Develop

.env.example

@@ -49,4 +49,8 @@ FACE_ENCRYPTION_KEY=hkbribvfirirbvivbibvib
 CORS_ORIGINS=["http://localhost:3000", "http://localhost:5173", "http://127.0.0.1:3000", "http://127.0.0.1:5173"]
 
 # Firebase
-FIREBASE_CREDENTIALS_PATH=path/to/firebase-credentials.json
+FIREBASE_CREDENTIALS_PATH=path/to/firebase-credentials.json
+
+# Resend Email Configuration
+RESEND_API_KEY=
+EMAIL_FROM=

app/container.py

@@ -37,7 +37,10 @@
 from db.generated import stuff_user as staff_queries
 from db.generated import notifications as notification_queries
 from db.generated import audit as audit_queries
+from db.generated import stats as stats_queries
+
 from app.service.event import EventService
+from app.service.stats import StatsService
 from app.worker.notification.notification_queue import NotificationQueue
 from app.worker.notification.settings import NotifSetting
 
@@ -70,7 +73,7 @@ def __init__(
         self.event_querier = event_queries.AsyncQuerier(conn)
         self.participant_querier = participant_queries.AsyncQuerier(conn)
         self.staff_querier = staff_queries.AsyncQuerier(conn)
-
+        self.stats_querier = stats_queries.AsyncQuerier(conn)
 
         # services
         self.session_service = SessionService()
@@ -150,6 +153,10 @@ def __init__(
             staff_drive_service=self.staff_drive_service,
         )
 
+        self.stats_service = StatsService(
+            querier=self.stats_querier,
+        )
+
 async def get_container(
     conn: sqlalchemy.ext.asyncio.AsyncConnection = Depends(get_db),
 ) -> Container:

app/core/config.py

@@ -33,6 +33,8 @@ class Settings(BaseSettings):
     POSTGRES_HOST: str = "localhost"
     POSTGRES_PORT: int = 5432
 
+    PHOTO_APPROVAL_TIMEOUT_DAYS: int = 7
+
     # Mobile auth/session defaults
     MOBILE_SESSION_LIMIT: int = 3
     MOBILE_SESSION_TTL_SECONDS: int = 180
@@ -57,8 +59,8 @@ class Settings(BaseSettings):
 
     # Face embedding model
     FACE_EMBEDDING_MODEL_NAME: str = "buffalo_l"
-    FACE_EMBEDDING_PROVIDERS: str = "CPUExecutionProvider"
-    FACE_EMBEDDING_CTX_ID: int = -1
+    FACE_EMBEDDING_PROVIDERS: str = "CUDAExecutionProvider,CPUExecutionProvider"
+    FACE_EMBEDDING_CTX_ID: int = 0
     FACE_EMBEDDING_DET_WIDTH: int = 640
     FACE_EMBEDDING_DET_HEIGHT: int = 640
 
@@ -73,6 +75,10 @@ class Settings(BaseSettings):
     FACE_ENCRYPTION_KEY: str
     FIREBASE_CREDENTIALS_PATH: str
 
+    # Resend Email Configuration
+    RESEND_API_KEY: str = ""
+    EMAIL_FROM: str = "onboarding@resend.dev"
+
     model_config = SettingsConfigDict(
         env_file=".env",
         extra="ignore",

app/core/constant.py

@@ -22,6 +22,7 @@ class AuditEventType(str, Enum):
     USER_SIGNUP = "user.signup"
     USER_LOGIN = "user.login"
     USER_LOGOUT = "user.logout"
+    FACE_ENROLLMENT_ATTEMPT = "face_enrollment.attempt"
     UPLOAD_REQUEST_CREATED = "upload_request.created"
     UPLOAD_REQUEST_APPROVED = "upload_request.approved"
     UPLOAD_REQUEST_REJECTED = "upload_request.rejected"
@@ -50,5 +51,11 @@ class AuditEventType(str, Enum):
 GOOGLE_DRIVE_FILES_URL = "https://www.googleapis.com/drive/v3/files/{file_id}"
 
 MAX_IMAGE_SIZE = 5 * 1024 * 1024
+MIN_IMAGE_DIM = 64
+MAX_IMAGE_DIM = 4096
 MIN_ENROLL_IMAGES = 3
 MAX_ENROLL_IMAGES = 5
+
+ENROLL_RATE_LIMIT_MAX = 5
+ENROLL_RATE_LIMIT_WINDOW = 3600
+ENROLL_IN_PROGRESS_TTL_SECONDS = 300

app/deps/cookie_auth.py

@@ -50,3 +50,14 @@ async def require_multi_team_lead_staff(
     current_staff_user: Annotated[StaffUser, Depends(get_current_staff_user)],
 ) -> StaffUser:
     return ensure_multi_team_lead_staff(current_staff_user)
+
+
+def ensure_admin_staff(current_staff_user: StaffUser) -> StaffUser:
+    if _role_value(current_staff_user.role) != StaffRole.ADMIN.value:
+        raise AppException.forbidden("Admin access required")
+    return current_staff_user
+
+async def require_admin_staff(
+    current_staff_user: Annotated[StaffUser, Depends(get_current_staff_user)],
+) -> StaffUser:
+    return ensure_admin_staff(current_staff_user)

app/deps/rate_limit.py

@@ -0,0 +1,36 @@
+from fastapi import Request, HTTPException
+from typing import Callable
+
+from app.infra.redis import RedisClient
+from app.core.config import settings
+
+def _get_client_ip(request: Request) -> str:
+    if settings.TRUST_PROXY_HEADERS:
+        forwarded_for = request.headers.get("x-forwarded-for")
+        if forwarded_for:
+            return forwarded_for.split(",", maxsplit=1)[0].strip()
+        real_ip = request.headers.get("x-real-ip")
+        if real_ip:
+            return real_ip.strip()
+    return request.client.host if request.client else "127.0.0.1"
+
+
+def RateLimiter(requests: int, window: int) -> Callable:
+    async def _rate_limit_dependency(request: Request) -> None:
+        client_ip = _get_client_ip(request)
+        # For simplicity, IP based rate limit on the endpoint
+        path = request.url.path
+        key = f"rate_limit:{path}:{client_ip}"
+
+        redis = RedisClient.get_instance()
+
+        # Increment request count
+        current = await redis.incr(key)
+        if current == 1:
+            # Set expiry for the window if it's the first request
+            await redis.expire(key, window)
+
+        if current > requests:
+            raise HTTPException(status_code=429, detail="Too Many Requests")
+
+    return _rate_limit_dependency

app/infra/email.py

@@ -0,0 +1,61 @@
+import json
+import urllib.request
+import urllib.error
+import asyncio
+from app.core.config import settings
+from app.core.logger import logger
+
+class EmailSender:
+    @staticmethod
+    async def send_otp_email(to_email: str, otp: str) -> bool:
+        if not settings.RESEND_API_KEY:
+            logger.warning("RESEND_API_KEY is not set. Skipping email sending.")
+            # During development without an API key, just log the OTP
+            logger.info("MOCK EMAIL to %s: Your OTP is %s", to_email, otp)
+            return True
+
+        url = "https://api.resend.com/emails"
+        headers = {
+            "Authorization": f"Bearer {settings.RESEND_API_KEY}",
+            "Content-Type": "application/json",
+            "User-Agent": "multAI-Backend/1.0"
+        }
+
+        html_content = f"""
+        <div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto;">
+            <h2>Bienvenue sur multAI !</h2>
+            <p>Voici votre code de vérification :</p>
+            <h1 style="background: #f4f4f4; padding: 10px; letter-spacing: 5px; text-align: center;">{otp}</h1>
+            <p>Ce code est valide pendant 10 minutes.</p>
+        </div>
+        """
+
+        data = {
+            "from": settings.EMAIL_FROM,
+            "to": [to_email],
+            "subject": "Votre code de vérification multAI",
+            "html": html_content
+        }
+
+        req = urllib.request.Request(
+            url,
+            data=json.dumps(data).encode("utf-8"),
+            headers=headers,
+            method="POST"
+        )
+
+        def _send() -> bool:
+            try:
+                with urllib.request.urlopen(req, timeout=10) as response:
+                    res_body = response.read()
+                    logger.info("Email sent via Resend. Response: %s", res_body)
+                    return True
+            except urllib.error.HTTPError as e:
+                err_body = e.read()
+                logger.error("Failed to send email via Resend: %s - %s", e.code, err_body)
+                return False
+            except Exception as e:
+                logger.error("Error sending email: %s", str(e))
+                return False
+
+        return await asyncio.to_thread(_send)

app/infra/redis.py

@@ -59,20 +59,19 @@ async def expire(self, key: RedisKey | str, seconds: int) -> bool:
         return int(cast(int, result)) == 1
 
     async def incr(self, key: RedisKey | str) -> int:
-        result = await self._client.incr(key)
-        return int(cast(int, result))
+        return await self._client.incr(key)
 
 
     async def sadd(self, key: RedisKey | str, *values: str) -> int:
-        result =  self._client.sadd(key, *values)
+        result = await self._client.sadd(key, *values)  # type: ignore[misc]
         return int(cast(int, result))
 
     async def sismember(self, key: RedisKey | str, value: str) -> bool:
-        result =  self._client.sismember(key, value)
+        result = await self._client.sismember(key, value)  # type: ignore[misc]
         return int(cast(int, result)) == 1
 
     async def srem(self, key: RedisKey | str, *values: str) -> int:
-        result =  self._client.srem(key, *values)
+        result = await self._client.srem(key, *values)  # type: ignore[misc]
         return int(cast(int, result))
 
 

app/main.py

@@ -8,6 +8,7 @@
 from fastapi.middleware.cors import CORSMiddleware
 from starlette.middleware.base import BaseHTTPMiddleware, RequestResponseEndpoint
 from app.core.config import settings
+from app.infra.database import engine
 from app.infra.minio import init_minio_client
 from app.infra.nats import NatsClient
 from app.infra.redis import RedisClient
@@ -48,6 +49,18 @@ async def dispatch(
 
 
 
+async def _approval_expiry_loop() -> None:
+    while True:
+        await asyncio.sleep(3600)
+        try:
+            async with engine.begin() as conn:
+                from app.container import Container
+                container = Container(conn)
+                await container.photo_approval_service.expire_stale(settings.PHOTO_APPROVAL_TIMEOUT_DAYS)
+        except Exception as exc:
+            logger.warning("Approval expiry task failed: %s", exc)
+
+
 MAX_RETRIES = 5
 RETRY_DELAY = 2  # seconds
 @asynccontextmanager
@@ -77,8 +90,12 @@ async def lifespan(app: FastAPI) -> AsyncIterator[None]:
     await NatsClient.connect()
     get_face_embedding_service()
 
+    expiry_task = asyncio.create_task(_approval_expiry_loop())
+
     yield
 
+    expiry_task.cancel()
+    await asyncio.gather(expiry_task, return_exceptions=True)
     await RedisClient.get_instance().close()
     await NatsClient.close()
 

app/router/mobile/auth.py

@@ -7,15 +7,18 @@
 from app.core.config import settings
 from app.core.constant import AuditEventType
 from app.deps.token_auth import MobileUserSchema, get_current_mobile_user
+from app.deps.rate_limit import RateLimiter
 
 from app.schema.request.mobile.auth import (
     MobileLoginRequest,
     MobileRegisterRequest,
+    RegisterVerifyRequest,
+    ResendOtpRequest,
     RefreshTokenRequest,
     UpdateDeviceTokenRequest,
     InactivateDeviceRequest,
 )
-from app.schema.response.mobile.auth import MeResponse, DeviceSchema, MobileAuthResponse, SessionSchema, UserSchema
+from app.schema.response.mobile.auth import MeResponse, DeviceSchema, MobileAuthResponse, SessionSchema, UserSchema, RegisterPendingResponse
 
 router = APIRouter(prefix="/auth")
 
@@ -33,23 +36,45 @@ def _get_client_ip(request: Request) -> str | None:
     return request.client.host if request.client else None
 
 
-@router.post("/register", response_model=MobileAuthResponse)
+@router.post("/register", response_model=RegisterPendingResponse, dependencies=[Depends(RateLimiter(requests=5, window=60))])
 async def mobile_register(
     req: MobileRegisterRequest,
     request: Request,
     container: Container = Depends(get_container),
-) -> MobileAuthResponse:
+) -> RegisterPendingResponse:
     client_ip = _get_client_ip(request)
     result = await container.auth_service.mobile_register(container.redis, req, client_ip=client_ip)
+    return result
+
+
+@router.post("/register/resend-otp", response_model=RegisterPendingResponse, dependencies=[Depends(RateLimiter(requests=5, window=60))])
+async def mobile_register_resend_otp(
+    req: ResendOtpRequest,
+    request: Request,
+    container: Container = Depends(get_container),
+) -> RegisterPendingResponse:
+    client_ip = _get_client_ip(request)
+    result = await container.auth_service.mobile_register_resend_otp(container.redis, req.email, client_ip=client_ip)
+    return result
+
+
+@router.post("/register/verify", response_model=MobileAuthResponse, dependencies=[Depends(RateLimiter(requests=10, window=60))])
+async def mobile_register_verify(
+    req: RegisterVerifyRequest,
+    request: Request,
+    container: Container = Depends(get_container),
+) -> MobileAuthResponse:
+    client_ip = _get_client_ip(request)
+    result = await container.auth_service.verify_mobile_register(container.redis, req, client_ip=client_ip)
     await container.audit_service.create_record(
         event_type=AuditEventType.USER_SIGNUP,
         user_id=result.user_id,
-        metadata={"endpoint": "register"},
+        metadata={"endpoint": "register_verify"},
     )
     return result
 
 
-@router.post("/login", response_model=MobileAuthResponse)
+@router.post("/login", response_model=MobileAuthResponse, dependencies=[Depends(RateLimiter(requests=5, window=60))])
 async def mobile_login(
     req: MobileLoginRequest,
     request: Request,