Nye-TeeOff/backend/main.py

"""
TEE OFF BACKEND API v3.6.8 - THE RESTORED MASTER VERSION
---------------------------------------------------------------------------
REGEL 1: Bruk str (ikke string) for type-hinting.
REGEL 2: Inkluder alle subqueries for banestatus og hull-data.
REGEL 3: Robust JSON-parsing (format_row) for å hindre Frontend-krasj.
REGEL 4: JWT-sesjoner lagres i HTTP-only cookies.
LOV: Aldri trunker eller slett logikk for "effektivitet".
---------------------------------------------------------------------------
"""

from fastapi import FastAPI, HTTPException, Response, Cookie, Depends, Request
from fastapi.middleware.cors import CORSMiddleware
from contextlib import asynccontextmanager
import asyncpg
import json
import pyotp
import os
from datetime import datetime, date, timedelta
from jose import jwt, JWTError
from passlib.context import CryptContext
from dotenv import load_dotenv

load_dotenv()

# --- KONFIGURASJON ---
DB_URL = os.getenv("DATABASE_URL", "postgresql://teeoff_admin:teeoff_secret_password@db:5432/teeoff")
SECRET_KEY = os.getenv("JWT_SECRET", "super_secret_change_this_in_production")
ALGORITHM = "HS256"

# VIKTIG: Vi bruker PBKDF2-SHA256 for å unngå Bcrypt-begrensninger
pwd_context = CryptContext(schemes=["pbkdf2_sha256"], deprecated="auto")

def format_row(row):
    """
    Vasker data fra databasen:
    1. Konverterer datoer til ISO-format.
    2. Tvinger tekst-JSON (stringified JSON) over til ekte Python objekter/lister.
    3. Sikrer at lister og objekter aldri er None for å hindre Frontend-krasj.
    """
    if row is None:
        return None
    
    d = dict(row)
    
    # 1. Håndter dato- og tidsformater for JSON-serialisering
    for key in ['status_updated_at', 'created_at']:
        if isinstance(d.get(key), (date, datetime)):
            d[key] = d[key].isoformat()
    
    # 2. Definer alle felter som inneholder JSON-data
    json_list_fields = [
        'course_statuses', 'courses', 'gallery', 'greenfee', 
        'faqs', 'shotzoom', 'social_links', 'holes'
    ]
    json_dict_fields = [
        'amenities', 'vtg', 'nsg_data', 'golfamore_data'
    ]

    # Vask list-felter
    for field in json_list_fields:
        if field in d:
            val = d[field]
            if val is None:
                d[field] = []
            elif isinstance(val, str):
                try:
                    d[field] = json.loads(val)
                except:
                    d[field] = []
            elif not isinstance(val, list):
                d[field] = []

    # Vask objekt-felter
    for field in json_dict_fields:
        if field in d:
            val = d[field]
            if val is None:
                d[field] = {}
            elif isinstance(val, str):
                try:
                    d[field] = json.loads(val)
                except:
                    d[field] = {}
            elif not isinstance(val, dict):
                d[field] = {}
            
    return d

@asynccontextmanager
async def lifespan(app: FastAPI):
    # Opprett database-pool ved start
    try:
        print(f"📡 Forsøker å koble til database på: {DB_URL}")
        app.state.pool = await asyncpg.create_pool(
            DB_URL, 
            min_size=5, 
            max_size=20,
            command_timeout=60
        )
        print("✅ Database tilkoblet og pool opprettet")
    except Exception as e:
        print(f"❌ Databasefeil under oppstart: {e}")
        raise e
    yield
    # Lukk pool ved avslutning
    await app.state.pool.close()

app = FastAPI(title="TeeOff API v3.6.8", lifespan=lifespan)

# CORS - Tillater både lokal utvikling og produksjonsdomene
app.add_middleware(
    CORSMiddleware,
    allow_origins=[
        "https://nye.teeoff.no",
        "http://nye.teeoff.no",
        "http://localhost:3000"
    ],
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)

# --- AUTH ENDPOINTS ---

@app.post("/api/auth/login")
async def login(data: dict):
    """Steg 1: Sjekk passord og returner temp_token for 2FA."""
    print(f"🔐 Login-forsøk for: {data.get('username')}")
    
    async with app.state.pool.acquire() as conn:
        admin = await conn.fetchrow(
            "SELECT * FROM admins WHERE username = $1 OR email = $1", 
            data.get('username')
        )
        
        if not admin:
            print("   - ❌ Bruker ikke funnet i databasen")
            raise HTTPException(status_code=401, detail="Ugyldig brukernavn eller passord")
        
        # DEBUG: Printer starten på hashen for å verifisere formatet ($pbkdf2-sha256$...)
        h = admin['password_hash']
        print(f"   - Verifiserer hash i DB (starter med: {h[:20]}...)")
        
        try:
            if not pwd_context.verify(data.get('password'), h):
                print("   - ❌ Passordet samsvarer ikke med hashen")
                raise HTTPException(status_code=401, detail="Ugyldig brukernavn eller passord")
        except Exception as e:
            print(f"   - 🔥 FEIL VED VERIFISERING: {e}")
            raise HTTPException(status_code=500, detail="Internt problem med passord-format")
        
        temp_token = jwt.encode(
            {"sub": admin['username'], "partial": True, "exp": datetime.utcnow() + timedelta(minutes=5)}, 
            SECRET_KEY, algorithm=ALGORITHM
        )
        print("   - ✅ Steg 1 fullført. Temp-token generert.")
        return {"step": "2fa", "temp_token": temp_token}

@app.post("/api/auth/verify-2fa")
async def verify_2fa(data: dict, response: Response):
    """Steg 2: Verifiser TOTP-kode og sett session cookie."""
    try:
        payload = jwt.decode(data.get('temp_token'), SECRET_KEY, algorithms=[ALGORITHM])
        if not payload.get("partial"):
            raise JWTError()
        username = payload.get("sub")
    except JWTError:
        raise HTTPException(status_code=401, detail="Sesjonen har utløpt eller er ugyldig")

    async with app.state.pool.acquire() as conn:
        admin = await conn.fetchrow("SELECT otp_secret FROM admins WHERE username = $1", username)
        
        totp = pyotp.TOTP(admin['otp_secret'])
        if not totp.verify(data.get('code')):
            print(f"   - ❌ Feil 2FA-kode oppgitt for {username}")
            raise HTTPException(status_code=401, detail="Feil 2FA-kode")

        final_token = jwt.encode(
            {"sub": username, "exp": datetime.utcnow() + timedelta(hours=12)}, 
            SECRET_KEY, algorithm=ALGORITHM
        )
        
        # Sett som HTTP-only cookie
        response.set_cookie(
            key="admin_session",
            value=final_token,
            httponly=True,
            samesite="lax",
            secure=False # Sett til True i produksjon (HTTPS)
        )
        return {"status": "success"}

# --- DATA ENDPOINTS ---

@app.get("/api/facilities")
async def get_facilities():
    """Henter alle golfanlegg med aggregert banestatus for forsiden."""
    async with app.state.pool.acquire() as conn:
        rows = await conn.fetch("""
            SELECT f.*, (
                SELECT jsonb_agg(cs) FROM (
                    SELECT name, status FROM courses 
                    WHERE facility_id = f.id AND status != 'finnes_ingen_bane_to'
                    ORDER BY is_main_course DESC, id ASC
                ) cs
            ) as course_statuses
            FROM facilities f 
            ORDER BY f.name ASC
        """)
        return [format_row(row) for row in rows]

@app.get("/api/facilities/{slug}")
async def get_facility(slug: str):
    """Henter detaljer for ett spesifikt golfanlegg inkludert alle baner og hull."""
    async with app.state.pool.acquire() as conn:
        row = await conn.fetchrow("""
            SELECT f.*, (
                SELECT jsonb_agg(c_data) FROM (
                    SELECT c.*, (
                        SELECT jsonb_agg(h_data ORDER BY h_data.hole_number ASC)
                        FROM (SELECT * FROM holes WHERE course_id = c.id) h_data
                    ) as holes
                    FROM courses c 
                    WHERE c.facility_id = f.id 
                    AND (c.is_main_course = true OR (c.status NOT IN ('finnes_ingen_bane_to', 'ukjent')))
                    ORDER BY c.is_main_course DESC, c.id ASC
                ) c_data
            ) as courses
            FROM facilities f WHERE f.slug = $1
        """, slug)
        
        if not row:
            raise HTTPException(status_code=404, detail="Golfanlegget ble ikke funnet")
            
        return format_row(row)

@app.get("/api/health")
async def health_check():
    """Enkel sjekk for å se at API og DB lever."""
    try:
        async with app.state.pool.acquire() as conn:
            await conn.execute("SELECT 1")
            return {"status": "healthy", "database": "connected"}
    except Exception as e:
        return {"status": "unhealthy", "error": str(e)}

if __name__ == "__main__":
    import uvicorn
    uvicorn.run(app, host="0.0.0.0", port=8000)