modify the project, everything go under app folder

app/auth.py

@@ -0,0 +1,134 @@
+import httpx
+from fastapi import APIRouter, Depends, Request, HTTPException
+from fastapi.responses import RedirectResponse
+import os
+import secrets
+from app.auth.deps import get_current_user
+from app.db import SessionLocal
+from app.models import User
+from app.auth.jwt import create_access_token, create_refresh_token, decode_token
+
+router = APIRouter()
+
+GOOGLE_CLIENT_ID = os.getenv("GOOGLE_CLIENT_ID")
+GOOGLE_CLIENT_SECRET = os.getenv("GOOGLE_CLIENT_SECRET")
+GOOGLE_REDIRECT_URI = os.getenv("GOOGLE_REDIRECT_URI")
+
+GOOGLE_AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth"
+GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token"
+GOOGLE_USERINFO_URL = "https://www.googleapis.com/oauth2/v2/userinfo"
+
+@router.get("/login/google")
+def login_google():
+    state = secrets.token_urlsafe(16)
+
+    url = (
+        f"{GOOGLE_AUTH_URL}"
+        f"?client_id={GOOGLE_CLIENT_ID}"
+        f"&redirect_uri={GOOGLE_REDIRECT_URI}"
+        f"&response_type=code"
+        f"&scope=openid email profile"
+        f"&state={state}"
+    )
+
+    response = RedirectResponse(url)
+    response.set_cookie(
+        "oauth_state",
+        state,
+        httponly=True,
+        secure=True,
+        samesite="lax"
+    )
+    return response
+
+@router.get("/auth/callback")
+async def auth_callback(request: Request, code: str, state: str):
+    cookie_state = request.cookies.get("oauth_state")
+
+    if not cookie_state or cookie_state != state:
+        raise HTTPException(status_code=400, detail="Invalid state")
+
+    async with httpx.AsyncClient() as client:
+        token_res = await client.post(
+            GOOGLE_TOKEN_URL,
+            data={
+                "code": code,
+                "client_id": GOOGLE_CLIENT_ID,
+                "client_secret": GOOGLE_CLIENT_SECRET,
+                "redirect_uri": GOOGLE_REDIRECT_URI,
+                "grant_type": "authorization_code",
+            },
+        )
+
+        token_json = token_res.json()
+        access_token = token_json["access_token"]
+
+        user_res = await client.get(
+            GOOGLE_USERINFO_URL,
+            headers={"Authorization": f"Bearer {access_token}"},
+        )
+
+        user_info = user_res.json()
+
+    db = SessionLocal()
+
+    user = db.query(User).filter(User.email == user_info["email"]).first()
+
+    if not user:
+        user = User(
+            google_id=user_info["id"],
+            email=user_info["email"],
+            name=user_info["name"],
+            avatar=user_info["picture"],
+        )
+        db.add(user)
+        db.commit()
+        db.refresh(user)
+
+    db.close()
+
+    jwt_token = create_access_token({
+        "sub": user.id,
+        "email": user.email,
+    })
+    
+    refresh_token = create_refresh_token({
+        "sub": user.id,
+        "email": user.email,
+    })
+
+    return {
+        "access_token": jwt_token,
+        "refresh_token": refresh_token,
+        "token_type": "bearer",
+        "user": {
+            "email": user.email,
+            "name": user.name,
+            "avatar": user.avatar,
+        }
+    }
+    
+@router.get("/me")
+def me(user = Depends(get_current_user)):
+    return {
+        "email": user.email,
+        "name": user.name,
+        "avatar": user.avatar,
+    }
+    
+@router.post("/refresh")
+def refresh_token(refresh_token: str):
+    payload = decode_token(refresh_token)
+
+    if payload.get("type") != "refresh":
+        raise HTTPException(status_code=401)
+
+    user_id = payload.get("sub")
+
+    new_access = create_access_token({"sub": user_id})
+
+    return {"access_token": new_access}
+
+@router.post("/logout")
+def logout():
+    return {"message": "ok"}