blink

dependencies.py

@@ -1,6 +1,6 @@
 import logging
 from datetime import datetime, timedelta
-from typing import Optional, Tuple
+from typing import Optional, Tuple, Union
 import ipaddress
 import httpx
 from fastapi import Request, Depends, HTTPException, status
@@ -149,6 +149,56 @@ async def get_current_user(
     return user
 
 
+async def get_optional_user(
+    req: Request,
+    db: AsyncSession = Depends(get_db)
+) -> Optional[User]:
+    """
+    Attempt to extract and verify JWT from Authorization header.
+    Returns the authenticated user if valid, or None if not authenticated.
+    
+    Unlike get_current_user, this does NOT raise errors for missing/invalid tokens.
+    Useful for endpoints that work for both authenticated and anonymous users.
+    
+    Usage:
+        @router.get("/optional-auth")
+        async def optional_auth_route(user: Optional[User] = Depends(get_optional_user)):
+            if user:
+                return {"user_id": user.user_id}
+            return {"message": "anonymous"}
+    """
+    auth_header = req.headers.get("Authorization")
+    
+    if not auth_header or not auth_header.startswith("Bearer "):
+        return None
+    
+    token = auth_header.split(" ", 1)[1]
+    
+    try:
+        payload = verify_access_token(token)
+    except (TokenExpiredError, InvalidTokenError, JWTError) as e:
+        logger.debug(f"Optional auth failed: {e}")
+        return None
+    
+    # Get user from DB
+    query = select(User).where(
+        User.user_id == payload.user_id,
+        User.is_active == True
+    )
+    result = await db.execute(query)
+    user = result.scalar_one_or_none()
+    
+    if not user:
+        return None
+    
+    # Validate token version
+    if payload.token_version < user.token_version:
+        logger.debug(f"Token invalidated for user {user.user_id}")
+        return None
+    
+    return user
+
+
 async def verify_credits(
     user: User = Depends(get_current_user),
     db: AsyncSession = Depends(get_db)

routers/blink.py

@@ -12,7 +12,7 @@ import logging
 from core.database import get_db
 from core.models import User, AuditLog, GeminiJob, Contact, ClientUser
 from services.encryption_service import decrypt_multiple_blocks
-from dependencies import get_geolocation
+from dependencies import get_geolocation, get_optional_user
 
 logger = logging.getLogger(__name__)
 
@@ -430,11 +430,19 @@ async def get_contacts(
 async def blink(
     request: Request,
     userid: str = Query(..., description="User ID (20 chars) + encrypted data"),
-    db: AsyncSession = Depends(get_db)
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(get_optional_user)
 ):
     """
     Process blink request with encrypted user data.
     Logs to AuditLog with log_type='client'.
+    
+    If authenticated via JWT:
+    - Creates a new ClientUser entry linking client_user_id to server user_id
+    - Sets user_id in AuditLog entries
+    
+    If not authenticated:
+    - Creates AuditLog entries with user_id=None (anonymous)
     """
     try:
         # Validate minimum length
@@ -471,9 +479,37 @@ async def blink(
         else:
             ip_address = request.client.host if request.client else None
         
+        # Determine IPv4/IPv6
+        ipv4_address = None
+        ipv6_address = None
+        if ip_address:
+            try:
+                ip_obj = ipaddress.ip_address(ip_address)
+                if ip_obj.version == 4:
+                    ipv4_address = ip_address
+                else:
+                    ipv6_address = ip_address
+            except ValueError:
+                pass  # Invalid IP, leave both as None
+        
         # Get geolocation from IP address
         country, region = await get_geolocation(ip_address)
         
+        # Determine server user_id (if authenticated)
+        server_user_id = current_user.user_id if current_user else None
+        
+        # If authenticated, always create a new ClientUser entry
+        if current_user:
+            new_client_user = ClientUser(
+                user_id=current_user.user_id,
+                client_user_id=client_user_id,
+                ipv4_address=ipv4_address,
+                ipv6_address=ipv6_address,
+                device_info={"user_agent": user_agent} if user_agent else None
+            )
+            db.add(new_client_user)
+            logger.info(f"Created ClientUser entry: user_id={current_user.user_id}, client_user_id={client_user_id}")
+        
         # Store each decrypted result as separate audit log entries
         records_created = 0
         for json_data in decrypted_results:
@@ -486,7 +522,7 @@ async def blink(
             
             audit_log = AuditLog(
                 log_type="client",
-                user_id=None,  # Anonymous until linked
+                user_id=server_user_id,  # Set if authenticated, None if anonymous
                 client_user_id=client_user_id,
                 action="blink",
                 details=details,
@@ -502,7 +538,7 @@ async def blink(
         if not decrypted_results and encrypted_data:
             audit_log = AuditLog(
                 log_type="client",
-                user_id=None,
+                user_id=server_user_id,  # Set if authenticated, None if anonymous
                 client_user_id=client_user_id,
                 action="blink",
                 details={"encrypted_length": len(encrypted_data), "country": country, "region": region},
@@ -516,16 +552,11 @@ async def blink(
         
         await db.commit()
         
-        logger.info(f"Successfully processed blink for client: {client_user_id}, records: {records_created}")
+        auth_status = "authenticated" if current_user else "anonymous"
+        logger.info(f"Successfully processed blink for client: {client_user_id}, records: {records_created}, auth: {auth_status}")
         
-        return JSONResponse(
-            status_code=status.HTTP_200_OK,
-            content={
-                "status": "success",
-                "client_user_id": client_user_id,
-                "records_created": records_created
-            }
-        )
+        # Return 204 No Content for silent tracking
+        return JSONResponse(status_code=status.HTTP_204_NO_CONTENT, content=None)
         
     except HTTPException:
         raise
@@ -536,3 +567,4 @@ async def blink(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
             detail="Internal server error processing request"
         )
+