Phase 2: initiate

app/routes/auth.py

@@ -1,30 +1,101 @@
 from flask import Blueprint, render_template, redirect, url_for, flash, request
-from flask_login import login_user, logout_user, login_required
+from flask_login import login_user, logout_user, login_required, current_user
 from app import db
 from app.models.user import User
+from app.utils.forms import LoginForm, UserForm
+from app.utils.decorators import admin_required
 
 bp = Blueprint('auth', __name__, url_prefix='/auth')
 
 @bp.route('/login', methods=['GET', 'POST'])
 def login():
-    if request.method == 'POST':
-        username = request.form.get('username')
-        password = request.form.get('password')
-
-        user = User.query.filter_by(username=username).first()
-
-        if user and user.check_password(password):
+    if current_user.is_authenticated:
+        return redirect(url_for('dashboard.index'))
+    
+    form = LoginForm()
+    if form.validate_on_submit():
+        user = User.query.filter_by(username=form.username.data).first()
+        
+        if user and user.check_password(form.password.data):
             login_user(user)
             next_page = request.args.get('next')
+            flash(f'Welcome back, {user.username}!', 'success')
             return redirect(next_page or url_for('dashboard.index'))
         else:
-            flash('Invalid username or password', 'danger')
-
-    return render_template('login.html')
+            flash('Invalid credentials. Please try again.', 'danger')
+    
+    return render_template('auth/login.html', form=form)
 
 @bp.route('/logout')
 @login_required
 def logout():
     logout_user()
-    flash('You have been logged out successfully', 'success')
+    flash('Successfully logged out.', 'success')
     return redirect(url_for('auth.login'))
+
+@bp.route('/users')
+@login_required
+@admin_required
+def list_users():
+    users = User.query.order_by(User.created_at.desc()).all()
+    return render_template('auth/users.html', users=users)
+
+@bp.route('/users/new', methods=['GET', 'POST'])
+@login_required
+@admin_required
+def create_user():
+    form = UserForm()
+    
+    if form.validate_on_submit():
+        user = User(
+            username=form.username.data,
+            email=form.email.data,
+            role=form.role.data
+        )
+        user.set_password(form.password.data)
+        
+        db.session.add(user)
+        db.session.commit()
+        
+        flash(f'User {user.username} created successfully.', 'success')
+        return redirect(url_for('auth.list_users'))
+    
+    return render_template('auth/user_form.html', form=form, title='Create User')
+
+@bp.route('/users/<int:user_id>/edit', methods=['GET', 'POST'])
+@login_required
+@admin_required
+def edit_user(user_id):
+    user = User.query.get_or_404(user_id)
+    form = UserForm(user=user, obj=user)
+    
+    if form.validate_on_submit():
+        user.username = form.username.data
+        user.email = form.email.data
+        user.role = form.role.data
+        
+        if form.password.data:
+            user.set_password(form.password.data)
+        
+        db.session.commit()
+        flash(f'User {user.username} updated successfully.', 'success')
+        return redirect(url_for('auth.list_users'))
+    
+    return render_template('auth/user_form.html', form=form, user=user, title='Edit User')
+
+@bp.route('/users/<int:user_id>/delete', methods=['POST'])
+@login_required
+@admin_required
+def delete_user(user_id):
+    user = User.query.get_or_404(user_id)
+    
+    if user.id == current_user.id:
+        flash('Cannot delete your own account.', 'danger')
+        return redirect(url_for('auth.list_users'))
+    
+    username = user.username
+    db.session.delete(user)
+    db.session.commit()
+    
+    flash(f'User {username} deleted successfully.', 'success')
+    return redirect(url_for('auth.list_users'))