin: /login, /logout, /me, /event (GET+PATCH), /uploads (GET with
?status, ?kind=photo|video, ?q= for search), /uploads/{id} (PATCH
for author/message edit), /uploads/{id}/{approve,reject,cover},
/uploads/{id} (DELETE), /event/cover (DELETE), /uploads/bulk, /stats.
Build pipeline:
- Dockerfile: stage 1 builds the React/Vite SPA with pnpm; stage 2 is
python:3.12-slim that installs deps via uv (fast, reproducible),
copies the app/, and copies the SPA dist from stage 1 into /app/public
so the FastAPI process serves both /api/* and the SPA assets.
- docker-compose.yml unchanged: postgres + minio + minio-init + app +
caddy. Same env vars (DATABASE_URL, S3_*, ADMIN_PASSWORD, SESSION_SECRET,
ALLOWED_ADMIN_EMAILS, AUTO_MIGRATE).
- Removed apps/api from the pnpm workspace; root package.json now only
scripts the web. Makefile centralizes dev/build/docker commands so
the Python side has the same DX as the Node side did.
58 lines
1.5 KiB
Python
58 lines
1.5 KiB
Python
import hmac
|
|
import time
|
|
from typing import Annotated
|
|
|
|
import jwt
|
|
from fastapi import Cookie, HTTPException, Response
|
|
|
|
from ..config import settings
|
|
|
|
COOKIE_NAME = "wedding_admin"
|
|
SESSION_TTL = 60 * 60 * 24 * 7 # 7 days
|
|
|
|
|
|
def constant_time_eq(a: str, b: str) -> bool:
|
|
return hmac.compare_digest(a.encode("utf-8"), b.encode("utf-8"))
|
|
|
|
|
|
def _create_token(email: str) -> str:
|
|
payload = {
|
|
"email": email,
|
|
"exp": int(time.time()) + SESSION_TTL,
|
|
}
|
|
return jwt.encode(payload, settings.SESSION_SECRET, algorithm="HS256")
|
|
|
|
|
|
def set_session_cookie(response: Response, email: str) -> None:
|
|
token = _create_token(email)
|
|
response.set_cookie(
|
|
key=COOKIE_NAME,
|
|
value=token,
|
|
max_age=SESSION_TTL,
|
|
httponly=True,
|
|
secure=settings.is_production,
|
|
samesite="lax",
|
|
path="/",
|
|
)
|
|
|
|
|
|
def clear_session_cookie(response: Response) -> None:
|
|
response.delete_cookie(COOKIE_NAME, path="/")
|
|
|
|
|
|
def get_admin_email(
|
|
wedding_admin: Annotated[str | None, Cookie(alias=COOKIE_NAME)] = None,
|
|
) -> str:
|
|
if not wedding_admin:
|
|
raise HTTPException(status_code=401, detail="unauthorized")
|
|
try:
|
|
payload = jwt.decode(
|
|
wedding_admin, settings.SESSION_SECRET, algorithms=["HS256"]
|
|
)
|
|
except jwt.PyJWTError as e:
|
|
raise HTTPException(status_code=401, detail="unauthorized") from e
|
|
email = payload.get("email")
|
|
if not email or not isinstance(email, str):
|
|
raise HTTPException(status_code=401, detail="unauthorized")
|
|
return email
|