feat: Phase 0 – Gerüst (FastAPI+SQLite, Multi-User-Login, React-App-Shell, Deploy)

Grundgerüst für Certain Finance: - Backend: FastAPI + SQLAlchemy + SQLite, Alembic-Migrationen (Batch-Mode), argon2-Passwort-Hashing, server-seitige Sitzungen im Cookie, Erst-Admin, Benutzerverwaltung mit Temporär-Passwort, Einstellungen je Benutzer. - Ein Prozess, ein Port: uvicorn liefert API (/api) und gebautes SPA aus, inkl. SPA-Deeplink-Fallback. - Frontend: React 18 + Vite + JSX, Design-Tokens (Light/Dark), i18n DE/EN, Inline-SVG-Icons (keine Emojis), Login, Passwort-ändern, Dashboard-Platzhalter, Benutzer- und Einstellungsseiten. - Deploy: nativer LXC-Installer + Update-Skript (systemd), env-Vorlage, Doku. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-08-19 18:27:42 +02:00
commit 2c795a57c8
59 changed files with 6419 additions and 0 deletions
@@ -0,0 +1,82 @@
+"""Anmeldung über server-seitige Sitzung im Cookie."""
+
+from fastapi import APIRouter, Depends, HTTPException, Request, Response, status
+from fastapi.security import OAuth2PasswordRequestForm
+from sqlalchemy.orm import Session
+
+from ..config import get_settings
+from ..database import get_db
+from ..deps import get_current_user
+from ..models import User
+from ..schemas import PasswordChange, UserOut
+from ..security import hash_password, verify_password
+from ..services import sessions
+
+router = APIRouter(prefix="/auth", tags=["auth"])
+
+
+def _set_session_cookie(response: Response, raw_token: str) -> None:
+    settings = get_settings()
+    response.set_cookie(
+        key=settings.cookie_name,
+        value=raw_token,
+        max_age=settings.session_ttl_days * 86400,
+        httponly=True,
+        secure=settings.cookie_secure,
+        samesite=settings.cookie_samesite,
+        path="/",
+    )
+
+
+@router.post("/login", response_model=UserOut)
+def login(
+    response: Response,
+    request: Request,
+    form: OAuth2PasswordRequestForm = Depends(),
+    db: Session = Depends(get_db),
+) -> User:
+    user = db.query(User).filter(User.username == form.username).first()
+    if user is None or not verify_password(form.password, user.password_hash):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Benutzername oder Passwort falsch",
+        )
+    if not user.is_active:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Dieses Konto ist deaktiviert",
+        )
+    raw = sessions.create_session(db, user, request.headers.get("user-agent"))
+    _set_session_cookie(response, raw)
+    return user
+
+
+@router.post("/logout", status_code=status.HTTP_204_NO_CONTENT)
+def logout(request: Request, response: Response, db: Session = Depends(get_db)) -> None:
+    token = request.cookies.get(get_settings().cookie_name, "")
+    if token:
+        sessions.revoke(db, token)
+    response.delete_cookie(get_settings().cookie_name, path="/")
+
+
+@router.get("/me", response_model=UserOut)
+def me(current_user: User = Depends(get_current_user)) -> User:
+    return current_user
+
+
+@router.post("/change-password", response_model=UserOut)
+def change_password(
+    payload: PasswordChange,
+    current_user: User = Depends(get_current_user),
+    db: Session = Depends(get_db),
+) -> User:
+    if not verify_password(payload.current_password, current_user.password_hash):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Aktuelles Passwort ist falsch",
+        )
+    current_user.password_hash = hash_password(payload.new_password)
+    current_user.must_change_password = False
+    db.commit()
+    db.refresh(current_user)
+    return current_user
@@ -0,0 +1,67 @@
+"""Anzeige-/Verhaltens-Einstellungen je Benutzer (Schlüssel-Wert).
+
+Jeder Benutzer hat seine eigenen Einstellungen. Unbekannte Schlüssel werden
+ebenfalls gespeichert; die hier bekannten liefern sinnvolle Vorgaben.
+"""
+
+from fastapi import APIRouter, Depends
+from sqlalchemy.orm import Session
+
+from ..config import get_settings
+from ..database import get_db
+from ..deps import get_current_user
+from ..models import User, UserSetting
+from ..schemas import SettingOut
+
+router = APIRouter(prefix="/settings", tags=["settings"])
+
+BASE_CURRENCY_KEY = "base_currency"
+BUDGET_START_DAY_KEY = "budget_start_day"
+LOCALE_KEY = "locale"
+THEME_KEY = "theme"
+DATE_FORMAT_KEY = "date_format"
+
+
+def known_defaults() -> dict[str, str]:
+    return {
+        BASE_CURRENCY_KEY: get_settings().default_base_currency,
+        BUDGET_START_DAY_KEY: "1",
+        LOCALE_KEY: "de",
+        THEME_KEY: "system",
+        DATE_FORMAT_KEY: "de",
+    }
+
+
+def get_user_setting(db: Session, user: User, key: str) -> str | None:
+    row = db.get(UserSetting, (user.id, key))
+    if row is not None and row.value is not None:
+        return row.value
+    return known_defaults().get(key)
+
+
+@router.get("", response_model=list[SettingOut])
+def list_settings(
+    db: Session = Depends(get_db), user: User = Depends(get_current_user)
+) -> list[SettingOut]:
+    rows = db.query(UserSetting).filter(UserSetting.user_id == user.id).all()
+    merged: dict[str, str | None] = dict(known_defaults())
+    for r in rows:
+        merged[r.key] = r.value
+    return [SettingOut(key=k, value=v) for k, v in merged.items()]
+
+
+@router.put("/{key}", response_model=SettingOut)
+def set_setting(
+    key: str,
+    value: str,
+    db: Session = Depends(get_db),
+    user: User = Depends(get_current_user),
+) -> SettingOut:
+    row = db.get(UserSetting, (user.id, key))
+    if row is None:
+        row = UserSetting(user_id=user.id, key=key, value=value)
+        db.add(row)
+    else:
+        row.value = value
+    db.commit()
+    return SettingOut(key=key, value=value)
@@ -0,0 +1,78 @@
+"""Benutzerverwaltung (nur Admin). Neue Nutzer bekommen ein Temporär-Passwort."""
+
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy.orm import Session
+
+from ..database import get_db
+from ..deps import require_admin
+from ..models import Role, User
+from ..schemas import UserCreate, UserOut, UserUpdate
+from ..security import hash_password
+
+router = APIRouter(prefix="/users", tags=["users"], dependencies=[Depends(require_admin)])
+
+
+@router.get("", response_model=list[UserOut])
+def list_users(db: Session = Depends(get_db)) -> list[User]:
+    return db.query(User).order_by(User.username).all()
+
+
+@router.post("", response_model=UserOut, status_code=status.HTTP_201_CREATED)
+def create_user(payload: UserCreate, db: Session = Depends(get_db)) -> User:
+    if db.query(User).filter(User.username == payload.username).first():
+        raise HTTPException(status.HTTP_409_CONFLICT, "Benutzername existiert bereits")
+    user = User(
+        username=payload.username,
+        password_hash=hash_password(payload.password),
+        role=payload.role,
+        display_name=payload.display_name,
+        is_active=True,
+        # Vom Admin gesetztes Temporär-Passwort: beim ersten Login ändern lassen.
+        must_change_password=True,
+    )
+    db.add(user)
+    db.commit()
+    db.refresh(user)
+    return user
+
+
+@router.patch("/{user_id}", response_model=UserOut)
+def update_user(user_id: int, payload: UserUpdate, db: Session = Depends(get_db)) -> User:
+    user = db.get(User, user_id)
+    if user is None:
+        raise HTTPException(status.HTTP_404_NOT_FOUND, "Benutzer nicht gefunden")
+    if payload.password is not None:
+        user.password_hash = hash_password(payload.password)
+        # Vom Admin gesetztes Passwort gilt als temporär.
+        user.must_change_password = True
+    if payload.role is not None:
+        user.role = payload.role
+    if payload.display_name is not None:
+        user.display_name = payload.display_name
+    if payload.is_active is not None:
+        user.is_active = payload.is_active
+    db.commit()
+    db.refresh(user)
+    return user
+
+
+@router.delete("/{user_id}", status_code=status.HTTP_204_NO_CONTENT)
+def delete_user(
+    user_id: int,
+    db: Session = Depends(get_db),
+    current_admin: User = Depends(require_admin),
+) -> None:
+    user = db.get(User, user_id)
+    if user is None:
+        raise HTTPException(status.HTTP_404_NOT_FOUND, "Benutzer nicht gefunden")
+    if user.id == current_admin.id:
+        raise HTTPException(status.HTTP_400_BAD_REQUEST, "Du kannst dich nicht selbst löschen")
+    if user.role == Role.admin:
+        admin_count = db.query(User).filter(User.role == Role.admin).count()
+        if admin_count <= 1:
+            raise HTTPException(
+                status.HTTP_400_BAD_REQUEST,
+                "Der letzte Administrator kann nicht gelöscht werden",
+            )
+    db.delete(user)
+    db.commit()