73 lines
2.8 KiB
Python
73 lines
2.8 KiB
Python
from flask import Blueprint, render_template, request, redirect, url_for, session, flash
|
|
from werkzeug.security import generate_password_hash, check_password_hash
|
|
from app.db import query_one, execute_returning
|
|
from app.utils import parse_profile_fields
|
|
|
|
bp = Blueprint("auth", __name__)
|
|
|
|
|
|
@bp.route("/signup", methods=["GET", "POST"])
|
|
def signup():
|
|
if request.method == "POST":
|
|
username = request.form.get("username", "").strip()
|
|
password = request.form.get("password", "")
|
|
fields = parse_profile_fields(request.form)
|
|
|
|
# Validation
|
|
if not username or not password:
|
|
flash("Username and password are required.", "error")
|
|
return render_template("signup.html"), 400
|
|
|
|
if len(password) < 4:
|
|
flash("Password must be at least 4 characters.", "error")
|
|
return render_template("signup.html"), 400
|
|
|
|
# Check if username taken
|
|
existing = query_one("SELECT id FROM users WHERE username = %s", (username,))
|
|
if existing:
|
|
flash("Username already taken.", "error")
|
|
return render_template("signup.html"), 400
|
|
|
|
# Create user
|
|
password_hash = generate_password_hash(password)
|
|
user = execute_returning(
|
|
"""INSERT INTO users (username, password_hash, display_name, height_cm, age, gender, goal_weight_kg, starting_weight_kg, is_private)
|
|
VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s) RETURNING id""",
|
|
(username, password_hash,
|
|
fields["display_name"] or username,
|
|
fields["height_cm"], fields["age"], fields["gender"],
|
|
fields["goal_weight_kg"], fields["starting_weight_kg"],
|
|
fields["is_private"]),
|
|
)
|
|
|
|
session["user_id"] = user["id"]
|
|
flash("Welcome! You're all signed up.", "success")
|
|
return redirect(url_for("dashboard.index"))
|
|
|
|
return render_template("signup.html")
|
|
|
|
|
|
@bp.route("/login", methods=["GET", "POST"])
|
|
def login():
|
|
if request.method == "POST":
|
|
username = request.form.get("username", "").strip()
|
|
password = request.form.get("password", "")
|
|
|
|
user = query_one("SELECT * FROM users WHERE username = %s", (username,))
|
|
if not user or not check_password_hash(user["password_hash"], password):
|
|
flash("Invalid username or password.", "error")
|
|
return render_template("login.html"), 401
|
|
|
|
session["user_id"] = user["id"]
|
|
next_url = request.args.get("next", url_for("dashboard.index"))
|
|
return redirect(next_url)
|
|
|
|
return render_template("login.html")
|
|
|
|
|
|
@bp.route("/logout")
|
|
def logout():
|
|
session.clear()
|
|
flash("You've been logged out.", "info")
|
|
return redirect(url_for("auth.login"))
|