fixed

app/auth/routes.py

@@ -287,10 +287,6 @@ async def refresh_token(request: Request, token_data: TokenRefreshRequest):
         new_access_token = auth_middleware.create_access_token(data={"sub": user.id})
         new_refresh_token = auth_middleware.create_refresh_token(data={"sub": user.id})
         
-        # Blacklist old refresh token
-        expires_at = datetime.fromtimestamp(payload.get("exp", 0))
-        auth_middleware.blacklist_token(token_data.refresh_token, expires_at)
-        
         # Create new session
         await create_user_session(user.id, new_access_token, new_refresh_token, request)
         
@@ -319,10 +315,6 @@ async def logout(credentials: HTTPAuthorizationCredentials = Depends(security)):
         token = credentials.credentials
         payload = auth_middleware.verify_token(token)
         
-        # Blacklist the token
-        expires_at = datetime.fromtimestamp(payload.get("exp", 0))
-        auth_middleware.blacklist_token(token, expires_at)
-        
         # Update session as ended
         user_id = payload.get("sub")
         if user_id:

app/middleware/__init__.py

@@ -3,7 +3,6 @@ from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
 from jose import JWTError, jwt
 from datetime import datetime, timedelta
 from typing import Optional
-import redis
 from supabase import create_client, Client
 
 from app.config.settings import settings
@@ -15,22 +14,10 @@ class AuthMiddleware:
     
     def __init__(self):
         self.security = HTTPBearer()
-        self.supabase: Client = create_client(
+        self.supabase = create_client(
             settings.SUPABASE_URL, 
             settings.SUPABASE_SERVICE_KEY
         ) if settings.SUPABASE_URL and settings.SUPABASE_SERVICE_KEY else None
-        
-        # Redis client for token blacklisting
-        try:
-            self.redis_client = redis.Redis(
-                host=settings.REDIS_HOST,
-                port=settings.REDIS_PORT,
-                db=settings.REDIS_DB,
-                password=settings.REDIS_PASSWORD if settings.REDIS_PASSWORD else None,
-                decode_responses=True
-            )
-        except Exception:
-            self.redis_client = None
 
     def create_access_token(self, data: dict, expires_delta: Optional[timedelta] = None) -> str:
         """Create JWT access token."""
@@ -59,14 +46,6 @@ class AuthMiddleware:
     def verify_token(self, token: str) -> dict:
         """Verify JWT token."""
         try:
-            # Check if token is blacklisted
-            if self.redis_client and self.redis_client.get(f"blacklist:{token}"):
-                raise HTTPException(
-                    status_code=status.HTTP_401_UNAUTHORIZED,
-                    detail="Token has been revoked",
-                    headers={"WWW-Authenticate": "Bearer"},
-                )
-            
             payload = jwt.decode(token, settings.JWT_SECRET_KEY, algorithms=[settings.JWT_ALGORITHM])
             return payload
         except JWTError:
@@ -76,17 +55,6 @@ class AuthMiddleware:
                 headers={"WWW-Authenticate": "Bearer"},
             )
 
-    def blacklist_token(self, token: str, expires_at: datetime):
-        """Add token to blacklist."""
-        if self.redis_client:
-            try:
-                # Calculate TTL until token expires
-                ttl = int((expires_at - datetime.utcnow()).total_seconds())
-                if ttl > 0:
-                    self.redis_client.setex(f"blacklist:{token}", ttl, "1")
-            except Exception:
-                pass  # If Redis is down, continue without blacklisting
-
     async def get_user_from_supabase(self, user_id: str) -> Optional[User]:
         """Get user from Supabase."""
         if not self.supabase:
@@ -106,7 +74,7 @@ class AuthMiddleware:
         token = credentials.credentials
         payload = self.verify_token(token)
         
-        user_id: str = payload.get("sub")
+        user_id = payload.get("sub")
         if user_id is None:
             raise HTTPException(
                 status_code=status.HTTP_401_UNAUTHORIZED,