Update app.py

app.py

@@ -1,69 +1,83 @@
-from fastapi import FastAPI, HTTPException, status, Request
+from fastapi import FastAPI, HTTPException, Depends
 from fastapi.middleware.cors import CORSMiddleware
-from pydantic import BaseModel, EmailStr, constr
-import hashlib
-import os
-import certifi
+from fastapi.security import OAuth2PasswordRequestForm
+from pydantic import BaseModel
+from jose import JWTError, jwt
+from passlib.context import CryptContext
 from motor.motor_asyncio import AsyncIOMotorClient
+import certifi
+import os
+import datetime
 
-app = FastAPI()
-
-# === CORS Configuration ===
-app.add_middleware(
-    CORSMiddleware,
-    allow_origins=["*"],  # In production, replace with specific domains
-    allow_credentials=True,
-    allow_methods=["POST", "GET"],
-    allow_headers=["Authorization", "Content-Type"],
-)
+# ENV
+SECRET_KEY = os.getenv("SECRET_KEY", "your-secret-key")  # 🔐 Use HuggingFace secrets
+ALGORITHM = "HS256"
+ACCESS_TOKEN_EXPIRE_MINUTES = 30
 
-# === Secure MongoDB Setup ===
 MONGO_URI = os.getenv("MONGO_URI")
 if not MONGO_URI:
-    raise RuntimeError("Missing MONGO_URI in environment")
+    raise RuntimeError("MONGO_URI not set")
 
+# MongoDB
 client = AsyncIOMotorClient(MONGO_URI, tls=True, tlsCAFile=certifi.where())
 db = client["cps_db"]
-users_collection = db.get_collection("users")
+users_collection = db["users"]
 
-# === Utility: Strong Hashing ===
-def hash_password(password: str) -> str:
-    return hashlib.sha256(password.encode()).hexdigest()
+# App setup
+app = FastAPI()
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=["*"],  # Limit in production
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
 
-# === Pydantic Models with Validation ===
-class SignupForm(BaseModel):
-    email: EmailStr
-    password: constr(min_length=8)
+# Hashing
+pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
 
-class LoginForm(BaseModel):
-    email: EmailStr
-    password: str
+def verify_password(plain, hashed):
+    return pwd_context.verify(plain, hashed)
 
-# === Signup Endpoint ===
-@app.post("/signup", status_code=status.HTTP_201_CREATED)
-async def signup(data: SignupForm):
-    email = data.email.lower().strip()
-    hashed_password = hash_password(data.password)
+def hash_password(password):
+    return pwd_context.hash(password)
 
-    if await users_collection.find_one({"email": email}):
-        raise HTTPException(status_code=409, detail="Email already registered")
+# JWT utils
+def create_access_token(data: dict, expires_delta: datetime.timedelta = None):
+    to_encode = data.copy()
+    expire = datetime.datetime.utcnow() + (expires_delta or datetime.timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES))
+    to_encode.update({"exp": expire})
+    return jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)
 
-    await users_collection.insert_one({"email": email, "password": hashed_password})
-    return {"success": True, "message": "Account created successfully"}
+# Schemas
+class SignupForm(BaseModel):
+    email: str
+    password: str
 
-# === Login Endpoint ===
-@app.post("/login")
-async def login(data: LoginForm):
+class TokenResponse(BaseModel):
+    access_token: str
+    token_type: str
+
+# Routes
+@app.post("/signup")
+async def signup(data: SignupForm):
     email = data.email.lower().strip()
-    hashed_password = hash_password(data.password)
+    existing = await users_collection.find_one({"email": email})
+    if existing:
+        raise HTTPException(status_code=409, detail="Email already exists")
+    hashed_pw = hash_password(data.password)
+    await users_collection.insert_one({"email": email, "password": hashed_pw})
+    return {"success": True, "message": "Account created"}
 
-    user = await users_collection.find_one({"email": email, "password": hashed_password})
-    if not user:
-        raise HTTPException(status_code=401, detail="Invalid email or password")
+@app.post("/login", response_model=TokenResponse)
+async def login(form_data: OAuth2PasswordRequestForm = Depends()):
+    user = await users_collection.find_one({"email": form_data.username.lower().strip()})
+    if not user or not verify_password(form_data.password, user["password"]):
+        raise HTTPException(status_code=401, detail="Invalid credentials")
 
-    return {"success": True, "message": "Login successful"}
+    access_token = create_access_token(data={"sub": user["email"]})
+    return {"access_token": access_token, "token_type": "bearer"}
 
-# === Health Check ===
 @app.get("/")
-async def root():
-    return {"message": "✅ FastAPI MongoDB Auth API is live"}
+def root():
+    return {"message": "🛡️ Auth-secured FastAPI + MongoDB running"}