kaas

backend/main.py

@@ -4,7 +4,7 @@ from datetime import date
 from fastapi import FastAPI, Depends, HTTPException, Query
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import PlainTextResponse
-from pydantic import BaseModel, EmailStr
+from pydantic import BaseModel, EmailStr, Field
 from typing import Literal
 import sqlite3
 from datetime import datetime, timezone
@@ -20,17 +20,13 @@ from email_service import (
     update_email
 )
 
-from email_service import (
-    update_email,
-    verify_email,
-)
-
 from auth import (
     create_user,
     verify_user,
     create_token,
     get_current_user,
     get_user,
+    change_password,
 )
 
 from permissions import (
@@ -84,6 +80,9 @@ class Login(BaseModel):
     username: str
     password: str
 
+class PasswordUpdate(BaseModel):
+    old_password: str
+    new_password: str = Field(min_length=8)
 
 class UserCreate(BaseModel):
     username: str
@@ -113,10 +112,13 @@ class EventUpdate(BaseModel):
     visibility: str | None = None
     status: Literal["draft", "proposed", "confirmed", "cancelled"] | None = None
 
-
 class RoomCreate(BaseModel):
     room_name: str
-    invite_code: str
+    invite_code: str = Field(
+        min_length=6,
+        max_length=32,
+        pattern=r"^[A-Za-z0-9]+$",
+    )
 
 
 class RoomSearch(BaseModel):
@@ -266,6 +268,35 @@ def api_get_user(
 
     return dict(user)
 
+@app.patch(
+    "/me/password",
+    summary="Change password",
+    description="Changes the authenticated user's password after verifying the current password.",
+)
+def api_change_password(
+    data: PasswordUpdate,
+    user_id: int = Depends(get_current_user),
+):
+    result = change_password(
+        user_id,
+        data.old_password,
+        data.new_password,
+    )
+
+    if result["status"] == "failed":
+        if result["reason"] == "incorrect_password":
+            raise HTTPException(
+                status_code=401,
+                detail="incorrect password",
+            )
+
+        raise HTTPException(
+            status_code=404,
+            detail="user not found",
+        )
+
+    return result
+
 @app.patch(
     "/rooms/{room_id}/members/{user_id}",
     summary="Edit a user's role",
@@ -528,8 +559,8 @@ def api_remove_member(
     user_id: int,
     current_user: int = Depends(get_current_user),
 ):
-    current_role = get_member_role(room_id, current_user)
-    target_role = get_member_role(room_id, user_id)
+    current_role = get_role(room_id, current_user)
+    target_role = get_role(room_id, user_id)
 
     if current_role is None:
         raise HTTPException(