Infrastructure: Implement master/dev/vX branching, save git path, and fix username casing

backend/routers/users.py

@@ -0,0 +1,118 @@
+from fastapi import APIRouter, Depends, HTTPException
+from sqlalchemy.orm import Session
+from typing import List
+from passlib.context import CryptContext
+import ldap3
+import json
+import os
+from .. import models, schemas, database
+
+router = APIRouter(prefix="/users", tags=["users"])
+pwd_context = CryptContext(schemes=["pbkdf2_sha256"], deprecated="auto")
+
+def get_ldap_config():
+    config_path = os.path.join(os.path.dirname(os.path.dirname(__file__)), "ldap_config.json")
+    if os.path.exists(config_path):
+        with open(config_path, "r") as f:
+            return json.load(f)
+    return {"ldap_enabled": False}
+
+def authenticate_ldap(username, password):
+    config = get_ldap_config()
+    if not config.get("ldap_enabled"):
+        return False
+        
+    try:
+        server = ldap3.Server(config["server_uri"], use_ssl=config.get("use_tls", False), get_info=ldap3.ALL)
+        user_dn = config["user_template"].format(username=username)
+        conn = ldap3.Connection(server, user=user_dn, password=password, auto_bind=True)
+        # If bound, user is authenticated
+        return True
+    except Exception as e:
+        print(f"LDAP Auth Error: {e}")
+        return False
+pwd_context = CryptContext(schemes=["pbkdf2_sha256"], deprecated="auto")
+
+def get_db():
+    db = database.SessionLocal()
+    try:
+        yield db
+    finally:
+        db.close()
+
+def get_password_hash(password):
+    return pwd_context.hash(password)
+
+def verify_password(plain_password, hashed_password):
+    if not hashed_password: return False
+    return pwd_context.verify(plain_password, hashed_password)
+
+@router.get("/", response_model=List[schemas.User])
+def get_users(db: Session = Depends(get_db)):
+    users = db.query(models.User).all()
+    # Auto-seed if empty
+    if not users:
+        new_user = models.User(
+            username="Admin", 
+            role="admin", 
+            hashed_password=get_password_hash("admin") # Default password
+        )
+        db.add(new_user)
+        db.commit()
+        db.refresh(new_user)
+        return [new_user]
+    return users
+
+@router.post("/", response_model=schemas.User)
+def create_user(user: schemas.UserCreate, db: Session = Depends(get_db)):
+    existing = db.query(models.User).filter(models.User.username == user.username).first()
+    if existing:
+        raise HTTPException(status_code=400, detail="Username already exists")
+    
+    hashed = get_password_hash(user.password) if user.password else None
+    new_user = models.User(username=user.username, role=user.role, hashed_password=hashed)
+    db.add(new_user)
+    db.commit()
+    db.refresh(new_user)
+    return new_user
+
+@router.post("/login")
+def login(form_data: schemas.UserLogin, db: Session = Depends(get_db)):
+    user = db.query(models.User).filter(models.User.username == form_data.username).first()
+    
+    # Try local authentication
+    authenticated = False
+    if user and user.hashed_password:
+        if verify_password(form_data.password, user.hashed_password):
+            authenticated = True
+    elif user and not user.hashed_password:
+        # Legacy user without password - allow skip for now or force set
+        authenticated = True
+        
+    # If local failed, try LDAP
+    if not authenticated:
+        if authenticate_ldap(form_data.username, form_data.password):
+            authenticated = True
+            # If user doesn't exist locally, create a stub for role management
+            if not user:
+                user = models.User(username=form_data.username, role="user")
+                db.add(user)
+                db.commit()
+                db.refresh(user)
+        else:
+            raise HTTPException(status_code=400, detail="Invalid username or password")
+    
+    return user
+
+@router.delete("/{user_id}")
+def delete_user(user_id: int, db: Session = Depends(get_db)):
+    user = db.query(models.User).filter(models.User.id == user_id).first()
+    if not user:
+        raise HTTPException(status_code=404, detail="User not found")
+    
+    if user.username == "Admin":
+         raise HTTPException(status_code=400, detail="Cannot delete default Admin")
+         
+    db.delete(user)
+    db.commit()
+    return {"message": "User deleted"}