Add email/password sign-in and restrict sign-in to altafhvali.com

RAG_Products/api.py

@@ -18,7 +18,7 @@ from fastapi.responses import FileResponse
 from fastapi.staticfiles import StaticFiles
 from pydantic import BaseModel, Field
 
-from RAG_Products.config import SIMILAR_K, OPENROUTER_API_KEY, ALLOWED_ORIGINS
+from RAG_Products.config import SIMILAR_K, OPENROUTER_API_KEY, ALLOWED_ORIGINS, ALLOWED_EMAIL_DOMAIN
 from RAG_Products.graph import get_graph
 from RAG_Products.similar import find_similar, doc_to_dict
 from RAG_Products.models import llm_groq
@@ -118,10 +118,16 @@ def health():
 
 def _resolve_user(authorization, fallback):
     """Prefer the verified Firebase uid from the Bearer token; else the
-    client-supplied id (used in local/no-auth mode)."""
+    client-supplied id (used in local/no-auth mode).
+
+    Enforces ALLOWED_EMAIL_DOMAIN: a signed-in user whose email isn't on that
+    domain is rejected outright (403), never silently downgraded to anonymous.
+    """
     if authorization and authorization.lower().startswith("bearer "):
-        uid = storage.verify_token(authorization[7:].strip())
+        uid, email = storage.verify_token(authorization[7:].strip())
         if uid:
+            if ALLOWED_EMAIL_DOMAIN and not (email or "").lower().endswith("@" + ALLOWED_EMAIL_DOMAIN):
+                raise HTTPException(403, f"Sign-in is restricted to @{ALLOWED_EMAIL_DOMAIN} accounts.")
             return uid
     return fallback or "default"
 

RAG_Products/config.py

@@ -57,6 +57,10 @@ FIREBASE_CREDENTIALS_JSON = os.getenv("FIREBASE_CREDENTIALS_JSON")
 FIREBASE_PROJECT_ID = os.getenv("FIREBASE_PROJECT_ID")
 CHATS_LOCAL_PATH = BASE_DIR / "Data" / "chats.json"  # fallback store
 
+# Only emails on this domain may sign in (any Firebase provider — Google or
+# email/password). Empty string disables the restriction.
+ALLOWED_EMAIL_DOMAIN = os.getenv("ALLOWED_EMAIL_DOMAIN", "altafhvali.com")
+
 # CORS: comma-separated origins allowed to call the API (the Vercel frontend).
 # "*" is fine since there are no cookies; restrict to your domain for safety.
 ALLOWED_ORIGINS = os.getenv("ALLOWED_ORIGINS", "*")

RAG_Products/static/config.js

@@ -8,8 +8,12 @@ window.AHV_API = "https://mvali77-ahv.hf.space";
 // "Your apps" → Web app → SDK setup and configuration → "Config".
 // Leave apiKey empty to disable sign-in (anonymous per-browser mode).
 window.FIREBASE_CONFIG = {
-  apiKey: "",
+  apiKey: "AIzaSyDlHQi35b2bucAlXTHsso93cIOPdZFFZ0Y",
   authDomain: "ahv-assistant.firebaseapp.com",
   projectId: "ahv-assistant",
   appId: "1:201860800907:web:26114586af1b4a42704f8e"
 };
+
+// Only this email domain may sign in (must match ALLOWED_EMAIL_DOMAIN on the
+// backend — this is just a fast client-side check, the backend enforces it).
+window.ALLOWED_EMAIL_DOMAIN = "altafhvali.com";

RAG_Products/static/index.html

@@ -48,8 +48,21 @@
     .user-row .uname { flex:1; white-space:nowrap; overflow:hidden; text-overflow:ellipsis; }
     .user-row .signout { font-size:12px; color:var(--muted); cursor:pointer; background:none; border:none; }
     .user-row .signout:hover { color:#dc2626; }
-    .gate { text-align:center; color:var(--muted); margin-top:10vh; }
+    .gate { text-align:center; color:var(--muted); margin-top:6vh; }
     .gate h2 { color:var(--ink); font-weight:600; font-size:20px; margin:0 0 8px; }
+    .gate-box { max-width:340px; margin:24px auto 0; text-align:left; }
+    .gate-box .field { margin-bottom:10px; }
+    .gate-box input { width:100%; padding:11px 13px; border:1px solid var(--line); border-radius:9px;
+                       font-size:14.5px; font-family:inherit; outline:none; }
+    .gate-box input:focus { border-color:var(--ink); }
+    .gate-box .btn-primary { width:100%; padding:11px 13px; border:none; border-radius:9px; background:var(--ink);
+                              color:#fff; font-size:14.5px; font-weight:550; cursor:pointer; font-family:inherit; }
+    .gate-box .btn-primary:disabled { background:#a1a1aa; }
+    .gate-divider { display:flex; align-items:center; gap:10px; margin:16px 0; color:var(--muted); font-size:12px; }
+    .gate-divider::before, .gate-divider::after { content:''; flex:1; height:1px; background:var(--line); }
+    .gate-toggle { margin-top:14px; font-size:13px; }
+    .gate-toggle a { color:var(--accent); cursor:pointer; text-decoration:none; }
+    .gate-err { color:#dc2626; font-size:13px; margin-top:8px; text-align:left; }
     .status { font-size:11.5px; color:var(--muted); display:flex; align-items:center; gap:6px; margin-top:2px; }
     .dot { width:7px; height:7px; border-radius:50%; background:#d4d4d8; }
     .dot.up { background:var(--good); } .dot.down { background:#dc2626; }
@@ -388,6 +401,9 @@
           body: JSON.stringify({ message: text, chat_id: activeChat, user_id: USER_ID })
         });
         const data = await res.json(); loading.remove();
+        if (res.status === 403 && fbAuth) {
+          await fbAuth.signOut(); gateSign(data.detail || 'Access denied.'); return;
+        }
         if (!res.ok) {
           const e = document.createElement('div'); e.className = 'msg-bot';
           e.innerHTML = `<div class="note">${data.detail || 'Something went wrong.'}</div>`; thread.appendChild(e);
@@ -484,11 +500,68 @@
 
     /* ---------- auth ---------- */
     const GOOGLE_SVG = '<svg viewBox="0 0 48 48"><path fill="#EA4335" d="M24 9.5c3.5 0 6.6 1.2 9 3.6l6.7-6.7C35.6 2.6 30.2 0 24 0 14.6 0 6.5 5.4 2.6 13.2l7.8 6.1C12.2 13.2 17.6 9.5 24 9.5z"/><path fill="#4285F4" d="M46.1 24.5c0-1.6-.1-3.1-.4-4.5H24v9h12.4c-.5 2.9-2.1 5.3-4.5 7l7 5.4c4.1-3.8 6.5-9.4 6.5-16.9z"/><path fill="#FBBC05" d="M10.4 28.3c-.5-1.4-.8-2.9-.8-4.3s.3-3 .8-4.3l-7.8-6.1C.9 16.5 0 20.1 0 24s.9 7.5 2.6 10.4l7.8-6.1z"/><path fill="#34A853" d="M24 48c6.2 0 11.5-2 15.3-5.5l-7-5.4c-2 1.4-4.6 2.2-8.3 2.2-6.4 0-11.8-3.7-13.6-9l-7.8 6.1C6.5 42.6 14.6 48 24 48z"/></svg>';
-    function gateSign() {
+    let gateMode = 'signin';  // 'signin' | 'signup'
+
+    function gateSign(errMsg) {
       thread.innerHTML = `<div class="gate"><h2>Welcome to AHV Assistant</h2>
-        <div>Sign in to start chatting and keep your history on any device.</div></div>`;
+        <div>Sign in to start chatting and keep your history on any device.</div>
+        ${errMsg ? `<div class="gate-err" style="text-align:center;margin-top:10px">${errMsg}</div>` : ''}
+        <div class="gate-box">
+          <button class="signin-btn" id="gSignIn">${GOOGLE_SVG} Continue with Google</button>
+          <div class="gate-divider">or</div>
+          <div class="field"><input id="gEmail" type="email" placeholder="Email" autocomplete="email"></div>
+          <div class="field"><input id="gPass" type="password" placeholder="Password" autocomplete="current-password"></div>
+          <button class="btn-primary" id="gSubmit">Sign in</button>
+          <div class="gate-toggle" id="gToggleWrap">
+            <span id="gToggleText">Don't have an account? <a id="gToggle">Sign up</a></span>
+          </div>
+          <div class="gate-err" id="gErr"></div>
+        </div></div>`;
       box.disabled = true; send.disabled = true; box.placeholder = 'Sign in to chat…';
+
+      $('#gSignIn').onclick = () => fbAuth.signInWithPopup(new firebase.auth.GoogleAuthProvider())
+        .catch(e => showGateErr(e));
+      function toggleMode() {
+        gateMode = gateMode === 'signin' ? 'signup' : 'signin';
+        $('#gSubmit').textContent = gateMode === 'signin' ? 'Sign in' : 'Create account';
+        $('#gToggleText').innerHTML = gateMode === 'signin'
+          ? `Don't have an account? <a id="gToggle">Sign up</a>`
+          : `Already have an account? <a id="gToggle">Sign in</a>`;
+        $('#gToggle').onclick = toggleMode;
+        $('#gErr').textContent = '';
+      }
+      $('#gToggle').onclick = toggleMode;
+      $('#gSubmit').onclick = submitEmailAuth;
+      [$('#gEmail'), $('#gPass')].forEach(inp => inp.addEventListener('keydown', e => {
+        if (e.key === 'Enter') submitEmailAuth();
+      }));
+    }
+
+    function showGateErr(e) {
+      const map = {
+        'auth/invalid-email': 'That email looks invalid.',
+        'auth/missing-password': 'Enter a password.',
+        'auth/weak-password': 'Password should be at least 6 characters.',
+        'auth/email-already-in-use': 'An account already exists for that email — try signing in instead.',
+        'auth/invalid-credential': 'Wrong email or password.',
+        'auth/wrong-password': 'Wrong email or password.',
+        'auth/user-not-found': 'No account found for that email — try signing up.',
+        'auth/too-many-requests': 'Too many attempts. Try again in a bit.',
+      };
+      const el = $('#gErr'); if (el) el.textContent = map[e.code] || (e.message || 'Something went wrong.');
+    }
+
+    async function submitEmailAuth() {
+      const email = $('#gEmail').value.trim(), pass = $('#gPass').value;
+      if (!email || !pass) { $('#gErr').textContent = 'Enter an email and password.'; return; }
+      $('#gSubmit').disabled = true; $('#gErr').textContent = '';
+      try {
+        if (gateMode === 'signin') await fbAuth.signInWithEmailAndPassword(email, pass);
+        else await fbAuth.createUserWithEmailAndPassword(email, pass);
+      } catch (e) { showGateErr(e); }
+      $('#gSubmit').disabled = false;
     }
+
     function renderAuth(user) {
       const el = $('#authBox');
       if (user) {
@@ -498,11 +571,8 @@
           <button class="signout" id="signOut">Sign out</button></div>`;
         $('#signOut').onclick = () => fbAuth.signOut();
         box.disabled = false; send.disabled = false; box.placeholder = 'Message AHV Assistant…';
-      } else if (AUTH_ENABLED) {
-        el.innerHTML = `<button class="signin-btn" id="signIn">${GOOGLE_SVG} Sign in with Google</button>`;
-        $('#signIn').onclick = () => fbAuth.signInWithPopup(new firebase.auth.GoogleAuthProvider());
       } else {
-        el.innerHTML = '';  // anonymous mode: no auth UI
+        el.innerHTML = '';  // signed out (gate covers the sign-in UI) or anonymous mode
       }
     }
 
@@ -513,6 +583,12 @@
       fbAuth = firebase.auth();
       gateSign(); renderAuth(null);
       fbAuth.onAuthStateChanged(async (user) => {
+        const domain = window.ALLOWED_EMAIL_DOMAIN;
+        if (user && domain && !(user.email || '').toLowerCase().endsWith('@' + domain.toLowerCase())) {
+          await fbAuth.signOut();
+          gateSign(`Sign-in is restricted to @${domain} accounts.`);
+          return;
+        }
         authUser = user;
         if (user) {
           USER_ID = user.uid;

RAG_Products/storage.py

@@ -74,20 +74,21 @@ def backend() -> str:
 
 
 def verify_token(id_token):
-    """Verify a Firebase ID token and return its uid, or None if invalid.
+    """Verify a Firebase ID token and return (uid, email), or (None, None).
 
-    Returns None when Firestore/Auth isn't configured (local mode) so callers
-    can fall back to a client-supplied user_id.
+    Returns (None, None) when Firestore/Auth isn't configured (local mode) so
+    callers can fall back to a client-supplied user_id.
     """
     _init()
     if _backend != "firestore" or not id_token:
-        return None
+        return None, None
     try:
         from firebase_admin import auth
 
-        return auth.verify_id_token(id_token).get("uid")
+        decoded = auth.verify_id_token(id_token)
+        return decoded.get("uid"), decoded.get("email")
     except Exception:
-        return None
+        return None, None
 
 
 # ---------------------------------------------------------------------------