Upload 2 files

src/apps/app.py

@@ -180,7 +180,7 @@ async def login(response: Response, user: UserLogin, db: AsyncSession = Depends(
         httponly=True,
         max_age=ACCESS_TOKEN_EXPIRE_MINUTES * 60,
         samesite="lax",
-        secure=False  # Set to True in production with HTTPS
+        secure=True  # Required for Hugging Face HTTPS
     )
     
     print(f"Login successful for {db_user.username}, role: {db_user.role}")
@@ -194,7 +194,11 @@ async def login(response: Response, user: UserLogin, db: AsyncSession = Depends(
 
 @app.post("/api/logout")
 async def logout(response: Response):
-    response.delete_cookie("access_token")
+    response.delete_cookie(
+        key="access_token",
+        samesite="lax",
+        secure=True
+    )
     return {"message": "Logged out successfully"}
 
 @app.post("/api/forgot-password")

src/apps/auth.py

@@ -1,42 +1,51 @@
-from datetime import datetime, timedelta
-from typing import Optional
-import bcrypt
-
-# Monkeypatch bcrypt for passlib compatibility if needed
-if not hasattr(bcrypt, "__about__"):
-    bcrypt.__about__ = type('About', (object,), {'__version__': bcrypt.__version__})
-
-from jose import JWTError, jwt
-from passlib.context import CryptContext
-import os
-from dotenv import load_dotenv
-
-load_dotenv()
-
-SECRET_KEY = os.getenv("SECRET_KEY", "your_secret_key")
-ALGORITHM = os.getenv("ALGORITHM", "HS256")
-ACCESS_TOKEN_EXPIRE_MINUTES = int(os.getenv("ACCESS_TOKEN_EXPIRE_MINUTES", 30))
-
-_pwd_context = None
-
-def get_pwd_context():
-    global _pwd_context
-    if _pwd_context is None:
-        _pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
-    return _pwd_context
-
-def verify_password(plain_password, hashed_password):
-    return get_pwd_context().verify(plain_password, hashed_password)
-
-def get_password_hash(password):
-    return get_pwd_context().hash(password)
-
-def create_access_token(data: dict, expires_delta: Optional[timedelta] = None):
-    to_encode = data.copy()
-    if expires_delta:
-        expire = datetime.utcnow() + expires_delta
-    else:
-        expire = datetime.utcnow() + timedelta(minutes=15)
-    to_encode.update({"exp": expire})
-    encoded_jwt = jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)
-    return encoded_jwt
+from datetime import datetime, timedelta
+from typing import Optional
+import os
+import bcrypt
+from jose import JWTError, jwt
+from passlib.context import CryptContext
+from dotenv import load_dotenv
+
+# --- BCrypt Compatibility Fix ---
+# Satisfy passlib's check for the bcrypt library version (needed for modern Python/BCrypt compatibility)
+if not hasattr(bcrypt, "__about__"):
+    bcrypt.__about__ = type('About', (object,), {'__version__': bcrypt.__version__})
+
+load_dotenv()
+
+# --- Configuration ---
+# Use environment variables or local fallback for development
+# SECRET_KEY is used for signing JWT tokens and should be 32+ characters
+SECRET_KEY = os.getenv("SECRET_KEY", "f1fda542576b459ee24bf2d459711a439576da2d804dcbb35de9e18261")
+ALGORITHM = os.getenv("ALGORITHM", "HS256")
+ACCESS_TOKEN_EXPIRE_MINUTES = int(os.getenv("ACCESS_TOKEN_EXPIRE_MINUTES", 30))
+
+# --- Password Management ---
+# Using the standard bcrypt hashing scheme with passlib
+pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
+
+def verify_password(plain_password: str, hashed_password: str) -> bool:
+    """Verifies a plain text password against its hashed version."""
+    try:
+        if isinstance(hashed_password, str):
+            hashed_password = hashed_password.encode('utf-8')
+        return pwd_context.verify(plain_password, hashed_password)
+    except Exception:
+        return False
+
+def get_password_hash(password: str) -> str:
+    """Creates a secure hash for a password."""
+    return pwd_context.hash(password)
+
+# --- Token Management ---
+def create_access_token(data: dict, expires_delta: Optional[timedelta] = None) -> str:
+    """Generates a signed JWT access token."""
+    to_encode = data.copy()
+    if expires_delta:
+        expire = datetime.utcnow() + expires_delta
+    else:
+        expire = datetime.utcnow() + timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
+    
+    to_encode.update({"exp": expire})
+    encoded_jwt = jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)
+    return encoded_jwt