3 files changed, 106 insertions, 2 deletions
diff --git a/backend/__pycache__/main.cpython-314.pyc b/backend/__pycache__/main.cpython-314.pyc
index 088aec4..f65235c 100644
--- a/backend/__pycache__/main.cpython-314.pyc
+++ b/backend/__pycache__/main.cpython-314.pyc
diff --git a/backend/db.db-journal b/backend/db.db-journal
new file mode 100644
index 0000000..e58d84d
--- /dev/null
+++ b/backend/db.db-journal
diff --git a/backend/main.py b/backend/main.py
index ff6ec38..e242389 100644
--- a/backend/main.py
+++ b/backend/main.py
@@ -19,6 +19,7 @@ from dotenv import load_dotenv
 from os import getenv
 import yaml
 import notif  # import notif.py
+import bcrypt
 
 # ## API, db, and scheduler initialisation
 app = fastapi.FastAPI(title="Victoria Hall LaundryWeb", description="LaundryWeb Backend API", version="0.1")
@@ -30,6 +31,7 @@ scheduler.start()
 
 origins = [
     "http://localhost",
+    "http://localhost:8081",
     "http://localhost:998",
     "http://localhost:5173",
     "http://127.0.0.1",
@@ -59,6 +61,13 @@ CREATE TABLE IF NOT EXISTS timers (
     subscription_id TEXT NOT NULL
 );""")  # block is either 1 or 2, machine (1-4), odd is dryer, even is machine.
 
+cursor.execute("""
+CREATE TABLE IF NOT EXISTS admin_cookies (
+    cookie VARCHAR(64) PRIMARY KEY
+);
+""")
+
+cursor.execute("DELETE FROM admin_cookies;")
 
 class RowIndices(IntEnum):
     TIMER_ID = 0,
@@ -126,7 +135,7 @@ class FinishRequestData(BaseModel):
 class OverrideMachineData(BaseModel):
     block: int
     machine_id: int
-    status: int  # according to class Status
+    disabled: bool
 
 
 class Status(Enum):
@@ -476,12 +485,60 @@ def notif_subscribe(data: notif.PushSubscriptionData, response: fastapi.Response
 
 # #### ADMIN PANEL API END POINTS ####
 
+# ## ADMIN PANEL SCHEDULER METHODS ##
+
+
+def delete_cookie_scheduler(cookie):
+    pass
+
+
+def authenticate_admin_check(cookie):
+    cursor.execute("SELECT * FROM admin_cookies WHERE cookie = ?", (cookie,))
+    rows = cursor.fetchall()
+
+    return len(rows) > 0
+
 
 # --- admin login
 @app.post("/admin_login", response_class=PlainTextResponse)
 def admin_login(data: PlaintextPasswordData, response: fastapi.Response):
     print(data.password)
-    return data.password
+
+    pwd = data.password.encode('utf-8')
+    stored_hash_pwd = getenv("ADMIN_PASSWORD_HASH").encode('utf-8')
+
+    if bcrypt.checkpw(pwd, stored_hash_pwd):
+        response.status_code = fastapi.status.HTTP_202_ACCEPTED
+
+        auth_cookie_str = secrets.token_hex(32)
+        AUTH_MAX_AGE = 60 * 10  # 10 minutes
+        response.set_cookie(key="admin_auth", value=auth_cookie_str, secure=True, max_age=AUTH_MAX_AGE, domain="backend.laundryweb.altafcreator.com", samesite="none")
+        cursor.execute("""INSERT INTO admin_cookies (cookie) VALUES (?);""", (auth_cookie_str,))
+        conn.commit()
+        cursor.execute("SELECT * FROM admin_cookies")
+        print(cursor.fetchall())
+
+        now = datetime.datetime.now(ZoneInfo(TZ))
+        end_date = now + datetime.timedelta(seconds=(AUTH_MAX_AGE))
+        scheduler.add_job(delete_cookie_scheduler, 'date', run_date=end_date, args=[auth_cookie_str])
+
+        return "hi admin you are Authenticated!!!11"
+
+    response.status_code = fastapi.status.HTTP_403_FORBIDDEN
+    return "Forbidden."
+
+
+# --- admin auth check
+@app.post("/admin_check", response_class=PlainTextResponse)
+def admin_check(response: fastapi.Response, admin_auth: Annotated[str | None, fastapi.Cookie()] = None):
+    print("admin check request, ", admin_auth)
+
+    if authenticate_admin_check(admin_auth):
+        response.status_code = fastapi.status.HTTP_202_ACCEPTED
+        return "Authorised."
+    else:
+        response.status_code = fastapi.status.HTTP_401_UNAUTHORIZED
+        return "Get out."
 
 
 # --- override each machine status
@@ -490,3 +547,50 @@ def override_status(data: OverrideMachineData, response: fastapi.Response, admin
     if not admin_auth:
         response.status_code = fastapi.status.HTTP_401_UNAUTHORIZED
         return "Unauthorised."
+
+    if authenticate_admin_check(admin_auth):
+        if (data.disabled):
+            machine_status[data.block - 1][data.machine_id - 1] = Status.OUTOFSERVICE.name
+        else:
+            cursor.execute("SELECT * FROM timers WHERE ((block = ?) AND (machine = ?))", (data.block, data.machine_id))
+            rows = cursor.fetchall()
+
+            if len(rows) > 0:
+                machine_status[data.block - 1][data.machine_id - 1] = Status.RUNNING.name
+            else:
+                machine_status[data.block - 1][data.machine_id - 1] = Status.EMPTY.name
+
+            response.status_code = fastapi.status.HTTP_200_OK
+            return "Set!"
+
+        print("set machine", data.machine_id, "of block", data.block, ".", machine_status)
+    else:
+        response.status_code = fastapi.status.HTTP_403_FORBIDDEN
+        return "Forbidden."
+
+
+# --- change admin password
+@app.post("/admin_change_password", response_class=PlainTextResponse)
+def admin_change_password(data: PlaintextPasswordData, response: fastapi.Response, admin_auth: Annotated[str | None, fastapi.Cookie()] = None):
+    if not admin_auth:
+        response.status_code = fastapi.status.HTTP_401_UNAUTHORIZED
+        return "Unauthorised."
+
+    if authenticate_admin_check(admin_auth):
+        pass
+    else:
+        pass
+
+
+# --- get all blocks machine status for admin
+@app.post("/admin_machine_status")
+def admin_machine_status(response: fastapi.Response, admin_auth: Annotated[str | None, fastapi.Cookie()] = None):
+    if not admin_auth:
+        response.status_code = fastapi.status.HTTP_401_UNAUTHORIZED
+        return """{"reply": "Unauthorised."}"""
+
+    if authenticate_admin_check(admin_auth):
+        return machine_status
+    else:
+        response.status_code = fastapi.status.HTTP_403_FORBIDDEN
+        return """{"reply": "Forbidden."}"""