UP

app/core/auth.py

@@ -71,13 +71,23 @@ async def get_current_user(request: Request) -> dict:
     When SUPABASE_JWT_SECRET is not configured (HF Spaces / dev),
     falls back to trusting the user_id from the request body.
     """
+    import os
+
+    jwt_secret = os.environ.get("SUPABASE_JWT_SECRET", "")
+    _placeholder_values = {"", "your_jwt_secret_here", "CHANGE_ME", "placeholder"}
+    has_real_secret = jwt_secret not in _placeholder_values
+
+    log.info("[auth] SUPABASE_JWT_SECRET set=%s, has_real=%s", bool(jwt_secret), has_real_secret)
+
     token = extract_token_from_request(request)
 
     if token:
+        log.info("[auth] Token received (len=%d, prefix=%s...)", len(token), token[:16])
         payload = _validate_jwt(token)
         if payload:
             user_id = payload.get("sub", "")
             if user_id:
+                log.info("[auth] JWT validated, user_id=%s", user_id)
                 return {
                     "user_id": user_id,
                     "email": payload.get("email", ""),
@@ -85,7 +95,8 @@ async def get_current_user(request: Request) -> dict:
                 }
 
     # Dev/HF fallback: when no JWT secret is configured, trust user_id from body
-    if not _has_real_jwt_secret():
+    if not has_real_secret:
+        log.info("[auth-dev] No real JWT secret — trying body fallback")
         try:
             body_bytes = await request.body()
             if body_bytes:
@@ -97,6 +108,8 @@ async def get_current_user(request: Request) -> dict:
                     return {"user_id": user_id, "email": "", "role": "authenticated"}
         except Exception as exc:
             log.warning("[auth-dev] Body fallback failed: %s", exc)
+    else:
+        log.warning("[auth] Real JWT secret IS set but token validation failed")
 
     log.warning("Auth failed: no valid token and no dev fallback available")
     raise HTTPException(