Simplify mockup auth to use Supabase anon key only

README.md

@@ -30,8 +30,7 @@ Set these in your Hugging Face Space settings:
 
 - `GROQ_API_KEY`: required
 - `SUPABASE_URL`: required for auth/history
-- `SUPABASE_SERVICE_ROLE_KEY`: required for auth/history using `public.user`
-- `APP_AUTH_SECRET`: required for signing backend auth tokens
+- `SUPABASE_ANON_KEY`: required for auth/history in this mockup setup
 
 Optional variables:
 
@@ -42,7 +41,6 @@ Optional variables:
 - `UPLOAD_FOLDER=/tmp/agrogpt_uploads`
 - `SUPABASE_HISTORY_TABLE=chat_history`
 - `GROQ_TRANSCRIBE_MODEL=whisper-large-v3-turbo`
-- `AUTH_TOKEN_MAX_AGE_SECONDS=604800`
 
 ## Supabase Table (History)
 
@@ -55,7 +53,7 @@ Create a table named `chat_history` (or set `SUPABASE_HISTORY_TABLE`) with colum
 - `answer text`
 - `created_at timestamptz default now()`
 
-Auth endpoints in this backend use your existing `public.user` table (`email` + `password_hash`) and return a backend Bearer token.
+Auth endpoints in this backend use your existing `public.user` table (`email` + `password_hash`) and return a lightweight mockup Bearer token.
 
 ## Model Size Strategy
 

app.py

@@ -8,7 +8,6 @@ from flask_cors import CORS
 import threading
 from werkzeug.utils import secure_filename
 from werkzeug.security import generate_password_hash, check_password_hash
-from itsdangerous import URLSafeTimedSerializer, BadSignature, SignatureExpired
 import uuid
 
 # Import the new model functionality and prompts
@@ -29,14 +28,9 @@ app.config['MAX_CONTENT_LENGTH'] = 16 * 1024 * 1024  # 16MB max file size
 # Supabase and speech configuration
 SUPABASE_URL = os.getenv("SUPABASE_URL", "").rstrip("/")
 SUPABASE_ANON_KEY = os.getenv("SUPABASE_ANON_KEY", "")
-SUPABASE_SERVICE_ROLE_KEY = os.getenv("SUPABASE_SERVICE_ROLE_KEY", "")
 SUPABASE_HISTORY_TABLE = os.getenv("SUPABASE_HISTORY_TABLE", "chat_history")
 GROQ_API_KEY = os.getenv("GROQ_API_KEY", "")
 GROQ_TRANSCRIBE_MODEL = os.getenv("GROQ_TRANSCRIBE_MODEL", "whisper-large-v3-turbo")
-APP_AUTH_SECRET = os.getenv("APP_AUTH_SECRET", GROQ_API_KEY or "agrogpt-dev-secret")
-AUTH_TOKEN_MAX_AGE_SECONDS = int(os.getenv("AUTH_TOKEN_MAX_AGE_SECONDS", "604800"))
-
-token_serializer = URLSafeTimedSerializer(APP_AUTH_SECRET)
 
 # Create uploads directory if it doesn't exist
 os.makedirs(UPLOAD_FOLDER, exist_ok=True)
@@ -52,16 +46,12 @@ def allowed_audio_file(filename):
     return '.' in filename and filename.rsplit('.', 1)[1].lower() in ALLOWED_AUDIO_EXTENSIONS
 
 def supabase_enabled() -> bool:
-    return bool(SUPABASE_URL and (SUPABASE_ANON_KEY or SUPABASE_SERVICE_ROLE_KEY))
-
-def supabase_api_key() -> str:
-    return SUPABASE_SERVICE_ROLE_KEY or SUPABASE_ANON_KEY
+    return bool(SUPABASE_URL and SUPABASE_ANON_KEY)
 
 def supabase_headers() -> dict:
-    api_key = supabase_api_key()
     headers = {
-        "apikey": api_key,
-        "Authorization": f"Bearer {api_key}",
+        "apikey": SUPABASE_ANON_KEY,
+        "Authorization": f"Bearer {SUPABASE_ANON_KEY}",
         "Content-Type": "application/json"
     }
     return headers
@@ -73,20 +63,18 @@ def extract_bearer_token() -> str | None:
     return None
 
 def create_auth_token(user_row: dict) -> str:
-    return token_serializer.dumps({
-        "user_id": user_row["id"],
-        "email": user_row.get("email", "")
-    })
+    return f"user:{user_row['id']}"
 
 def decode_auth_token(token: str):
-    try:
-        payload = token_serializer.loads(token, max_age=AUTH_TOKEN_MAX_AGE_SECONDS)
-        return payload, None
-    except SignatureExpired:
-        return None, "Session expired"
-    except BadSignature:
+    if not token.startswith("user:"):
+        return None, "Invalid token"
+
+    user_id_raw = token.split(":", 1)[1].strip()
+    if not user_id_raw.isdigit():
         return None, "Invalid token"
 
+    return {"user_id": int(user_id_raw)}, None
+
 def sanitize_user(user_row: dict) -> dict:
     return {
         "id": user_row.get("id"),
@@ -425,7 +413,10 @@ def auth_signup_v1():
     try:
         res = requests.post(
             f"{SUPABASE_URL}/rest/v1/user",
-            headers=supabase_headers(),
+            headers={
+                **supabase_headers(),
+                "Prefer": "return=representation"
+            },
             params={
                 "select": "id,email,full_name,profession"
             },