feat: implement password update functionality and add signup, forgot-password, and update-password pages

auth/routes.py

@@ -1,8 +1,11 @@
 import uuid
+import cloudinary
+import cloudinary.uploader
 from fastapi import APIRouter, HTTPException, UploadFile, File
 from fastapi import Depends
 from typing import Optional
 
+from src.config import settings
 from src.database import get_auth_supabase, get_supabase
 from src.store import create_user, get_user_by_email, delete_user_data, update_user_profile, get_user_by_id
 from src.dependencies import get_current_user_id, get_current_user
@@ -22,7 +25,7 @@ async def upload_avatar(
     file: UploadFile = File(...),
     user_id: str = Depends(get_current_user_id),
 ):
-    """Upload a profile avatar image to Supabase Storage and return its public URL."""
+    """Upload a profile avatar image to Cloudinary and return its public URL."""
 
     # 1. Validate MIME type
     if file.content_type not in ALLOWED_MIME_TYPES:
@@ -40,31 +43,33 @@ async def upload_avatar(
             f"File is too large ({len(content) // 1024} KB). Maximum allowed size is 6 MB.",
         )
 
-    # 3. Build a unique storage path: avatars/<user_id>/<uuid>.<ext>
-    ext = (file.filename or "image").rsplit(".", 1)[-1].lower()
-    if ext not in {"jpg", "jpeg", "png", "webp", "gif", "avif", "svg"}:
-        ext = "jpg"  # safe fallback
-    storage_path = f"{user_id}/{uuid.uuid4()}.{ext}"
+    # 3. Configure Cloudinary
+    if not settings.cloudinary_cloud_name or not settings.cloudinary_api_key or not settings.cloudinary_api_secret:
+        raise HTTPException(503, "Cloudinary service is not configured")
 
-    # 4. Upload to Supabase Storage using the service-role client
-    client = get_supabase()
-    if client is None:
-        raise HTTPException(503, "Storage service unavailable")
+    cloudinary.config(
+        cloud_name=settings.cloudinary_cloud_name,
+        api_key=settings.cloudinary_api_key,
+        api_secret=settings.cloudinary_api_secret,
+        secure=True,
+    )
 
+    # 4. Upload to Cloudinary with smart face-cropping & auto webp conversion
     try:
-        client.storage.from_(AVATAR_BUCKET).upload(
-            path=storage_path,
-            file=content,
-            file_options={"content-type": file.content_type, "upsert": "true"},
+        response = cloudinary.uploader.upload(
+            content,
+            folder="avatars",
+            public_id=f"avatar_{user_id}",
+            overwrite=True,
+            transformation=[
+                {"width": 300, "height": 300, "crop": "fill", "gravity": "face"},
+                {"fetch_format": "auto", "quality": "auto"}
+            ]
         )
+        public_url = response.get("secure_url") or response.get("url")
+        return {"status": "success", "avatar_url": public_url}
     except Exception as e:
-        raise HTTPException(500, f"Failed to upload avatar: {e}")
-
-    # 5. Get the public URL from the bucket
-    public_url_resp = client.storage.from_(AVATAR_BUCKET).get_public_url(storage_path)
-    public_url = public_url_resp if isinstance(public_url_resp, str) else str(public_url_resp)
-
-    return {"status": "success", "avatar_url": public_url}
+        raise HTTPException(500, f"Failed to upload avatar to Cloudinary: {e}")
 
 
 @router.delete("/me")
@@ -164,6 +169,44 @@ async def get_profile(
 
 @router.patch("/profile")
 async def update_profile(body: ProfileUpdateRequest, user_id: str = Depends(get_current_user_id)):
+    # Reject raw base64 image data — images must be uploaded via /upload-avatar first
+    if body.avatar_url and body.avatar_url.startswith("data:"):
+        raise HTTPException(
+            400,
+            "Storing raw image data is not allowed. "
+            "Upload the image via POST /api/auth/upload-avatar and use the returned URL instead."
+        )
+
+    # Handle password update if password is provided
+    if body.password is not None:
+        # Verify current password if provided
+
+        if body.current_password:
+            user_data = get_user_by_id(user_id)
+            user_email = user_data.get("email") if user_data else None
+            if user_email and not any(domain in user_email for domain in PLACEHOLDER_DOMAINS):
+                auth_client = get_auth_supabase()
+                if auth_client:
+                    try:
+                        res = auth_client.auth.sign_in_with_password({
+                            "email": user_email,
+                            "password": body.current_password
+                        })
+                        if hasattr(res, "error") and res.error:
+                            raise HTTPException(400, "Current password is incorrect.")
+                    except HTTPException:
+                        raise
+                    except Exception:
+                        raise HTTPException(400, "Current password is incorrect.")
+
+        # Update password in Supabase Auth
+        admin_client = get_supabase()
+        if admin_client:
+            try:
+                admin_client.auth.admin.update_user_by_id(user_id, {"password": body.password})
+            except Exception as e:
+                raise HTTPException(500, f"Failed to update password: {e}")
+
     try:
         updated_user = update_user_profile(
             user_id,
@@ -176,3 +219,4 @@ async def update_profile(body: ProfileUpdateRequest, user_id: str = Depends(get_
         raise HTTPException(404, str(e))
     except Exception as e:
         raise HTTPException(500, f"Failed to update profile: {e}")
+

auth/schemas.py

@@ -1,7 +1,11 @@
-from pydantic import BaseModel
+from pydantic import BaseModel, Field
 from typing import Optional
 
 class ProfileUpdateRequest(BaseModel):
     name: Optional[str] = None
     avatar_url: Optional[str] = None
     theme: Optional[str] = None
+    current_password: Optional[str] = None
+    password: Optional[str] = Field(None, min_length=8)
+
+

config.py

@@ -24,7 +24,18 @@ class Settings:
         os.getenv("SUPABASE_ANON_KEY")
         or os.getenv("NEXT_PUBLIC_SUPABASE_ANON_KEY", "")
     )
-    groq_api_key: str = os.getenv("GROQ_API_KEY", "")
+    cloudinary_cloud_name: str = (
+        os.getenv("CLOUDINARY_CLOUD_NAME")
+        or os.getenv("CLOUD_NAME", "")
+    )
+    cloudinary_api_key: str = (
+        os.getenv("CLOUDINARY_API_KEY")
+        or os.getenv("CLOUD_API_KEY", "")
+    )
+    cloudinary_api_secret: str = (
+        os.getenv("CLOUDINARY_API_SECRET")
+        or os.getenv("CLOUD_SECRET", "")
+    )
     model_name: str = os.getenv("MODEL_NAME", "gemini-3.1-flash-lite")
     transformers_no_tf: str = os.getenv("TRANSFORMERS_NO_TF", "1")
     cors_allowed_origins: list[str] = [

main.py

@@ -67,7 +67,7 @@ async def lifespan(app: FastAPI):
         logger.warning(f"English ASR model failed to load: {e}")
 
     try:
-        from src.asr.models import get_audio_model_ard
+        from src.asr.models import get_audio_model_ar
         get_audio_model_ar()
     except Exception as e:
         logger.warning(f"Arabic ASR model failed to load: {e}")

rag/rag.py

@@ -12,7 +12,6 @@ from langchain.prompts import PromptTemplate
 from langchain.memory import ConversationBufferMemory, ConversationBufferWindowMemory
 from langchain_core.retrievers import BaseRetriever
 from langchain_core.documents import Document
-from langchain_openai import ChatOpenAI
 from langchain_google_genai import ChatGoogleGenerativeAI
 
 from src.config import settings
@@ -164,23 +163,25 @@ def get_quiz_llm():
     )
 
 
-def get_groq_llm():
-    if not settings.groq_api_key:
-        raise ValueError("GROQ_API_KEY not found. Please set it in config.env.")
-    return ChatOpenAI(
-        model="llama-3.1-8b-instant",
-        base_url="https://api.groq.com/openai/v1",
-        api_key=settings.groq_api_key,
-        max_tokens=600,
+def get_gemma_31b_llm():
+    if not os.environ.get("GEMINI_API_KEY"):
+        raise ValueError("GEMINI_API_KEY not found. Please set it in config.env.")
+    logger.info("Initializing primary LLM with model: google/gemma-4-31b-it")
+    return ChatGoogleGenerativeAI(
+        model="google/gemma-4-31b-it",
+        api_key=settings.gemini_api_key,
+        temperature=0.3,
+        max_output_tokens=2500,
+        timeout=120,
     )
 
 
-def get_fallback_gemma_llm():
+def get_gemma_26b_llm():
     if not os.environ.get("GEMINI_API_KEY"):
         raise ValueError("GEMINI_API_KEY not found. Please set it in config.env.")
-    logger.info("Initializing fallback LLM with model: google/gemma-4-31b-it")
+    logger.info("Initializing fallback LLM with model: google/gemma-4-26b-it")
     return ChatGoogleGenerativeAI(
-        model="google/gemma-4-31b-it",
+        model="google/gemma-4-26b-it",
         api_key=settings.gemini_api_key,
         temperature=0.3,
         max_output_tokens=2500,
@@ -298,8 +299,6 @@ def rag_answer(
 
     is_topic = not (material_id and mat and mat.get("source_type") != "topic")
 
-    llm = get_groq_llm()
-
     context_parts = []
     has_chunks = False
 
@@ -368,9 +367,8 @@ def rag_answer(
         return any(t.startswith(p) for p in _REFUSAL_PREFIXES)
 
     try:
-        # All queries now use the simple LLM call (no agent loop).
-        # DDG results are pre-fetched and injected into context above.
-        chain = prompt | llm
+        primary_llm = get_gemma_31b_llm()
+        chain = prompt | primary_llm
 
         memory_vars = memory.load_memory_variables({"input": query})
         chat_history = memory_vars.get("chat_history", [])
@@ -388,9 +386,9 @@ def rag_answer(
             memory.save_context({"input": query}, {"output": answer})
         return answer, memory
     except Exception as e:
-        logger.warning(f"Groq API call failed or rate-limited: {e}. Falling back to google/gemma-4-31b-it immediately.")
+        logger.warning(f"Gemma 4 31B API call failed or rate-limited: {e}. Falling back to google/gemma-4-26b-it immediately.")
         try:
-            fallback_llm = get_fallback_gemma_llm()
+            fallback_llm = get_gemma_26b_llm()
             chain = prompt | fallback_llm
             memory_vars = memory.load_memory_variables({"input": query})
             chat_history = memory_vars.get("chat_history", [])
@@ -407,12 +405,10 @@ def rag_answer(
                 memory.save_context({"input": query}, {"output": answer})
             return answer, memory
         except Exception as fallback_err:
-            logger.error(f"Fallback LLM call also failed: {fallback_err}")
+            logger.error(f"Fallback Gemma 4 26B LLM call also failed: {fallback_err}")
             raise fallback_err
 
 def extract_chat_title(query: str, material_title: Optional[str] = None) -> str:
-    llm = get_groq_llm()
-    
     topic_context = ""
     if material_title:
         topic_context = f"\nNote: The user is discussing the topic '{material_title}'. If their query uses pronouns like 'its' or 'this', assume it refers to this topic. If the topic name '{material_title}' appears to be a random string or dummy name, do not use it directly; instead, create a general title related to their query, such as 'Types of the topic' or 'Elements of the topic'."
@@ -425,16 +421,17 @@ def extract_chat_title(query: str, material_title: Optional[str] = None) -> str:
     )
     
     try:
-        chain = prompt | llm
+        primary_llm = get_gemma_31b_llm()
+        chain = prompt | primary_llm
         response = chain.invoke({"query": query})
     except Exception as e:
-        logger.warning(f"Groq API call failed or rate-limited in extract_chat_title: {e}. Falling back to google/gemma-4-31b-it immediately.")
+        logger.warning(f"Gemma 4 31B API call failed or rate-limited in extract_chat_title: {e}. Falling back to google/gemma-4-26b-it immediately.")
         try:
-            fallback_llm = get_fallback_gemma_llm()
+            fallback_llm = get_gemma_26b_llm()
             chain = prompt | fallback_llm
             response = chain.invoke({"query": query})
         except Exception as fallback_err:
-            logger.error(f"Fallback LLM call also failed in extract_chat_title: {fallback_err}")
+            logger.error(f"Fallback Gemma 4 26B LLM call also failed in extract_chat_title: {fallback_err}")
             raise fallback_err
 
     title = response.content.strip().strip('"').strip("'")