'code'

requirements.txt

@@ -1,7 +1,7 @@
 alembic>=1.17.2
 fastapi>=0.124.4
 passlib[bcrypt]==1.7.4
-bcrypt==4.2.1
+bcrypt==4.0.1
 psycopg2-binary>=2.9.11
 pydantic-settings>=2.12.0
 pydantic[email]>=2.12.5

src/utils/deps.py

@@ -11,16 +11,27 @@ def get_current_user(
     request: Request,
     session: Session = Depends(get_session_dep)
 ) -> User:
-    """Dependency to get the current authenticated user from JWT token in cookie."""
-    # Debug: Print all cookies
-    print(f"All cookies received: {request.cookies}")
-    
-    # Get the token from the cookie
+    """Dependency to get the current authenticated user from JWT token in cookie or Authorization header.
+
+    This accepts the token from either:
+      - an HttpOnly cookie named `access_token` (cookie-based flows)
+      - an Authorization Bearer header (e.g. `Authorization: Bearer <token>`) — helpful for cross-site frontends
+    """
+    # Debug: Print all cookies (do not print token values)
+    print(f"All cookies received: { {k: '***' for k in request.cookies.keys()} }")
+
+    # Try cookie first (usual flow when cookies are allowed)
     token = request.cookies.get("access_token")
-    print(f"Access token from cookie: {token}")
-    
+
+    # If no cookie token, fall back to Authorization header
     if not token:
-        print("No access token found in cookies")
+        auth_header = request.headers.get("Authorization") or request.headers.get("authorization")
+        if auth_header and auth_header.lower().startswith("bearer "):
+            token = auth_header.split(" ", 1)[1]
+            print("Using Bearer token from Authorization header")
+
+    if not token:
+        print("No access token found in cookies or Authorization header")
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="Not authenticated",
@@ -29,7 +40,7 @@ def get_current_user(
 
     user_id = verify_user_id_from_token(token)
     print(f"User ID from token: {user_id}")
-    
+
     if not user_id:
         print("Invalid user ID from token")
         raise HTTPException(
@@ -40,7 +51,7 @@ def get_current_user(
 
     user = session.get(User, user_id)
     print(f"User from database: {user}")
-    
+
     if not user:
         print("User not found in database")
         raise HTTPException(