feat(auth): add DB-backed login, token management, and idempotent auth migration

app/services/auth_service.py

@@ -0,0 +1,102 @@
+"""Authentication and token issuance service."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from datetime import datetime, timedelta, timezone
+
+from fastapi import Depends
+
+from app.core.auth import AuthContext, Permission, _has_permission
+from app.core.config import Settings, get_settings
+from app.core.security import generate_token, hash_token, token_prefix, verify_password
+from app.domain.models import AuthToken, User
+from app.repositories.factory import get_portfolio_repository_from_settings
+from app.repositories.portfolio_repository import PortfolioRepository
+from app.schemas.auth import CreateClientTokenRequest, LoginRequest
+
+
+@dataclass
+class LoginResult:
+    token: str
+    auth_token: AuthToken
+    user: User
+
+
+@dataclass
+class IssuedClientToken:
+    token: str
+    auth_token: AuthToken
+
+
+def get_auth_service_repository(settings: Settings = Depends(get_settings)) -> PortfolioRepository:
+    return get_portfolio_repository_from_settings(settings)
+
+
+class AuthService:
+    def __init__(self, repository: PortfolioRepository, settings: Settings) -> None:
+        self._repository = repository
+        self._settings = settings
+
+    def login(self, payload: LoginRequest) -> LoginResult:
+        user = self._repository.get_user_by_username(payload.username)
+        if user is None or not user.is_active or not verify_password(payload.password, user.password_hash):
+            raise ValueError("잘못된 사용자명 또는 비밀번호입니다")
+
+        raw_token = generate_token()
+        expires_at = datetime.now(timezone.utc) + timedelta(hours=self._settings.session_token_ttl_hours)
+        auth_token = self._repository.create_auth_token(
+            user.id,
+            name="session",
+            token_hash=hash_token(raw_token),
+            token_prefix=token_prefix(raw_token),
+            permission=user.permission,
+            token_type="session",
+            expires_at=expires_at,
+        )
+        self._repository.update_user_last_login(user.id)
+        refreshed_user = self._repository.get_user(user.id)
+        return LoginResult(token=raw_token, auth_token=auth_token, user=refreshed_user)
+
+    def issue_client_token(self, auth_context: AuthContext, payload: CreateClientTokenRequest) -> IssuedClientToken:
+        if auth_context.user_id is None:
+            raise ValueError("DB 사용자 컨텍스트에서만 클라이언트 토큰을 발급할 수 있습니다")
+
+        requested = Permission(payload.permission or auth_context.permission.value)
+        if not _has_permission(auth_context.permission, requested):
+            raise ValueError("요청한 토큰 권한이 현재 권한을 초과합니다")
+
+        raw_token = generate_token()
+        expires_at = None
+        if payload.expires_in_days is not None:
+            expires_at = datetime.now(timezone.utc) + timedelta(days=payload.expires_in_days)
+        else:
+            expires_at = datetime.now(timezone.utc) + timedelta(days=self._settings.client_token_default_ttl_days)
+
+        auth_token = self._repository.create_auth_token(
+            auth_context.user_id,
+            name=payload.name,
+            token_hash=hash_token(raw_token),
+            token_prefix=token_prefix(raw_token),
+            permission=requested.value,
+            token_type="client",
+            expires_at=expires_at,
+        )
+        return IssuedClientToken(token=raw_token, auth_token=auth_token)
+
+    def list_tokens(self, auth_context: AuthContext) -> list[AuthToken]:
+        if auth_context.user_id is None:
+            raise ValueError("DB 사용자 컨텍스트에서만 토큰 목록을 조회할 수 있습니다")
+        return self._repository.list_auth_tokens(auth_context.user_id)
+
+    def revoke_token(self, auth_context: AuthContext, token_id: str) -> None:
+        if auth_context.user_id is None:
+            raise ValueError("DB 사용자 컨텍스트에서만 토큰을 폐기할 수 있습니다")
+        self._repository.revoke_auth_token(auth_context.user_id, token_id)
+
+
+def get_auth_service(
+    settings: Settings = Depends(get_settings),
+    repository: PortfolioRepository = Depends(get_auth_service_repository),
+) -> AuthService:
+    return AuthService(repository, settings)