from flask import Blueprint, render_template, redirect, url_for, flash, request, jsonify, session as flask_session from flask_login import login_user, logout_user, login_required, current_user from app.extensions import db, limiter, mail from app.models.user import User from app.i18n import flash_i18n from app.auth.google_oauth import GoogleOAuth, refresh_google_token from app.auth.otp_service import generate_otp, send_otp_email, verify_otp, clear_otp, verify_otp_from_session from datetime import datetime, timedelta import secrets auth_bp = Blueprint("auth", __name__, url_prefix="/auth") @auth_bp.route("/register", methods=["GET", "POST"]) @limiter.limit("10 per hour") def register(): if current_user.is_authenticated: return redirect(url_for("dashboard.index")) if request.method == "POST": name = request.form.get("name", "").strip() email = request.form.get("email", "").strip().lower() password = request.form.get("password", "") if not name or not email or not password: flash_i18n("flash.all_fields_required", "error") return render_template("auth/register.html") if len(password) < 8: flash_i18n("flash.password_too_short", "error") return render_template("auth/register.html") if User.query.filter_by(email=email).first(): flash_i18n("flash.email_exists", "error") return render_template("auth/register.html") account_type = request.form.get("account_type", "entrepreneur").strip() company_name = request.form.get("company_name", "").strip() or None organization_id = request.form.get("organization_id") interests = request.form.getlist("interests") user = User(name=name, email=email, account_type=account_type, company_name=company_name, organization_id=organization_id, interests_json=interests if interests else None) # Handle organization selection if organization_id: try: user.organization_id = int(organization_id) except (ValueError, TypeError): pass user.set_password(password) db.session.add(user) db.session.commit() # Auto-create FactoryPartner record for factory accounts if account_type == "factory" and company_name: from app.models.services import FactoryPartner fp = FactoryPartner( name=company_name, name_ar=company_name, user_id=user.id, sectors_json=interests, is_verified=False, is_active=True, ) db.session.add(fp) user.factory_partner_id = fp.id db.session.commit() _send_verification_email(user) login_user(user) flash_i18n("flash.register_success", "success") return redirect(url_for("dashboard.index")) return render_template("auth/register.html") @auth_bp.route("/search-organizations") @limiter.limit("100 per hour") def search_organizations(): """Search organizations for autocomplete in registration form.""" from app.models.organization import Organization q = request.args.get("q", "").strip() query = Organization.query.filter(Organization.deleted_at == None, Organization.is_active == True) if q: query = query.filter( Organization.name.ilike(f"%{q}%") | Organization.name_ar.ilike(f"%{q}%") ) organizations = query.order_by(Organization.name).limit(20).all() return jsonify({ "organizations": [ { "id": org.id, "name": org.name_ar or org.name } for org in organizations ] }) @auth_bp.route("/login", methods=["GET", "POST"]) @limiter.limit("20 per hour") def login(): if current_user.is_authenticated: return redirect(url_for("dashboard.index")) if request.method == "POST": email = request.form.get("email", "").strip().lower() password = request.form.get("password", "") user = User.query.filter_by(email=email).first() # Get client info for logging ip_address = request.headers.get("X-Forwarded-For", request.remote_addr) user_agent = request.headers.get("User-Agent", "")[:500] if user and user.check_password(password): if user.two_factor_enabled: from flask import session session["2fa_user_id"] = user.id session["2fa_next"] = request.args.get("next", "") # Log 2FA redirect _log_audit(user, "login_2fa_required", "login", "pending", ip_address, user_agent, {"email": email}) return redirect(url_for("auth.verify_2fa")) login_user(user) # Log successful login _log_audit(user, "login_success", "login", "success", ip_address, user_agent, {"email": email}) next_page = request.args.get("next") return redirect(next_page or url_for("dashboard.index")) # Log failed login attempt _log_audit(user, "login_failed", "login", "failed", ip_address, user_agent, {"email": email}) flash_i18n("flash.invalid_credentials", "error") return render_template("auth/login.html") @auth_bp.route("/logout") @login_required def logout(): # Log logout ip_address = request.headers.get("X-Forwarded-For", request.remote_addr) user_agent = request.headers.get("User-Agent", "")[:500] _log_audit(current_user, "logout", "login", "success", ip_address, user_agent) logout_user() return redirect(url_for("auth.login")) @auth_bp.route("/verify-email/") def verify_email(token): user = User.verify_token(token, "email-verify", expires_sec=86400) if not user: flash("Invalid or expired verification link.", "error") return redirect(url_for("auth.login")) if not user.email_verified: user.email_verified = True user.email_verified_at = datetime.utcnow() db.session.commit() flash("Email verified successfully!", "success") if current_user.is_authenticated: return redirect(url_for("dashboard.index")) return redirect(url_for("auth.login")) @auth_bp.route("/resend-verification") @login_required @limiter.limit("3 per hour") def resend_verification(): if current_user.email_verified: flash("Email already verified.", "info") return redirect(url_for("dashboard.index")) _send_verification_email(current_user) flash("Verification email sent!", "success") return redirect(url_for("dashboard.index")) @auth_bp.route("/forgot-password", methods=["GET", "POST"]) @limiter.limit("5 per hour") def forgot_password(): if request.method == "POST": email = request.form.get("email", "").strip().lower() user = User.query.filter_by(email=email).first() if user: _send_reset_email(user) flash("If an account exists with that email, a reset link has been sent.", "success") return redirect(url_for("auth.login")) return render_template("auth/forgot_password.html") @auth_bp.route("/reset-password/", methods=["GET", "POST"]) @limiter.limit("10 per hour") def reset_password(token): user = User.verify_token(token, "password-reset", expires_sec=3600) if not user: flash("Invalid or expired reset link.", "error") return redirect(url_for("auth.forgot_password")) if request.method == "POST": password = request.form.get("password", "") confirm = request.form.get("confirm_password", "") if len(password) < 8: flash("Password must be at least 8 characters.", "error") return render_template("auth/reset_password.html", token=token) if password != confirm: flash("Passwords do not match.", "error") return render_template("auth/reset_password.html", token=token) user.set_password(password) db.session.commit() flash("Password reset successfully! Please log in.", "success") return redirect(url_for("auth.login")) return render_template("auth/reset_password.html", token=token) @auth_bp.route("/profile", methods=["GET", "POST"]) @login_required def profile(): if request.method == "POST": action = request.form.get("action") if action == "update_profile": name = request.form.get("name", "").strip() language = request.form.get("language", "ar") currency = request.form.get("currency", "SAR") if name: current_user.name = name current_user.language_pref = language current_user.currency = currency db.session.commit() flash_i18n("flash.profile_updated", "success") elif action == "change_password": current_pw = request.form.get("current_password", "") new_pw = request.form.get("new_password", "") confirm = request.form.get("confirm_password", "") if not current_user.check_password(current_pw): flash_i18n("flash.wrong_password", "error") elif len(new_pw) < 8: flash_i18n("flash.password_too_short", "error") elif new_pw != confirm: flash_i18n("flash.password_mismatch", "error") else: current_user.set_password(new_pw) db.session.commit() flash_i18n("flash.password_changed", "success") return redirect(url_for("auth.profile")) from app.models.platform_keys import UserPlatformKey, PLATFORM_REGISTRY user_keys = {pk.platform: pk for pk in UserPlatformKey.query.filter_by(user_id=current_user.id).all()} is_admin = getattr(current_user, 'is_admin', False) visible_platforms = { k: v for k, v in PLATFORM_REGISTRY.items() if not v.get("admin_only") or is_admin } return render_template("auth/profile.html", platform_registry=visible_platforms, user_keys=user_keys, ) @auth_bp.route("/profile/platform-key", methods=["POST"]) @login_required def save_platform_key(): """Save or update a platform API key.""" from app.models.platform_keys import UserPlatformKey, PLATFORM_REGISTRY platform = request.form.get("platform", "").strip() if platform not in PLATFORM_REGISTRY: flash("منصة غير معروفة.", "error") return redirect(url_for("auth.profile")) pk = UserPlatformKey.query.filter_by(user_id=current_user.id, platform=platform).first() if not pk: pk = UserPlatformKey(user_id=current_user.id, platform=platform) db.session.add(pk) info = PLATFORM_REGISTRY[platform] for field in info["fields"]: val = request.form.get(field, "").strip() if val: setattr(pk, field, val) pk.is_active = True db.session.commit() flash(f"تم حفظ مفتاح {info['name_ar']} بنجاح.", "success") return redirect(url_for("auth.profile") + "#platforms") @auth_bp.route("/profile/platform-key/delete", methods=["POST"]) @login_required def delete_platform_key(): """Delete a platform API key.""" from app.models.platform_keys import UserPlatformKey, PLATFORM_REGISTRY platform = request.form.get("platform", "").strip() pk = UserPlatformKey.query.filter_by(user_id=current_user.id, platform=platform).first() if pk: db.session.delete(pk) db.session.commit() info = PLATFORM_REGISTRY.get(platform, {}) flash(f"تم حذف مفتاح {info.get('name_ar', platform)}.", "success") return redirect(url_for("auth.profile") + "#platforms") def _send_verification_email(user): from flask import current_app from flask_mail import Message try: token = user.generate_token("email-verify") verify_url = url_for("auth.verify_email", token=token, _external=True) msg = Message( "Verify Your Email - Jadwa AI", recipients=[user.email], ) msg.html = f"""

Jadwa AI

Hello {user.name},

Please verify your email by clicking the button below:

Verify Email

This link expires in 24 hours.

""" mail.send(msg) except Exception as e: current_app.logger.warning(f"Could not send verification email: {e}") def _send_reset_email(user): from flask import current_app from flask_mail import Message try: token = user.generate_token("password-reset") reset_url = url_for("auth.reset_password", token=token, _external=True) msg = Message( "Reset Your Password - Jadwa AI", recipients=[user.email], ) msg.html = f"""

Jadwa AI

Hello {user.name},

You requested a password reset. Click the button below:

Reset Password

This link expires in 1 hour. If you didn't request this, ignore this email.

""" mail.send(msg) except Exception as e: current_app.logger.warning(f"Could not send reset email: {e}") @auth_bp.route("/setup-2fa", methods=["GET", "POST"]) @login_required def setup_2fa(): import pyotp import qrcode import io import base64 if request.method == "POST": code = request.form.get("code", "").strip() secret = current_user.totp_secret if not secret: flash("Setup error. Try again.", "error") return redirect(url_for("auth.setup_2fa")) totp = pyotp.TOTP(secret) if totp.verify(code, valid_window=1): current_user.two_factor_enabled = True db.session.commit() flash("2FA enabled successfully!", "success") return redirect(url_for("auth.profile")) flash("Invalid code. Try again.", "error") return redirect(url_for("auth.setup_2fa")) if not current_user.totp_secret: current_user.totp_secret = pyotp.random_base32() db.session.commit() totp = pyotp.TOTP(current_user.totp_secret) uri = totp.provisioning_uri(name=current_user.email, issuer_name="Jadwa AI") img = qrcode.make(uri) buf = io.BytesIO() img.save(buf, format="PNG") buf.seek(0) qr_b64 = base64.b64encode(buf.read()).decode() return render_template("auth/setup_2fa.html", qr_b64=qr_b64, secret=current_user.totp_secret) @auth_bp.route("/disable-2fa", methods=["POST"]) @login_required def disable_2fa(): code = request.form.get("code", "").strip() if current_user.totp_secret: import pyotp totp = pyotp.TOTP(current_user.totp_secret) if totp.verify(code, valid_window=1): current_user.two_factor_enabled = False current_user.totp_secret = None db.session.commit() flash("2FA disabled.", "success") else: flash("Invalid code.", "error") return redirect(url_for("auth.profile")) @auth_bp.route("/verify-2fa", methods=["GET", "POST"]) @limiter.limit("10 per hour") def verify_2fa(): from flask import session user_id = session.get("2fa_user_id") if not user_id: return redirect(url_for("auth.login")) if request.method == "POST": code = request.form.get("code", "").strip() user = User.query.get(user_id) if user and user.totp_secret: import pyotp totp = pyotp.TOTP(user.totp_secret) if totp.verify(code, valid_window=1): session.pop("2fa_user_id", None) next_page = session.pop("2fa_next", "") # Log successful 2FA login ip_address = request.headers.get("X-Forwarded-For", request.remote_addr) user_agent = request.headers.get("User-Agent", "")[:500] _log_audit(user, "login_2fa_success", "login", "success", ip_address, user_agent) login_user(user) return redirect(next_page or url_for("dashboard.index")) # Log failed 2FA attempt ip_address = request.headers.get("X-Forwarded-For", request.remote_addr) user_agent = request.headers.get("User-Agent", "")[:500] _log_audit(user, "login_2fa_failed", "login", "failed", ip_address, user_agent) flash("Invalid 2FA code.", "error") return render_template("auth/verify_2fa.html") def _log_audit(user, action, log_type, status, ip_address, user_agent, details=None): """Helper function to log audit events.""" from app.models.features import AuditLog log_data = {"email": user.email if user else "unknown"} if details: log_data.update(details) # Get IP geolocation country, city = _get_ip_location(ip_address) log = AuditLog( user_id=user.id if user else None, action=action, log_type=log_type, status=status, resource_type="User", resource_id=user.id if user else None, ip_address=ip_address, user_agent=user_agent, country=country, city=city, details=log_data ) db.session.add(log) db.session.commit() def _get_ip_location(ip_address): """Get country and city from IP address using free IP-API.""" import requests if not ip_address or ip_address in ["127.0.0.1", "localhost", "::1"]: return None, None try: # Using free ip-api.com (no API key required for basic usage) response = requests.get(f"http://ip-api.com/json/{ip_address}", timeout=1) if response.status_code == 200: data = response.json() if data.get("status") == "success": return data.get("country"), data.get("city") except Exception: pass return None, None @auth_bp.route("/sponsor-request", methods=["POST"]) @login_required def submit_sponsor_request(): """Submit a sponsorship request from user profile.""" from app.models.organization import SponsorProfile, Organization from app.utils.uploads import upload_logo # Check if user already has a sponsor request existing = SponsorProfile.query.filter_by(user_id=current_user.id).first() if existing: flash("لديك بالفعل طلب رعاية قيد المراجعة.", "info") return redirect(url_for("auth.profile")) logo_url = request.form.get("logo_url", "").strip() or None tier = request.form.get("tier", "bronze") notes = request.form.get("notes", "").strip() or None use_organization = request.form.get("use_organization") == "1" if use_organization and current_user.organization: org = current_user.organization else: flash("يجب أن تكون مرتبطاً بمنظمة لتقديم طلب الرعاية.", "error") return redirect(url_for("auth.profile")) # Handle logo upload if 'logo' in request.files: logo = request.files['logo'] if logo and logo.filename: uploaded_url = upload_logo(logo) if uploaded_url: logo_url = uploaded_url # Check if organization already has a sponsor profile existing_org_sponsor = SponsorProfile.query.filter_by(organization_id=org.id).first() if existing_org_sponsor: flash("هذه المنظمة لديها بالفعل ملف راعي. يرجى التواصل مع الإدارة.", "error") return redirect(url_for("auth.profile")) # Create sponsor profile sponsor = SponsorProfile( organization_id=org.id, user_id=current_user.id, logo_url=logo_url, tier=tier, status="pending", notes=notes ) db.session.add(sponsor) db.session.commit() flash("تم إرسال طلب الرعاية! سيتم مراجعته من قبل الإدارة.", "success") return redirect(url_for("auth.profile")) # ══════════════════════════════════════════════════════════════ # NEW: 2-Step Registration with Gmail/Personal Email + OTP # ══════════════════════════════════════════════════════════════ @auth_bp.route("/register/step1", methods=["POST"]) @limiter.limit("10 per hour") def register_step1(): """Step 1: Collect profile data, store in session.""" if current_user.is_authenticated: return redirect(url_for("dashboard.index")) name = request.form.get("name", "").strip() account_type = request.form.get("account_type", "entrepreneur").strip() company_name = request.form.get("company_name", "").strip() or None organization_id = request.form.get("organization_id") interests = request.form.getlist("interests") if not name: flash("Name is required", "error") return redirect(url_for("auth.register")) # Store in session for step 2 flask_session["reg_data"] = { "name": name, "account_type": account_type, "company_name": company_name, "organization_id": organization_id, "interests": interests, } return redirect(url_for("auth.register_step2")) @auth_bp.route("/register/step2", methods=["GET"]) @limiter.limit("10 per hour") def register_step2(): """Step 2: Email verification with Gmail/Personal selection.""" if current_user.is_authenticated: return redirect(url_for("dashboard.index")) reg_data = flask_session.get("reg_data", {}) if not reg_data: return redirect(url_for("auth.register")) return render_template("auth/register_step2.html") @auth_bp.route("/register/send-otp", methods=["POST"]) @limiter.limit("10 per hour") def send_otp(): """Send OTP to selected email (Gmail or Personal).""" start_time = datetime.utcnow() email_type = request.form.get("email_type", "personal") email = request.form.get("email", "").strip().lower() if email_type == "gmail" and not email.endswith("@gmail.com"): flash("Please enter a Gmail address", "error") return redirect(url_for("auth.register_step2")) # Check if email already exists existing_user = User.query.filter_by(email=email).first() if existing_user: flash("This email is already registered", "error") return redirect(url_for("auth.register_step2")) # Generate and store OTP otp = generate_otp() reg_data = flask_session.get("reg_data", {}) # Store OTP in session (temporary, not in DB yet) flask_session["reg_otp"] = { "code": otp, "email": email, "expires_at": (datetime.utcnow() + timedelta(minutes=10)).isoformat(), } # Direct OTP sending for testing try: import sys from flask_mail import Message from app.extensions import mail msg = Message( "Jadwa AI - Your Verification Code", recipients=[email], ) msg.html = f"""

Jadwa AI

Hello {reg_data.get('name', 'User')},
Your verification code is:

{otp}

This code expires in 10 minutes.
If you didn't request this, please ignore this email.

""" mail.send(msg) print(f"OTP email sent successfully to {email}", file=sys.stderr) send_success = True except Exception as e: print(f"Failed to send OTP: {e}", file=sys.stderr) send_success = False flask_session["reg_email"] = email flask_session["reg_email_type"] = email_type elapsed = (datetime.utcnow() - start_time).total_seconds() current_app.logger.info(f"send_otp completed in {elapsed:.2f}s for {email}") return redirect(url_for("auth.register_step3")) @auth_bp.route("/register/step3", methods=["GET", "POST"]) @limiter.limit("10 per hour") def register_step3(): """Step 3: Verify OTP and create account.""" if current_user.is_authenticated: return redirect(url_for("dashboard.index")) reg_data = flask_session.get("reg_data") reg_otp = flask_session.get("reg_otp") if not reg_data or not reg_otp: return redirect(url_for("auth.register")) if request.method == "POST": user_otp = request.form.get("otp", "").strip() # Verify OTP expires_at_str = reg_otp.get("expires_at") expires_at = datetime.fromisoformat(expires_at_str) if expires_at_str else None if expires_at and datetime.utcnow() > expires_at: flash("OTP has expired. Please request a new one", "error") return redirect(url_for("auth.register_step2")) if user_otp != reg_otp.get("code"): flash("Invalid OTP. Please try again", "error") return render_template("auth/register_step3.html") # Create user account email = flask_session.get("reg_email") email_type = flask_session.get("reg_email_type") user = User( name=reg_data["name"], email=email, account_type=reg_data["account_type"], company_name=reg_data["company_name"], organization_id=reg_data["organization_id"], interests_json=reg_data["interests"] if reg_data["interests"] else None, email_verified=True, # OTP verified email_verified_at=datetime.utcnow(), auth_provider="google" if email_type == "gmail" else "email", ) # Handle organization selection if reg_data["organization_id"]: try: user.organization_id = int(reg_data["organization_id"]) except (ValueError, TypeError): pass # Set random password (not used for Google auth) user.set_password(secrets.token_urlsafe(32)) db.session.add(user) # Auto-create FactoryPartner for factory accounts if reg_data["account_type"] == "factory" and reg_data["company_name"]: from app.models.services import FactoryPartner fp = FactoryPartner( name=reg_data["company_name"], name_ar=reg_data["company_name"], user_id=user.id, sectors_json=reg_data["interests"], is_verified=False, is_active=True, ) db.session.add(fp) user.factory_partner_id = fp.id db.session.commit() # Clear session flask_session.pop("reg_data", None) flask_session.pop("reg_otp", None) flask_session.pop("reg_email", None) flask_session.pop("reg_email_type", None) login_user(user) flash("Registration successful! Welcome to Jadwa AI", "success") return redirect(url_for("dashboard.index")) return render_template("auth/register_step3.html") @auth_bp.route("/register/resend-otp", methods=["POST"]) @limiter.limit("5 per hour") def resend_otp(): """Resend OTP to the same email.""" reg_email = flask_session.get("reg_email") reg_data = flask_session.get("reg_data") if not reg_email or not reg_data: return redirect(url_for("auth.register")) # Generate new OTP otp = generate_otp() # Update session flask_session["reg_otp"] = { "code": otp, "email": reg_email, "expires_at": (datetime.utcnow() + timedelta(minutes=10)).isoformat(), } # Send OTP email send_otp_email(reg_email, otp, reg_data.get("name", "")) flash("New OTP sent to your email", "success") return redirect(url_for("auth.register_step3")) # ══════════════════════════════════════════════════════════════ # NEW: Google OAuth Routes for Login # ══════════════════════════════════════════════════════════════ @auth_bp.route("/google/login") @limiter.limit("10 per hour") def google_login(): """Start Google OAuth login flow.""" oauth = GoogleOAuth() auth_url = oauth.get_authorization_url() return redirect(auth_url) @auth_bp.route("/login/google", methods=["GET"]) @limiter.limit("10 per hour") def login_with_google(): """Redirect to Google OAuth for login.""" return redirect(url_for("auth.google_login")) @auth_bp.route("/google/callback") @limiter.limit("10 per hour") def google_callback(): """Handle Google OAuth callback.""" oauth = GoogleOAuth() try: # Get authorization response auth_response = request.url # Fetch tokens credentials = oauth.fetch_token(auth_response) # Get user info user_info = oauth.get_user_info(credentials) # Get client info for logging ip_address = request.headers.get("X-Forwarded-For", request.remote_addr) user_agent = request.headers.get("User-Agent", "")[:500] # Check if user exists by Google ID user = User.query.filter_by(google_id=user_info["google_id"]).first() if user: # Existing user - login login_user(user) # Update tokens user.google_access_token = credentials["token"] user.google_refresh_token = credentials["refresh_token"] user.google_email = user_info["email"] user.auth_provider = "google" user.email_verified = True if not user.email_verified_at: user.email_verified_at = datetime.utcnow() db.session.commit() # Log successful login _log_audit(user, "login_google_success", "login", "success", ip_address, user_agent, {"email": user.email}) flash("Logged in with Google successfully", "success") return redirect(url_for("dashboard.index")) # New user - check if email already exists existing_user = User.query.filter_by(email=user_info["email"]).first() if existing_user: # Link existing account existing_user.google_id = user_info["google_id"] existing_user.google_access_token = credentials["token"] existing_user.google_refresh_token = credentials["refresh_token"] existing_user.google_email = user_info["email"] existing_user.auth_provider = "google" existing_user.email_verified = True if not existing_user.email_verified_at: existing_user.email_verified_at = datetime.utcnow() if not existing_user.avatar_url and user_info.get("picture"): existing_user.avatar_url = user_info["picture"] db.session.commit() login_user(existing_user) # Log successful link _log_audit(existing_user, "google_linked", "login", "success", ip_address, user_agent, {"email": existing_user.email}) flash("Your Google account has been linked", "success") return redirect(url_for("dashboard.index")) # Create new user from Google user = User( name=user_info.get("name", "") or user_info["email"].split("@")[0], email=user_info["email"], google_id=user_info["google_id"], google_access_token=credentials["token"], google_refresh_token=credentials["refresh_token"], google_email=user_info["email"], auth_provider="google", email_verified=True, email_verified_at=datetime.utcnow(), language_pref="ar", ) if user_info.get("picture"): user.avatar_url = user_info["picture"] user.set_password(secrets.token_urlsafe(32)) db.session.add(user) db.session.commit() login_user(user) # Log successful registration _log_audit(user, "register_google", "register", "success", ip_address, user_agent, {"email": user.email}) flash("Account created with Google", "success") return redirect(url_for("dashboard.index")) except ValueError as e: # OAuth state error flash("Invalid OAuth state. Please try again", "error") return redirect(url_for("auth.login")) except Exception as e: current_app.logger.error(f"Google OAuth error: {e}") flash("Failed to authenticate with Google. Please try again", "error") return redirect(url_for("auth.login"))