add priority filter

src/api/dependacies/task_dep.py

@@ -5,9 +5,7 @@ from fastapi import Depends, Query
 from fastapi.exceptions import HTTPException
 from pydantic import BaseModel, model_validator
 
-from src.schemas.tasks import TaskFilter
+from src.schemas.tasks import PriorityEnum, StatusEnum
-
-TaskFilterDep = Annotated[TaskFilter, Depends()]
 
 
 class Date(BaseModel):
@@ -23,4 +21,21 @@ class Date(BaseModel):
         return self
 
 
-DateDep = Annotated[Date, Depends()]
+class Page(BaseModel):
+    limit: int = Query(default=30, ge=1, le=100)
+    page: int | None = Query(default=1, ge=1)
+
+
+class Status(BaseModel):
+    status: StatusEnum | None = Query(default=None)
+
+
+class Priority(BaseModel):
+    priority: PriorityEnum | None = Query(default=None)
+
+
+class Filters(Date, Status, Priority, Page):
+    pass
+
+
+FilterDep = Annotated[Filters, Depends()]

src/api/dependacies/user_dep.py

@@ -1,6 +1,6 @@
 from typing import Annotated
 
-from fastapi import Depends, HTTPException, Path
+from fastapi import Depends, HTTPException
 from fastapi.security import (
     HTTPAuthorizationCredentials,
     HTTPBearer,
@@ -8,17 +8,13 @@ from fastapi.security import (
 )
 from jwt import InvalidTokenError
 
-from src.api.dependacies.db_dep import sessionDep
 from src.core.auth_manager import AuthManager
 from src.core.settings import settings
 from src.schemas.auth import TokenData
-from src.services.tasks import TaskService
-from src.services.users import UserService
 
 http_bearer = HTTPBearer(auto_error=False)
 
 oauth2_scheme = OAuth2PasswordBearer(tokenUrl=f"{settings.api.v1_login_url}/login")
-# AccessTokenDep = Annotated[str, Depends(oauth2_scheme)]
 AccessTokenDep = Annotated[HTTPAuthorizationCredentials, Depends(http_bearer)]
 
 
@@ -54,48 +50,14 @@ async def get_current_user_for_refresh(token: AccessTokenDep):
     return await get_current_user(token, verify_exp=False, check_active=True)
 
 
-CurrentUser = Annotated[TokenData, Depends(get_current_user_basic)]
+async def get_current_user_for_admin(token: AccessTokenDep):
-ActiveUser = Annotated[TokenData, Depends(get_current_active_user)]
+    admin = await get_current_user(token, verify_exp=True, check_active=True)
-RefreshUser = Annotated[TokenData, Depends(get_current_user_for_refresh)]
+    if not admin.is_superuser:
-
+        raise HTTPException(status_code=403, detail="Admin access required")
-
-async def get_admin_user(db: sessionDep, current_user: ActiveUser):
-    await UserService(db).validate_admin_user(current_user.sub)
-    return current_user
-
-
-AdminUser = Annotated[TokenData, Depends(get_admin_user)]
-
-
-async def user_or_admin(db: sessionDep, current_user: ActiveUser, owner_id: int):
-    if current_user.id == owner_id:
-        return current_user
-    else:
-        admin = await get_admin_user(db, current_user)
     return admin
 
 
-async def CurrentOrAdminOwner(
+CurrentUser = Annotated[TokenData, Depends(get_current_user_basic)]
-    db: sessionDep, current_user: ActiveUser, id: Annotated[int, Path()]
+ActiveUser = Annotated[TokenData, Depends(get_current_active_user)]
-):
+RefreshUser = Annotated[TokenData, Depends(get_current_user_for_refresh)]
-    authorized_user = await user_or_admin(db, current_user, id)
+AdminUser = Annotated[TokenData, Depends(get_current_user_for_admin)]
-    if not authorized_user:
-        raise HTTPException(status_code=403, detail="Not authorized")
-    return authorized_user
-
-
-async def CurrentOrAdminTask(
-    db: sessionDep,
-    id: Annotated[int, Path()],
-    current_user: ActiveUser,
-):
-    task = await TaskService(db).get_task(id)
-    if not task:
-        raise HTTPException(status_code=404, detail="Task not found")
-
-    return await CurrentOrAdminOwner(db, current_user, task.user_id)
-
-
-OwnerDep = Annotated[TokenData, Depends(CurrentOrAdminOwner)]
-
-TaskOwnerDep = Annotated[TokenData, Depends(CurrentOrAdminTask)]

src/api/v1/auth.py

@@ -27,7 +27,7 @@ async def login(
     session: sessionDep,
     credential: Annotated[OAuth2PasswordRequestForm, Depends()],
     response: Response,
-    fingerprint: str = Form(),
+    fingerprint: str = Form(min_length=5),
 ):
     result = await AuthService(session).login(
         credential.username, credential.password, fingerprint=fingerprint
@@ -38,7 +38,7 @@ async def login(
         httponly=True,
         samesite="lax",
         path=settings.api.v1_login_url,
-        max_age=60 * 60 * 24 * 7,
+        max_age=60 * 60 * 24 * settings.refresh_token.expire_days,
     )
     return result
 

src/api/v1/tasks.py

@@ -1,28 +1,20 @@
 from typing import Annotated
 
-from fastapi import APIRouter, Body, Depends
+from fastapi import APIRouter, Body, Depends, HTTPException
 
 from src.api.dependacies.db_dep import sessionDep
-from src.api.dependacies.task_dep import TaskFilterDep
+from src.api.dependacies.user_dep import ActiveUser
-from src.api.dependacies.user_dep import ActiveUser, TaskOwnerDep
 from src.schemas.tasks import TaskADDRequest, TaskPATCHRequest
 from src.services.tasks import TaskService
-from src.services.users import UserService
 
 router = APIRouter(prefix="/tasks", tags=["Tasks"])
 
 
-@router.get("/")
-async def get_tasks(session: sessionDep, user: ActiveUser, filter: TaskFilterDep):
-    result = await UserService(session).get_user_with_tasks(
-        user_id=user.id, **filter.model_dump(exclude_unset=True)
-    )
-    return result
-
-
 @router.get("/{id}")
-async def get_task_id(session: sessionDep, id: int, _: TaskOwnerDep):
+async def get_task_id(session: sessionDep, id: int, user: ActiveUser):
     task = await TaskService(session).get_task(id)
+    if task.user_id != user.id and user.is_superuser is False:
+        raise HTTPException(status_code=403, detail="Forbidden")
     return task
 
 
@@ -42,17 +34,26 @@ async def post_task(
 async def patch_task(
     session: sessionDep,
     id: int,
-    _: TaskOwnerDep,
+    user: ActiveUser,
     task_data: TaskPATCHRequest = Body(),
 ):
-    task = await TaskService(session).update_task(id, task_data)
+    if user.is_superuser is False:
-    return task
+        task = await TaskService(session).get_task(id)
+        if task.user_id != user.id:
+            raise HTTPException(status_code=403, detail="Forbidden")
+    updated_task = await TaskService(session).update_task(id, task_data)
+    return updated_task
 
 
 @router.delete("/{id}")
 async def delete_task(
     session: sessionDep,
     id: int,
-    _: TaskOwnerDep,
+    user: ActiveUser,
 ):
+    if user.is_superuser is False:
+        task = await TaskService(session).get_task(id)
+        if task.user_id != user.id:
+            raise HTTPException(status_code=403, detail="Forbidden")
     await TaskService(session).delete_task(id)
+    return {"message": "Task deleted successfully"}

src/api/v1/users.py

@@ -1,9 +1,10 @@
-from fastapi import APIRouter, Body
+from fastapi import APIRouter, Body, HTTPException
 
 from src.api.dependacies.db_dep import sessionDep
+from src.api.dependacies.task_dep import FilterDep
 from src.api.dependacies.user_dep import (
+    ActiveUser,
     AdminUser,
-    OwnerDep,
 )
 from src.core.settings import settings
 from src.schemas.users import UserUpdate
@@ -19,18 +20,30 @@ async def get_all_users(session: sessionDep, _: AdminUser):
 
 
 @router.get("/{id}")
-async def get_user_by_id(session: sessionDep, id: int, _: OwnerDep):
+async def get_user_by_id(session: sessionDep, id: int, _: AdminUser):
     user = await UserService(session).get_user_by_filter_or_raise(id=id)
     return user
 
 
+@router.get("/{id}/tasks")
+async def get_user_tasks(
+    session: sessionDep, id: int, user: ActiveUser, filters: FilterDep
+):
+    if user.id != id and user.is_superuser is False:
+        raise HTTPException(status_code=403, detail="Forbidden")
+    tasks = await UserService(session).get_user_with_tasks(id, **filters.model_dump())
+    return tasks.tasks
+
+
 @router.patch("/{id}")
 async def patch_user(
     session: sessionDep,
     id: int,
-    _: OwnerDep,
+    user: ActiveUser,
     user_update: UserUpdate = Body(),
 ):
+    if user.id != id and user.is_superuser is False:
+        raise HTTPException(status_code=403, detail="Forbidden")
     updated_user = await UserService(session).update_user(
         id=id, update_data=user_update
     )
@@ -38,6 +51,6 @@ async def patch_user(
 
 
 @router.delete("/{id}")
-async def delete_user(session: sessionDep, id: int, _: AdminUser):
+async def delete_user(session: sessionDep, id: int, user: AdminUser):
     await UserService(session).delete_user(id)
     return {"message": "User deleted successfully"}

src/core/interfaces.py

@@ -8,10 +8,6 @@ if TYPE_CHECKING:
     from src.repository.users import UsersRepo
 
 
-class HasId(Protocol):
-    id: Any
-
-
 class IUOWDB(Protocol):
     session: AsyncSession
     user: "UsersRepo"

src/core/settings.py

@@ -47,7 +47,9 @@ class Settings(BaseSettings):
     db: DbSettings = DbSettings()
     access_token: AccessToken
     refresh_token: RefreshToken
-    model_config = SettingsConfigDict(env_file=".env", env_file_encoding="utf-8", env_nested_delimiter='__')
+    model_config = SettingsConfigDict(
+        env_file=".env", env_file_encoding="utf-8", env_nested_delimiter="__"
+    )
 
 
 settings = Settings()  # type: ignore

src/migrations/versions/2025_09_21_2016-5821f37941a8_expire_and_fingerprintjs_token.py

@@ -5,14 +5,15 @@ Revises: b879d3502c37
 Create Date: 2025-09-21 20:16:48.289050
 
 """
+
 from typing import Sequence, Union
 
 import sqlalchemy as sa
 from alembic import op
 
 # revision identifiers, used by Alembic.
-revision: str = '5821f37941a8'
+revision: str = "5821f37941a8"
-down_revision: Union[str, None] = 'b879d3502c37'
+down_revision: Union[str, None] = "b879d3502c37"
 branch_labels: Union[str, Sequence[str], None] = None
 depends_on: Union[str, Sequence[str], None] = None
 
@@ -20,14 +21,25 @@ depends_on: Union[str, Sequence[str], None] = None
 def upgrade() -> None:
     """Upgrade schema."""
     # ### commands auto generated by Alembic - please adjust! ###
-    op.add_column('refresh_tokens', sa.Column('fingerprint', sa.String(length=255), nullable=False))
+    op.add_column(
-    op.add_column('refresh_tokens', sa.Column('expired_at', sa.TIMESTAMP(timezone=True), server_default=sa.text("(datetime('now', '+7 days'))"), nullable=False))
+        "refresh_tokens",
+        sa.Column("fingerprint", sa.String(length=255), nullable=False),
+    )
+    op.add_column(
+        "refresh_tokens",
+        sa.Column(
+            "expired_at",
+            sa.TIMESTAMP(timezone=True),
+            server_default=sa.text("(datetime('now', '+7 days'))"),
+            nullable=False,
+        ),
+    )
     # ### end Alembic commands ###
 
 
 def downgrade() -> None:
     """Downgrade schema."""
     # ### commands auto generated by Alembic - please adjust! ###
-    op.drop_column('refresh_tokens', 'expired_at')
+    op.drop_column("refresh_tokens", "expired_at")
-    op.drop_column('refresh_tokens', 'fingerprint')
+    op.drop_column("refresh_tokens", "fingerprint")
     # ### end Alembic commands ###

src/models/tokens.py

@@ -15,5 +15,7 @@ class RefreshTokensORM(Base):
     fingerprint: Mapped[str] = mapped_column(String(255), nullable=False)
     expired_at: Mapped[datetime] = mapped_column(
         TIMESTAMP(timezone=True),
-        server_default=text(f"datetime('now', '+{settings.refresh_token.expire_days} days')"),
+        server_default=text(
+            f"datetime('now', '+{settings.refresh_token.expire_days} days')"
+        ),
     )

src/repository/auth.py

@@ -2,5 +2,5 @@ from src.models.tokens import RefreshTokensORM
 from src.repository.base import BaseRepo
 
 
-class AuthRepo(BaseRepo):
+class AuthRepo(BaseRepo[RefreshTokensORM]):
     model: type[RefreshTokensORM] = RefreshTokensORM

src/repository/base.py

@@ -3,9 +3,7 @@ from typing import Any, Generic, Mapping, Sequence, Type, TypeVar
 from sqlalchemy import delete, insert, select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from src.core.interfaces import HasId
+ModelType = TypeVar("ModelType")
-
-ModelType = TypeVar("ModelType", bound=HasId)
 
 
 class BaseRepo(Generic[ModelType]):
@@ -45,12 +43,9 @@ class BaseRepo(Generic[ModelType]):
     async def delete_one(self, **filter_by) -> None:
         await self.session.execute(delete(self.model).filter_by(**filter_by))
 
-    async def update_one(self, id: int, data: dict[str, Any]) -> ModelType:
+    async def update_one(self, data: dict[str, Any], **filter_by: Any) -> ModelType:
         stmt = (
-            update(self.model)
+            update(self.model).filter_by(**filter_by).values(data).returning(self.model)
-            .where(self.model.id == id)
-            .values(data)
-            .returning(self.model)
         )
         result = await self.session.execute(stmt)
         model = result.scalar_one()

src/repository/tasks.py

@@ -2,5 +2,5 @@ from src.models.tasks import TasksORM
 from src.repository.base import BaseRepo
 
 
-class TasksRepo(BaseRepo):
+class TasksRepo(BaseRepo[TasksORM]):
     model: type[TasksORM] = TasksORM

src/repository/users.py

@@ -1,5 +1,4 @@
 from datetime import date
-from typing import Optional
 
 from sqlalchemy import func, select
 from sqlalchemy.orm import selectinload
@@ -9,21 +8,24 @@ from src.models.tasks import TasksORM
 from src.repository.base import BaseRepo
 
 
-class UsersRepo(BaseRepo):
+class UsersRepo(BaseRepo[UsersORM]):
     model: type[UsersORM] = UsersORM
 
     async def get_one_with_load(
         self,
         user_id: int,
         status: str | None = None,
-        tasks_limit: Optional[int] = None,
+        priority: str | None = None,
-        tasks_offset: Optional[int] = 0,
+        tasks_limit: int | None = None,
-        date_to: Optional[date] = None,
+        tasks_offset: int | None = 0,
-        date_from: Optional[date] = None,
+        date_to: date | None = None,
+        date_from: date | None = None,
     ) -> UsersORM | None:
         filters_sq: dict = {"user_id": user_id}
         if status:
             filters_sq["status"] = status
+        if priority:
+            filters_sq["priority"] = priority
         tasks_subquery = self._tasks_subquary(
             date_from=date_from, date_to=date_to, **filters_sq
         )

src/schemas/tasks.py

@@ -50,11 +50,3 @@ class Task(TaskADDRequest):
     time_spent: int
 
     model_config = ConfigDict(from_attributes=True)
-
-
-class TaskFilter(BaseModel):
-    status: StatusEnum | None = None
-    limit: int | None = 30
-    offset: int | None = None
-    date_from: date | None = None
-    date_to: date | None = None

src/services/auth.py

@@ -25,7 +25,7 @@ class AuthService(BaseService):
         await self.session.auth.create_one({
             "token": refresh_token,
             "user_id": user_data.id,
-            "fingerprint": fingerprint
+            "fingerprint": fingerprint,
         })
         return {
             "access_token": access_token,
@@ -34,28 +34,27 @@ class AuthService(BaseService):
         }
 
     async def login(self, username: str, password: str, fingerprint: str) -> dict:
-        result = await self.session.user.get_one_or_none(username=username)
+        login_exception = HTTPException(
-        if result is None:
-            raise HTTPException(
             status_code=401,
             detail="Incorrect username or password",
         )
+        result = await self.session.user.get_one_or_none(username=username)
+        if result is None:
+            raise login_exception
         user = UserWithHashedPass.model_validate(result)
         token_data = TokenData.model_validate(user.model_dump())
         verify = AuthManager.verify_password(
             plain_password=password, hashed_password=user.hashed_password
         )
         if not verify or user.is_active is False:
-            raise HTTPException(
+            raise login_exception
-                status_code=401,
-                detail="Incorrect username or password",
-            )
         tokens = await self._tokens_create(token_data, fingerprint)
         await self.session.commit()
-        print(tokens)
         return tokens
 
-    async def refresh_tokens(self, refresh_token: str, user_data: TokenData, fingerprint: str) -> dict:
+    async def refresh_tokens(
+        self, refresh_token: str, user_data: TokenData, fingerprint: str
+    ) -> dict:
         token_record = await self.session.auth.get_one_or_none(token=refresh_token)
         if not token_record or token_record.user_id != user_data.id:
             raise HTTPException(status_code=401, detail="Invalid refresh token")

src/services/tasks.py

@@ -1,13 +1,10 @@
 from fastapi import HTTPException
 
-from src.models.tasks import TasksORM
 from src.schemas.tasks import Task, TaskADDRequest, TaskPATCHRequest
 from src.services.base import BaseService
 
 
 class TaskService(BaseService):
-    model = TasksORM
-
     async def create_task(self, user_id: int, task_data: TaskADDRequest) -> Task:
         user = await self.session.user.get_one_or_none(id=user_id)
         if user is None:
@@ -29,10 +26,13 @@ class TaskService(BaseService):
         await self.session.commit()
 
     async def update_task(
-        self, task_id: int, task_data: TaskPATCHRequest, exclude_unset: bool = True
+        self,
+        task_id: int,
+        task_data: TaskPATCHRequest,
+        exclude_unset: bool = True,
     ):
         task = await self.session.task.update_one(
-            id=task_id, data=task_data.model_dump(exclude_unset=exclude_unset)
+            data=task_data.model_dump(exclude_unset=exclude_unset), id=task_id
         )
         await self.session.commit()
         return Task.model_validate(task)

src/services/users.py

@@ -1,5 +1,3 @@
-from datetime import date
-
 from fastapi import HTTPException
 
 from src.schemas.users import User, UserUpdate, UserWithTasks
@@ -36,27 +34,24 @@ class UserService(BaseService):
     async def update_user(self, id: int, update_data: UserUpdate) -> User:
         await self.get_user_by_filter_or_raise(id=id)
         user = await self.session.user.update_one(
-            id=id, data=update_data.model_dump(exclude_unset=True)
+            data=update_data.model_dump(exclude_unset=True), id=id
         )
         await self.session.commit()
         return User.model_validate(user)
 
-    async def get_user_with_tasks(
+    async def get_user_with_tasks(self, user_id: int, **attrs):
-        self,
+        if attrs.get("page") and attrs.get("limit"):
-        user_id: int,
+            tasks_offset = (attrs.get("page", 0) - 1) * attrs.get("limit")
-        status: str | None,
+        else:
-        limit: int | None,
+            tasks_offset = None
-        offset: int | None,
-        date_to: date | None,
-        date_from: date | None,
-    ):
         user = await self.session.user.get_one_with_load(
             user_id=user_id,
-            status=status,
+            status=attrs.get("status"),
-            tasks_limit=limit,
+            priority=attrs.get("priority"),
-            tasks_offset=offset,
+            tasks_limit=attrs.get("limit"),
-            date_from=date_from,
+            tasks_offset=tasks_offset,
-            date_to=date_to,
+            date_from=attrs.get("date_from"),
+            date_to=attrs.get("date_to"),
         )
         if user is None:
             raise HTTPException(status_code=404, detail="User not found.")

tests/integration_tests/test_auth_api.py

@@ -1,3 +1,4 @@
+import pytest
 from httpx import AsyncClient
 
 from src.core.settings import settings
@@ -15,14 +16,30 @@ async def test_registration(ac):
     assert result.json()["is_active"]
 
 
-async def test_login(ac: AsyncClient):
+@pytest.mark.parametrize(
+    "fingerprint, username,password,expected_status",
+    [("string", "kot", "P@ssw0rd", 200), ("", "kot", "P@ssw0rd", 422)],
+)
+async def test_login(
+    ac: AsyncClient,
+    fingerprint: str,
+    username: str,
+    password: str,
+    expected_status: int,
+):
     result = await ac.post(
         f"{settings.api.v1_login_url}/login",
         data={
+            "fingerprint": fingerprint,
             "grant_type": "password",
-            "username": "kot",
+            "username": username,
-            "password": "P@ssw0rd",
+            "password": password,
         },
     )
-    assert result.status_code == 200
+    assert result.status_code == expected_status
-    assert result.json().get("access_token")
+    if expected_status == 200:
+        assert result.json().get("access_token") is not None
+    else:
+        json_response = result.json()
+        if expected_status == 422:
+            assert "detail" in json_response