feat: implement centralized token extraction via Request headers and add debug logging to search route

dependencies.py

@@ -1,4 +1,4 @@
-from fastapi import Depends, HTTPException, Header, status
+from fastapi import Depends, HTTPException, Header, status, Request
 from fastapi.security import OAuth2PasswordBearer
 from typing import Any, Optional
 
@@ -10,58 +10,39 @@ DEV_USER = {"id": DEV_USER_ID, "email": "dev@studymate.ai", "name": "Dev User"}
 oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token", auto_error=False)
 
 
-async def get_current_user(
-    token: Optional[str] = Depends(oauth2_scheme),
-    x_auth_token: Optional[str] = Header(None),
-    authorization: Optional[str] = Header(None),
-) -> Any:
-    auth_client = get_auth_supabase()
-    client = get_supabase()
+def _extract_token(request: Request) -> Optional[str]:
+    """
+    Extract Supabase JWT from headers — case-insensitive.
+    Priority: X-Auth-Token → Authorization (skip HF tokens)
+    """
+    headers = {k.lower(): v for k, v in request.headers.items()}
 
-    supabase_token = x_auth_token
-    if not supabase_token and authorization:
-        supabase_token = authorization.replace("Bearer ", "").strip()
-    elif not supabase_token and token:
-        supabase_token = token
+    # 1. Try X-Auth-Token first (our custom header)
+    token = headers.get("x-auth-token")
+    if token:
+        return token
 
-    # If the token is a Hugging Face token (starts with hf_), ignore it for user auth
-    if supabase_token and supabase_token.startswith("hf_"):
-        supabase_token = None
+    # 2. Fallback to Authorization header
+    auth = headers.get("authorization", "")
+    if auth.startswith("Bearer "):
+        token = auth[len("Bearer "):].strip()
+        # Skip HF tokens — they're for space access, not user auth
+        if token.startswith("hf_"):
+            return None
+        return token
 
-    # Dev mode: no Supabase configured
-    if client is None:
-        return DEV_USER
-
-    # 3. Verify the token with Supabase
-    if supabase_token:
-        try:
-            verify_client = auth_client if auth_client is not None else client
-            response = verify_client.auth.get_user(supabase_token)
-            user = getattr(response, "user", None) or response
-            if user:
-                return user
-        except Exception:
-            pass
-
-    raise HTTPException(status.HTTP_401_UNAUTHORIZED, "Not authenticated")
+    return None
 
 
-async def get_current_user_id(
-    x_auth_token: Optional[str] = Header(None),
-    authorization: Optional[str] = Header(None),
-) -> str:
-    token = x_auth_token
-
-    if not token and authorization:
-        token = authorization.replace("Bearer ", "").strip()
-    
-    if token and token.startswith("hf_"):
-        token = None
-
+async def get_current_user_id(request: Request) -> str:
     client = get_supabase()
+
+    # Dev mode
     if client is None:
         return DEV_USER_ID
 
+    token = _extract_token(request)
+
     if not token:
         raise HTTPException(status.HTTP_401_UNAUTHORIZED, "Not authenticated")
 
@@ -71,5 +52,28 @@ async def get_current_user_id(
         user = supabase.auth.get_user(token)
         user_obj = getattr(user, "user", None) or user
         return str(user_obj.id)
-    except Exception:
+    except Exception as e:
         raise HTTPException(status.HTTP_401_UNAUTHORIZED, "Invalid or expired token")
+
+
+async def get_current_user(request: Request) -> Any:
+    auth_client = get_auth_supabase()
+    client = get_supabase()
+
+    # Dev mode
+    if client is None:
+        return DEV_USER
+
+    token = _extract_token(request)
+
+    if token:
+        try:
+            verify_client = auth_client if auth_client is not None else client
+            response = verify_client.auth.get_user(token)
+            user = getattr(response, "user", None) or response
+            if user:
+                return user
+        except Exception:
+            pass
+
+    raise HTTPException(status.HTTP_401_UNAUTHORIZED, "Not authenticated")

materials/routes.py

@@ -2,7 +2,7 @@ import time
 import asyncio
 import logging
 import validators
-from fastapi import APIRouter, UploadFile, File, HTTPException, Depends, BackgroundTasks, Header
+from fastapi import APIRouter, UploadFile, File, HTTPException, Depends, BackgroundTasks, Header, Request
 from pydantic import BaseModel
 from postgrest.exceptions import APIError
 
@@ -243,18 +243,27 @@ class SearchRequest(BaseModel):
 
 @router.post("/search")
 async def search_materials(
+    request: Request,
     body: SearchRequest,
-    user_id: str = Depends(get_current_user_id)
+    user_id: str = Depends(get_current_user_id),
 ):
+    # Debug logs
+    headers = {k.lower(): v for k, v in request.headers.items()}
+    logger.info(f"[search] user_id={user_id}")
+    logger.info(f"[search] x-auth-token present: {'x-auth-token' in headers}")
+    logger.info(f"[search] authorization present: {'authorization' in headers}")
+    logger.info(f"[search] query={body.q}")
+
     supabase = get_supabase()
     if not supabase:
-         return {"results": []}
-         
+        return {"results": []}
+
     result = supabase.rpc(
         "search_materials_by_title",
         {"p_query": body.q, "p_user_id": user_id}
     ).execute()
 
+    logger.info(f"[search] RPC returned {len(result.data)} results: {result.data}")
     return {"results": result.data}
     
 @router.delete("/{material_id}")