app.py

import os
import json
import requests
from flask import (
    Flask,
    render_template,
    request,
    flash,
    redirect,
    url_for,
    make_response,
    session
)
from flask_login import (
    LoginManager, 
    current_user,
    login_required,
    login_user,
    logout_user,
)
from oauthlib.oauth2 import WebApplicationClient

from config import DEV_MODE
from utils.auth import (
    User,
    get_google_provider_cfg,
    role_required,
    GOOGLE_CLIENT_ID,
    GOOGLE_CLIENT_SECRET
)

from utils.db import (
    find_user_by_session_id,
    find_user_by_email,
    delete_user_by_email,
    init_db,
    reset_db,
    get_users,
    modify_user_role,
    modify_user_stall
)

from utils.vendordb import (
    add_stall,
    del_stall,
    init_vendor,
    reset_vendor,
    get_stall_info,
    add_item,
    modify_item_name,
    modify_desc,
    modify_price,
    modify_maxquantity,
    del_item,
    get_stalls,
    get_all_stalls_info
)

from utils.order import (
    reset_orderdb,
    init_orderdb,
    add_order,
    get_order,
    find_order_by_user,
    find_order_by_stall,
    set_collected
)

from utils.price import parse_price


FLASK_SECRET_KEY = os.environ.get("FLASK_SECRET_KEY", None)

app = Flask(__name__)
app.secret_key = FLASK_SECRET_KEY

# User session management setup
login_manager = LoginManager()
login_manager.init_app(app)

# OAuth 2 client setup
client = WebApplicationClient(GOOGLE_CLIENT_ID)


# Flask-Login helper to retrieve a user from database
@login_manager.user_loader
def user_loader(email):
    details = find_user_by_email(email)
    if details is None:
        return None
    return User.get(email)


@login_manager.unauthorized_handler
def unauthorized_callback():
    return redirect('/home')


# Global HTML template variables.
@app.context_processor
def set_global_html_variable_values():
    if current_user.is_authenticated:
        signed_in = True
    else:
        signed_in = False
    config = {
        "signed_in": signed_in,
        "role": current_user.role if signed_in else "signed_out",
        "name": current_user.name if signed_in else "None"
    }
    return config


"""
Webapp Routes
"""

@app.route("/")
def mainpage():
    return redirect("/home")


@app.route("/about")
def about():
    return render_template("about.html")


@app.route("/statistics")
def statistics():
    return render_template("statistics.html")



@app.route("/credits")
def credits():
    return render_template("credits.html")

@app.route("/vendor")
@login_required
@role_required("vendor")
def vendor():
    orders=find_order_by_stall(current_user.stall)
    return render_template(
        "vendor/vendor.html",
        orders=orders
    )

@app.route("/vendor/edit")
@login_required
@role_required("vendor")
def editmenu():
    return render_template(
        "vendor/editmenu.html",
        items=get_stall_info(current_user.stall)["items"]
    )

@app.get("/vendor/additem")
@login_required
@role_required("vendor")
def additem_get():
    return render_template("vendor/additem.html", edit=False)

@app.get("/vendor/setcollected")
@login_required
@role_required("vendor")
def setcollected():
    order_id = request.args["order_id"]
    # if current_user.stall != get_order(order_id)["stall"]:
    if current_user.stall != get_order(order_id)["stall"]:
        return "Unauthorised"
    set_collected(order_id, True)
    return redirect("../vendor")


@app.route("/student")
@login_required
@role_required("student")
def student():
    # return find_order_by_user(current_user.email)
    orders = find_order_by_user(current_user.email)
    # return [orders,get_all_stalls_info()]
    updated_orders = []
    for order in orders:
        order["items"] = {
            i[0]: {
                "quantity": i[1],
                "item_price": float(i[2])
            } for i in order["items"]
        }
        updated_orders.append(order)
    return render_template("student/student.html", orders=updated_orders, stalls=get_all_stalls_info())

@app.get("/student/order")
@login_required
@role_required("student")
def order_get():
    if "stall" in request.args and "time" in request.args:
        name = request.args["stall"]
        time = request.args["time"]
        data = get_stall_info(name)
        # return str(data)
        return render_template("student/selectitems.html", stall=data, time=time)
    else:
        return render_template("student/selectstall.html", stalls=get_stalls())

@app.post("/student/order")
@login_required
@role_required("student")
def order_post():
    data = dict(request.form)
    stall = data["stall"]
    time = data["time"]
    del data["stall"]
    del data["time"]

    items = {}
    info = get_stall_info(stall)
    for item in data:
        if data[item] in ("", "0"): continue
        items[item] = {
            "quantity": int(data[item]),
            "price": info["items"][item]["price"],
            "total_item_price": info["items"][item]["price"] * int(data[item])
        }

    total_price = 0
    for item in items: total_price += items[item]["total_item_price"]
    session["order"] = {
        "stall": stall,
        "time": time,
        "items": items,
        "total_price": total_price
    }
    return render_template("student/vieworder.html", stall=stall, time=time, items=items, total_price=total_price)


@app.post("/student/placeorder")
@login_required
@role_required("student")
def place_order():
    order = session.get("order", None)
    # return order # Temporary until database functions for ordering are properly implemented.
    # Validate order data
    assert(order is not None)
    actual_items = get_stall_info(order["stall"])["items"]
    total = 0
    for item in order["items"]:
        assert(item in actual_items)
        assert(order["items"][item]["price"] == actual_items[item]["price"])
        assert(order["items"][item]["quantity"] <= actual_items[item]["max_quantity"])
        total += order["items"][item]["quantity"] * actual_items[item]["price"]
    assert(total == order["total_price"])
    items = [[item, order["items"][item]["quantity"], order["items"][item]["price"]] for item in order["items"]]
    order_id = add_order(
        order["stall"],
        current_user.email,
        current_user.name,
        items,
        total,
        order["time"]
    )
    return redirect(f"/student/receipt?order_id={order_id}")


@app.route("/student/receipt")
@login_required
@role_required("student")
def receipt():
    order = get_order(request.args["order_id"])
    # User validation
    if order["user_email"] != current_user.email:
        return "This order does not belong to you!"
    return render_template(
        "student/receipt.html",
        order=order,
        items={
            i[0]: {
                "quantity": i[1],
                "item_price": float(i[2])
            } for i in order["items"]
        }
    )


@app.post("/vendor/additem")
@login_required
@role_required("vendor")
def additem_post():
    data = request.form
    price = parse_price(data["price"])
    add_item(
        current_user.stall,
        data["name"],
        data["description"],
        price,
        data["max_quantity"],
        True # availability: bool
    )
    return redirect("/vendor/edit")


@app.get("/vendor/edititem")
@login_required
@role_required("vendor")
def edititem_get():
    item = request.args.get("item")
    items = get_stall_info(current_user.stall)["items"]
    if item not in items:
        return "Item does not exist."
    data = items[item]
    return render_template(
        "vendor/additem.html", # reuse the same page
        name=item,
        description=data["description"],
        price=data["price"],
        max_quantity=data["max_quantity"],
        available=data["available"],
        edit=True,
    )


@app.route("/vendor/deleteitem")
@login_required
@role_required("vendor")
def deleteitem():
    item = request.args.get("item")
    items = get_stall_info(current_user.stall)["items"]
    if item not in items:
        return "Item does not exist."
    del_item(current_user.stall, item)
    return redirect("/vendor/edit")


@app.post("/vendor/edititem")
@login_required
@role_required("vendor")
def edititem_post():
    """
    Edits an item's data by deleting the old item and
    adding the same item with the updated data
    """
    data = request.form
    price = parse_price(data["price"])
    stall = current_user.stall
    if data["original_name"] != data["name"]:
        modify_item_name(stall, data["original_name"], data["name"])
    modify_desc(stall, data["name"], data["description"])
    modify_price(stall, data["name"], price)
    modify_maxquantity(stall, data["name"], data["max_quantity"])
    return redirect("/vendor/edit")


@app.route("/home")
def home():
    if current_user.is_authenticated:
        if current_user.role == "vendor":
            return redirect("vendor")
        else:
            return redirect("student")
    else:
        return render_template("home.html")


@app.route("/login")
def login():
    """
    Redirects user to Google Oauth for authentication
    if user is not logged in.
    """
    if current_user.is_authenticated:
        return redirect("/home")

    # Find out what URL to hit for Google login
    google_provider_cfg = get_google_provider_cfg()
    authorization_endpoint = google_provider_cfg["authorization_endpoint"]

    # Use library to construct the request for Google login and provide
    # scopes that let you retrieve user's profile from Google
    request_uri = client.prepare_request_uri(
        authorization_endpoint,
        redirect_uri=request.base_url + "/callback",
        scope=["openid", "email", "profile"],
    )
    return redirect(request_uri)


@app.route("/login/callback")
def login_callback():
    """
    Handles Google OAuth log in.
    - Receives and validates Oauth code
    - Creates user session    
    """
    # Get authorization code that Google sent
    code = request.args.get("code")
    google_provider_cfg = get_google_provider_cfg()
    token_endpoint = google_provider_cfg["token_endpoint"]

    # Prepare and send a request to get tokens
    token_url, headers, body = client.prepare_token_request(
        token_endpoint,
        authorization_response=request.url,
        redirect_url=request.base_url,
        code=code
    )
    token_response = requests.post(
        token_url,
        headers=headers,
        data=body,
        auth=(GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET),
    )

    # Parse tokens
    print(json.dumps(token_response.json()))
    client.parse_request_body_response(json.dumps(token_response.json()))

    userinfo_endpoint = google_provider_cfg["userinfo_endpoint"]
    uri, headers, body = client.add_token(userinfo_endpoint)
    userinfo_response = requests.get(uri, headers=headers, data=body)

    # Check if email is verified and then get info
    if userinfo_response.json().get("email_verified"):
        id_ = userinfo_response.json()["sub"]
        email = userinfo_response.json()["email"]
        profile_pic = userinfo_response.json()["picture"]
        name = userinfo_response.json()["given_name"]
    else:
        return "User email not available or not verified by Google.", 400

    # Create the User object
    user = User.get(email)

    # Add user to database if it does not exist
    if user is None:
        user = User(
            email,
            id_,
            name,
            profile_pic,
            "student",
            None
        )
        user.create()
    elif user.name == email: # This means an admin has created an account for user already (usually used for vendors)
        role = user.role
        stall = user.stall
        delete_user_by_email(email)
        user = User(
            email,
            id_,
            name,
            profile_pic,
            role,
            stall
        )
        user.create()
    # Begin user session by logging the user in
    login_user(user)

    # Send user back to homepage
    response = make_response(redirect("/"))
    return response


@app.route("/logout")
@login_required
def logout():
    logout_user()
    return redirect("/")

@app.route("/admin")
@login_required
@role_required("admin")
def admin():
    if current_user.role != "admin": 
        return "Access denied. Only admins allowed."
    return render_template(
        "admin/admin.html",
        users=get_users(),
        stalls=get_all_stalls_info()
    )

@app.post("/admin/adduser")
@login_required
@role_required("admin")
def adduser_post():
    if current_user.role != "admin": 
        return "Access denied. Only admins allowed."
    data = request.form
    user = User(
        data["email"],
        "0",
        data["email"], # Name as email to indicate the user has not logged in yet.
        "", # profile pic link
        data["role"],
        data["stall"] # If role is student, stall value does not matter
    )
    try:
        user.create()
    except Exception as err:
        if str(err) == "UserAlreadyExists":
            modify_user_role(data["email"], data["role"])
            modify_user_stall(data["email"], data["stall"])
        else:
            return "Error: " + str(err)
    return "Success <a href='/admin'>Back</a>"

@app.post("/admin/modifystall")
@login_required
@role_required("admin")
def modifystall_post():
    if current_user.role != "admin": 
        return "Access denied. Only admins allowed."
    data = request.form
    try:
        if data["action"] == "add":
            add_stall(data["stall_name"])
        elif data["action"] == "remove":
            del_stall(data["stall_name"])
        else:
            raise ValueError("No such action. Use either add or remove")
    except Exception as err:
        return f"Error: {err}"
    return "Success <a href='/admin'>Back</a>"


def set_up_backend(reset=False):
    # Set up database
    try:
        if reset: reset_db()
        else: init_db()
    except Exception as err:
        print(err)
        # Database already exist


    # Set up vendor database
    try:
        if reset: reset_vendor()
        else: init_vendor()

        # Create stalls with temporary items
        add_stall("Chinese Wok")
        # name, item, desc, price, max, have
        add_item("Chinese Wok", "Rice", "A bowl of white rice", 0.5, 5, 1)
        add_item("Chinese Wok", "Fried Chicken (Spicy)", "Fried chicken cutlet. This item is spicy", 1.8, 2, 1)

        add_stall("Chicken Paradise")
        # name, item, desc, price, max, have
        add_item("Chicken Paradise", "Rice", "Rice", 0.5, 5, 1)
        add_item("Chicken Paradise", "Steamed chicken", "", 1.8, 2, 1)
        add_item("Chicken Paradise", "Fried Egg", "", 0.5, 5, 1)
    except Exception as err:
        print(err)
        # Database already exist

    # Set up order database
    try:
        if reset: reset_orderdb()
        else: init_orderdb()
    except Exception as err:
        print(err) # Database already exist

    # Initialise default users (to maintain admin accounts)
    from config import default_users
    for user in default_users:
        try:
            user_obj = User(
                user["email"],
                "0",
                user["email"], # Name as email to indicate the user has not logged in yet.
                "", # profile pic link
                user["role"],
                user["stall"] # If role is student, stall value does not matter
            )
            user_obj.create()
        except Exception as err:
            print(f"User Creation Error: {err}")


if __name__ == "__main__":
    print("Running BBQ... Dev mode set to", DEV_MODE)
    if not DEV_MODE:
        set_up_backend(True)
        app.run()
    else:
        # DANGER! This resets all databases. (when `True` is passed)
        # set_up_backend(True)
        app.run(debug=True, ssl_context="adhoc", port=5000)