feat: T03+T04 backend - FastAPI, DB models, Rentman integration, admin auth, APScheduler

backend/app/routers/admin.py

@@ -0,0 +1,92 @@
+"""Admin router: login, sync endpoints, sync log."""
+from fastapi import APIRouter, Depends, HTTPException, Response, Query, status
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+from typing import Any
+from app.database import get_db
+from app.models.admin_user import AdminUser
+from app.models.sync_log import SyncLog
+from app.schemas.auth import LoginRequest, TokenResponse, AdminInfo
+from app.schemas.sync import SyncStatus, SyncLogEntry, SyncTriggerResponse
+from app.auth import verify_password, create_access_token, get_current_user
+from app.services.sync_service import SyncService
+from app.cache import cache
+
+router = APIRouter(prefix="/api/admin", tags=["admin"])
+
+
+@router.post("/login", response_model=TokenResponse)
+async def login(
+    creds: LoginRequest,
+    response: Response,
+    db: AsyncSession = Depends(get_db),
+) -> Any:
+    """Admin login: verify credentials, set JWT in HttpOnly cookie."""
+    # Rate limiting
+    rate_key = f"rate:login:{creds.username}"
+    count = await cache.incr_rate(rate_key, window=60)
+    if count > 5:
+        raise HTTPException(status_code=status.HTTP_429_TOO_MANY_REQUESTS, detail="Too many login attempts")
+
+    result = await db.execute(select(AdminUser).where(AdminUser.username == creds.username))
+    user = result.scalar_one_or_none()
+    if not user or not verify_password(creds.password, user.password_hash):
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid credentials")
+
+    token = create_access_token({"sub": user.username})
+    response.set_cookie(
+        key="hms_admin_token",
+        value=token,
+        httponly=True,
+        secure=True,
+        samesite="strict",
+        max_age=86400,
+        path="/",
+    )
+    return TokenResponse(access_token=token, token_type="bearer")
+
+
+@router.get("/me", response_model=AdminInfo)
+async def get_me(user: AdminUser = Depends(get_current_user)) -> Any:
+    """Return current authenticated admin user."""
+    return AdminInfo(username=user.username)
+
+
+@router.post("/sync", response_model=SyncTriggerResponse)
+async def trigger_sync(
+    user: AdminUser = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+) -> Any:
+    """Trigger a manual equipment sync (admin only)."""
+    sync_service = SyncService(db)
+    result = await sync_service.run_sync()
+    return SyncTriggerResponse(sync_id=result["sync_id"], status=result["status"])
+
+
+@router.get("/sync-status", response_model=SyncStatus)
+async def sync_status(
+    user: AdminUser = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+) -> Any:
+    """Return the latest sync status."""
+    sync_service = SyncService(db)
+    return await sync_service.get_last_sync()
+
+
+@router.get("/sync-log")
+async def sync_log(
+    page: int = Query(1, ge=1),
+    page_size: int = Query(20, ge=1, le=100),
+    user: AdminUser = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+) -> Any:
+    """Return paginated sync log entries (admin only)."""
+    sync_service = SyncService(db)
+    result = await sync_service.get_sync_log_paginated(page=page, page_size=page_size)
+    return {
+        "items": [SyncLogEntry.model_validate(log) for log in result["items"]],
+        "total": result["total"],
+        "page": result["page"],
+        "page_size": result["page_size"],
+        "total_pages": result["total_pages"],
+    }