refactor: expand JWT algorithm support

auth/routes.py

@@ -350,7 +350,7 @@ async def exchange_session(request: Request, response: Response):
             payload = pyjwt.decode(
                 raw_supabase_token,
                 supabase_jwt_secret,
-                algorithms=["HS256"],
+                algorithms=["HS256", "HS384", "HS512"],
                 options={"verify_aud": False},  # Supabase uses 'authenticated' as aud
             )
             user_id = payload.get("sub")
@@ -358,26 +358,8 @@ async def exchange_session(request: Request, response: Response):
             user_metadata = payload.get("user_metadata", {})
         except pyjwt.ExpiredSignatureError:
             raise HTTPException(401, "Supabase token has expired. Please sign in again.")
-        except pyjwt.InvalidTokenError as e:
-            raise HTTPException(401, f"Invalid Supabase token: {e}")
-    else:
-        # Fallback: decode claims without signature verification if secret is not set
-        try:
-            import time
-            payload = pyjwt.decode(
-                raw_supabase_token,
-                options={"verify_signature": False, "verify_aud": False},
-            )
-            exp = payload.get("exp")
-            if exp and time.time() > exp:
-                raise HTTPException(401, "Supabase token has expired. Please sign in again.")
-            user_id = payload.get("sub")
-            email = payload.get("email", "")
-            user_metadata = payload.get("user_metadata", {})
-        except HTTPException:
-            raise
         except Exception:
-            pass
+            pass  # Fall through to Supabase API validation below
 
     # Fallback: validate via Supabase API (slower, but works if unverified decoding failed)
     if not user_id:

dependencies.py

@@ -88,27 +88,19 @@ async def get_current_user_id(request: Request) -> str:
         pass
 
     # ── Mode 1b: Supabase JWT stateless fallback (avoids 403 network race) ───
-    try:
-        if settings.supabase_jwt_secret:
+    if settings.supabase_jwt_secret:
+        try:
             payload = pyjwt.decode(
                 token,
                 settings.supabase_jwt_secret,
-                algorithms=["HS256"],
+                algorithms=["HS256", "HS384", "HS512"],
                 options={"verify_aud": False},
             )
-        else:
-            payload = pyjwt.decode(
-                token,
-                options={"verify_signature": False, "verify_aud": False},
-            )
-            exp = payload.get("exp")
-            if exp and time.time() > exp:
-                payload = {}
-        user_id = payload.get("sub")
-        if user_id:
-            return str(user_id)
-    except Exception:
-        pass
+            user_id = payload.get("sub")
+            if user_id:
+                return str(user_id)
+        except Exception:
+            pass
 
     # ── Mode 2: Supabase token (backwards-compat for Google OAuth sessions) ──
     try:
@@ -142,27 +134,19 @@ async def get_current_user(request: Request) -> Any:
         pass
 
     # ── Mode 1b: Supabase JWT stateless fallback ─────────────────────────────
-    try:
-        if settings.supabase_jwt_secret:
+    if settings.supabase_jwt_secret:
+        try:
             payload = pyjwt.decode(
                 token,
                 settings.supabase_jwt_secret,
-                algorithms=["HS256"],
+                algorithms=["HS256", "HS384", "HS512"],
                 options={"verify_aud": False},
             )
-        else:
-            payload = pyjwt.decode(
-                token,
-                options={"verify_signature": False, "verify_aud": False},
-            )
-            exp = payload.get("exp")
-            if exp and time.time() > exp:
-                payload = {}
-        user_id = payload.get("sub")
-        if user_id:
-            return {"id": user_id, "email": payload.get("email", "")}
-    except Exception:
-        pass
+            user_id = payload.get("sub")
+            if user_id:
+                return {"id": str(user_id), "email": payload.get("email", "")}
+        except Exception:
+            pass
 
     # ── Mode 2: Supabase token (backwards compat) ────────────────────────────
     try:

main.py

@@ -95,7 +95,7 @@ app = FastAPI(
     title="AI Tutor API",
     description="Backend API for the AI Tutor for Students application",
     version="1.0.0",
-    lifespan=lifespan,
+    # lifespan=lifespan,
 )
 
 @app.middleware("http")