added multi user support, move api key to database

backend/app/routers/auth.py

@@ -0,0 +1,94 @@
+"""Login, logout, current-user and self-service password change.
+
+``POST /auth/login`` is the only unauthenticated endpoint here; the rest resolve
+the caller from their Bearer session token.
+"""
+
+from fastapi import APIRouter, Depends, Request, Security
+from sqlalchemy import select
+from sqlalchemy.orm import Session as DbSession
+
+from .. import auth
+from ..auth import bearer_scheme, get_current_admin
+from ..database import get_db
+from ..errors import APIError
+from ..models import Admin, Session
+from ..schemas import (
+    ChangePasswordRequest,
+    CurrentUser,
+    LoginRequest,
+    LoginResponse,
+)
+
+router = APIRouter(prefix="/auth", tags=["auth"])
+
+
+@router.post("/login", response_model=LoginResponse)
+def login(payload: LoginRequest, request: Request, db: DbSession = Depends(get_db)):
+    admin = db.execute(
+        select(Admin).where(Admin.username == payload.username)
+    ).scalar_one_or_none()
+    if admin is None or not auth.verify_password(payload.password, admin.password_hash):
+        # Generic message so we don't leak which usernames exist.
+        raise APIError(status_code=401, detail="Invalid username or password")
+
+    token = auth.create_session(db, admin)
+    auth.record_log(
+        db, username=admin.username, action="login", detail="Signed in", request=request
+    )
+    return LoginResponse(
+        token=token,
+        username=admin.username,
+        is_admin=admin.is_admin,
+        must_change_password=admin.must_change_password,
+    )
+
+
+@router.post("/logout", status_code=204)
+def logout(
+    request: Request,
+    admin: Admin = Depends(get_current_admin),
+    creds=Security(bearer_scheme),
+    db: DbSession = Depends(get_db),
+):
+    if creds and creds.credentials:
+        session = db.get(Session, creds.credentials)
+        if session is not None:
+            db.delete(session)
+            db.commit()
+    auth.record_log(db, username=admin.username, action="logout", detail="Signed out", request=request)
+
+
+@router.get("/me", response_model=CurrentUser)
+def me(admin: Admin = Depends(get_current_admin)):
+    return admin
+
+
+@router.post("/change-password", status_code=204)
+def change_password(
+    payload: ChangePasswordRequest,
+    request: Request,
+    admin: Admin = Depends(get_current_admin),
+    db: DbSession = Depends(get_db),
+):
+    """Change your OWN password. Any authenticated user may do this.
+
+    When the account is flagged ``must_change_password`` (a forced first-login or
+    post-reset change) the current password is not required — the user just
+    authenticated with it. A normal self-service change still verifies it.
+    """
+    if not admin.must_change_password:
+        if not payload.current_password or not auth.verify_password(
+            payload.current_password, admin.password_hash
+        ):
+            raise APIError(status_code=400, detail="Current password is incorrect")
+    admin.password_hash = auth.hash_password(payload.new_password)
+    admin.must_change_password = False
+    db.commit()
+    auth.record_log(
+        db,
+        username=admin.username,
+        action="change_password",
+        detail="Changed own password",
+        request=request,
+    )