Deploy: backend updates

.env

@@ -0,0 +1,8 @@
+# .env — local development only (do NOT commit to git)
+# Place this file next to verification.py
+
+DB_USER=admin
+DB_PASSWORD=Pykara123
+
+# Run once to create tables, then change to 0 or remove.
+RUN_INIT_DB=0

requirements.txt

@@ -3,4 +3,5 @@ flask-cors
 pyodbc
 bcrypt
 PyJWT
-gunicorn
+gunicorn
+python-dotenv

verification.py

@@ -1,57 +1,63 @@
-import pyodbc
-from flask import Flask, request, jsonify, make_response
-from flask_cors import CORS 
-import jwt
-import datetime
-import bcrypt
-from functools import wraps  # Import wraps for decorators
-import pdb
-import os  # add this
-
-app = Flask(__name__)
-# CORS(app,
-#      supports_credentials=True,
-#      resources={r"/*": {"origins": "http://localhost:4200"}})
+# --- load .env FIRST ---
+import os
+from dotenv import load_dotenv
 
+BASEDIR = os.path.abspath(os.path.dirname(__file__))
+load_dotenv(os.path.join(BASEDIR, ".env"))  # loads DB_USER, DB_PASSWORD, RUN_INIT_DB
 
 
-CORS(app, supports_credentials=True, origins=["http://localhost:4200"])
+# import os
+import logging
+from threading import Lock
+from functools import wraps
+import datetime
+import bcrypt
+import jwt
+import pyodbc
+from flask import Flask, request, jsonify, make_response
+from flask_cors import CORS
 
-# CORS(app, supports_credentials=True, origins=["http://localhost:4200"])
-# CORS(app, supports_credentials=True)  # Enable CORS with credentials
+# ------------------------------------------------------------------------------
+# App & CORS
+# ------------------------------------------------------------------------------
+app = Flask(__name__)
+CORS(app, supports_credentials=True, origins=["http://localhost:4200"])  # add your prod origins later
 app.config['SECRET_KEY'] = '96c63da06374c1bde332516f3acbd23c84f35f90d8a6321a25d790a0a451af32'
 
-# ✅ Configure SQL Server Connection (Windows Authentication)
-DB_SERVER   = "pykara-sqlserver.c5aosm6ie5j3.eu-north-1.rds.amazonaws.com,1433"
+# Optional: cleaner logs on Spaces / local
+logging.basicConfig(level=logging.INFO)
+
+# ------------------------------------------------------------------------------
+# SQL Server configuration
+# ------------------------------------------------------------------------------
+DB_SERVER = "pykara-sqlserver.c5aosm6ie5j3.eu-north-1.rds.amazonaws.com,1433"
 DB_DATABASE = "AuthenticationDB1"
 
-# ✅ Create Connection String for Windows Authentication
-# conn_str = f"DRIVER={{SQL Server}};SERVER={DB_SERVER};DATABASE={DB_DATABASE};Trusted_Connection=yes"
-# Use Windows Authentication only for local SQLEXPRESS; otherwise use SQL login from environment
 if DB_SERVER.lower().startswith("localhost") or "\\" in DB_SERVER:
-    # Local dev: Windows Authentication
-    conn_str = f"DRIVER={{SQL Server}};SERVER={DB_SERVER};DATABASE={DB_DATABASE};Trusted_Connection=yes"
+    # Local Windows SQL Express with integrated auth
+    CONN_STR = f"DRIVER={{SQL Server}};SERVER={DB_SERVER};DATABASE={DB_DATABASE};Trusted_Connection=yes"
 else:
-    # RDS: SQL authentication (no hard-coding; read from env)
-    conn_str = (
+    # RDS / SQL login via env secrets
+    CONN_STR = (
         "DRIVER={ODBC Driver 17 for SQL Server};"
         f"SERVER={DB_SERVER};DATABASE={DB_DATABASE};"
         f"UID={os.getenv('DB_USER')};PWD={os.getenv('DB_PASSWORD')};"
         "Encrypt=yes;TrustServerCertificate=yes"
     )
 
-
-# ✅ Function to Connect to SQL Server
 def get_db_connection():
-    return pyodbc.connect(conn_str)
+    """Create a short-timeout connection. Fail clearly if secrets are missing."""
+    if "Trusted_Connection=yes" not in CONN_STR:
+        if not os.getenv("DB_USER") or not os.getenv("DB_PASSWORD"):
+            raise RuntimeError("DB_USER/DB_PASSWORD are not set in the environment.")
+    return pyodbc.connect(CONN_STR, timeout=5)
 
-# ✅ Initialize the database (Create required tables if they do not exist)
 def init_db():
+    """Create tables if they do not exist."""
     conn = get_db_connection()
-    cursor = conn.cursor()
+    cur = conn.cursor()
 
-    # ✅ Create Users Table
-    cursor.execute("""
+    cur.execute("""
         IF OBJECT_ID('Users', 'U') IS NULL
         CREATE TABLE Users (
             id INT IDENTITY(1,1) PRIMARY KEY,
@@ -61,8 +67,7 @@ def init_db():
         )
     """)
 
-    # ✅ Create Blacklisted Tokens Table (For Logout)
-    cursor.execute("""
+    cur.execute("""
         IF OBJECT_ID('BlacklistedTokens', 'U') IS NULL
         CREATE TABLE BlacklistedTokens (
             id INT IDENTITY(1,1) PRIMARY KEY,
@@ -71,8 +76,7 @@ def init_db():
         )
     """)
 
-    # ✅ Create Refresh Tokens Table (For Secure Token Refresh)
-    cursor.execute("""
+    cur.execute("""
         IF OBJECT_ID('RefreshTokens', 'U') IS NULL
         CREATE TABLE RefreshTokens (
             id INT IDENTITY(1,1) PRIMARY KEY,
@@ -86,30 +90,53 @@ def init_db():
     conn.commit()
     conn.close()
 
-# ✅ Initialize Database (Call once when Flask starts)
-init_db()
-
-# ✅ Implement token verification function
+# ------------------------------------------------------------------------------
+# One-time DB initialisation (Flask 3.x safe)
+# ------------------------------------------------------------------------------
+_db_init_done = False
+_db_init_lock = Lock()
+_should_init = os.getenv("RUN_INIT_DB", "0") == "1"
+
+@app.before_request
+def maybe_init_db():
+    global _db_init_done
+    if _should_init and not _db_init_done:
+        with _db_init_lock:
+            if not _db_init_done:
+                try:
+                    init_db()
+                    app.logger.info("Database initialised.")
+                except Exception as e:
+                    app.logger.exception("DB init failed: %s", e)
+                finally:
+                    _db_init_done = True
+
+# ------------------------------------------------------------------------------
+# Health endpoint (helps confirm worker booted)
+# ------------------------------------------------------------------------------
+@app.get("/")
+def health():
+    return {"status": "ok"}, 200
+
+# ------------------------------------------------------------------------------
+# Auth utilities
+# ------------------------------------------------------------------------------
 def token_required(f):
     @wraps(f)
     def decorated(*args, **kwargs):
-        print("🔐 Accessing protected route:", request.path)
-        print("🍪 Cookies received:", request.cookies)
-        token = request.cookies.get('access_token')  # Access token from cookies
-
+        token = request.cookies.get('access_token')
         if not token:
             return jsonify({"message": "Token is missing"}), 401
 
         try:
-            # ✅ Check if token is blacklisted in SQL Server
+            # Check blacklist
             conn = get_db_connection()
-            cursor = conn.cursor()
-            cursor.execute("SELECT token FROM BlacklistedTokens WHERE token = ?", (token,))
-            result = cursor.fetchone()
-            conn.close()
-
-            if result:
+            cur = conn.cursor()
+            cur.execute("SELECT token FROM BlacklistedTokens WHERE token = ?", (token,))
+            if cur.fetchone():
+                conn.close()
                 return jsonify({"message": "Token has been revoked. Please log in again."}), 401
+            conn.close()
 
             data = jwt.decode(token, app.config['SECRET_KEY'], algorithms=["HS256"])
             return f(data['username'], *args, **kwargs)
@@ -118,85 +145,74 @@ def token_required(f):
             return jsonify({"message": "Token has expired"}), 401
         except jwt.InvalidTokenError:
             return jsonify({"message": "Invalid token"}), 401
-
+        except Exception as e:
+            app.logger.exception("Auth error: %s", e)
+            return jsonify({"message": "Server error"}), 500
     return decorated
 
-# ✅ Protected route: Dashboard
-@app.route('/dashboard', methods=['GET'])
+# ------------------------------------------------------------------------------
+# Routes
+# ------------------------------------------------------------------------------
+@app.get("/dashboard")
 @token_required
 def dashboard(username):
     return jsonify({"message": f"Welcome {username} to your dashboard!"})
 
-
-
-# ✅ Login: Generate Access & Refresh Tokens (Uses SQL Server for authentication)
-@app.route('/login', methods=['POST'])
+@app.post("/login")
 def login():
-    print("Login Request works")
-    data = request.json
+    data = request.json or {}
     username = data.get('username')
     password = data.get('password')
 
-    conn = get_db_connection()
-    cursor = conn.cursor()
-    
-    # ✅ Retrieve user from SQL Server
-    cursor.execute("SELECT password_hash FROM Users WHERE username = ?", (username,))
-    user = cursor.fetchone()
-    
-    conn.close()
+    try:
+        conn = get_db_connection()
+        cur = conn.cursor()
+        cur.execute("SELECT password_hash FROM Users WHERE username = ?", (username,))
+        row = cur.fetchone()
+        conn.close()
+    except Exception as e:
+        app.logger.exception("DB access error on login: %s", e)
+        return jsonify({"message": "Database is unavailable"}), 503
 
-    if not user:
+    if not row:
         return jsonify({"message": "Invalid credentials"}), 401
 
-    stored_hashed_password = user[0]
-
-    if bcrypt.checkpw(password.encode('utf-8'), stored_hashed_password.encode('utf-8')):
-        # ✅ Generate Access Token (expires in 15 minutes)
-        access_token = jwt.encode(
-            {'username': username, 'exp': datetime.datetime.utcnow() + datetime.timedelta(minutes=15)},
-            app.config['SECRET_KEY'],
-            algorithm="HS256"
-        )
-        print(f"Generated Access Token: {access_token}")
-        # ✅ Generate Refresh Token (expires in 7 days)
-        refresh_token = jwt.encode(
-            {'username': username, 'exp': datetime.datetime.utcnow() + datetime.timedelta(days=7)},
-            app.config['SECRET_KEY'],
-            algorithm="HS256"
-        )
+    stored_hash = row[0]
+    if not bcrypt.checkpw(password.encode('utf-8'), stored_hash.encode('utf-8')):
+        return jsonify({"message": "Invalid credentials"}), 401
 
-       
-        print(f"Generated Refresh Token: {refresh_token}")
+    access_token = jwt.encode(
+        {'username': username, 'exp': datetime.datetime.utcnow() + datetime.timedelta(minutes=15)},
+        app.config['SECRET_KEY'],
+        algorithm="HS256"
+    )
+    refresh_token = jwt.encode(
+        {'username': username, 'exp': datetime.datetime.utcnow() + datetime.timedelta(days=7)},
+        app.config['SECRET_KEY'],
+        algorithm="HS256"
+    )
 
-        # ✅ Store refresh token in SQL Server
+    try:
         conn = get_db_connection()
-        cursor = conn.cursor()
-        cursor.execute("INSERT INTO RefreshTokens (username, token) VALUES (?, ?)", (username, refresh_token))
+        cur = conn.cursor()
+        cur.execute("INSERT INTO RefreshTokens (username, token) VALUES (?, ?)", (username, refresh_token))
         conn.commit()
         conn.close()
+    except Exception as e:
+        app.logger.exception("DB write error on login: %s", e)
+        return jsonify({"message": "Database is unavailable"}), 503
 
+    resp = make_response(jsonify({"message": "Login successful"}))
+    resp.set_cookie('access_token', access_token, httponly=True, secure=False, samesite='Lax', max_age=900)
+    resp.set_cookie('refresh_token', refresh_token, httponly=True, secure=False, samesite='Lax', max_age=7*24*60*60)
+    return resp
 
-        # Set the tokens in cookies
-        resp = make_response(jsonify({"message": "Login successful"}))
-        
-        resp.set_cookie('access_token', access_token, httponly=True, secure=False, samesite='Lax',  max_age=900)  # Adjusted secure flag for development (set to True for production)
-        resp.set_cookie('refresh_token', refresh_token, httponly=True, secure=False, samesite='Lax',  max_age=7*24*60*60 )  # Same adjustment for refresh token
-        print(f"Set Cookies: access_token={access_token}, refresh_token={refresh_token}")
-
-        
-        return resp
-    return jsonify({"message": "Invalid credentials"}), 401
-
-# ✅ Refresh Token: Get New Access Token
-@app.route('/refresh', methods=['POST'])
+@app.post("/refresh")
 def refresh():
     refresh_token = request.cookies.get("refresh_token")
-
     if not refresh_token:
         return jsonify({'message': 'Refresh token is missing'}), 400
 
-    # Step 1: Decode and verify expiration
     try:
         payload = jwt.decode(refresh_token, app.config['SECRET_KEY'], algorithms=["HS256"])
     except jwt.ExpiredSignatureError:
@@ -204,99 +220,71 @@ def refresh():
     except jwt.InvalidTokenError:
         return jsonify({'message': 'Invalid refresh token'}), 401
 
-    # Step 2: Check if the token exists in DB
-    conn = get_db_connection()
-    cursor = conn.cursor()
-    cursor.execute("SELECT username FROM RefreshTokens WHERE token = ?", (refresh_token,))
-    result = cursor.fetchone()
-    conn.close()
+    try:
+        conn = get_db_connection()
+        cur = conn.cursor()
+        cur.execute("SELECT username FROM RefreshTokens WHERE token = ?", (refresh_token,))
+        row = cur.fetchone()
+        conn.close()
+    except Exception as e:
+        app.logger.exception("DB access error on refresh: %s", e)
+        return jsonify({"message": "Database is unavailable"}), 503
 
-    if not result:
+    if not row:
         return jsonify({'message': 'Invalid refresh token'}), 401
 
-    username = result[0]
-
-    # Step 3: Generate new access token
-    new_access_token = jwt.encode(
+    username = row[0]
+    new_access = jwt.encode(
         {'username': username, 'exp': datetime.datetime.utcnow() + datetime.timedelta(minutes=15)},
         app.config['SECRET_KEY'],
         algorithm="HS256"
     )
 
-    resp = make_response(jsonify({'access_token': new_access_token}))
-    resp.set_cookie(
-        'access_token',
-        new_access_token,
-        httponly=True,
-        secure=False,
-        samesite='Lax',
-        max_age=900    # 15 minutes
-    )
-
+    resp = make_response(jsonify({'access_token': new_access}))
+    resp.set_cookie('access_token', new_access, httponly=True, secure=False, samesite='Lax', max_age=900)
     return resp
 
-
-
-
-@app.route('/logout', methods=['POST'])
+@app.post("/logout")
 @token_required
 def logout(username):
-    print("Logout Request works")
-    print("Incoming  Cookies:", request.cookies)
-
-    # ✅ Get the access token from cookies
     token = request.cookies.get('access_token')
-    print("Logout Request - Token received:", token)  
-
     if not token:
         return jsonify({"message": "Invalid token format"}), 401
 
     try:
-        print("Decoding token...")
-        # ✅ Decode the token manually to extract username
         data = jwt.decode(token, app.config['SECRET_KEY'], algorithms=["HS256"])
         username = data['username']
-        print(f"Token decoded successfully. Username: {username}, Expiry: {data['exp']}")
-
     except jwt.ExpiredSignatureError:
         return jsonify({"message": "Token has expired"}), 401
     except jwt.InvalidTokenError:
         return jsonify({"message": "Invalid token"}), 401
 
-    print(f"Blacklisting token: {token}")
-
-    # ✅ Store the revoked token in SQL Server **only if it's not already blacklisted**
-    conn = get_db_connection()
-    cursor = conn.cursor()
-
-    # Check if the token is already blacklisted
-    cursor.execute("SELECT token FROM BlacklistedTokens WHERE token = ?", (token,))
-    existing_token = cursor.fetchone()
-
-    if not existing_token:
-        cursor.execute("INSERT INTO BlacklistedTokens (token) VALUES (?)", (token,))
-    
-    # ✅ Remove refresh token for the user
-    cursor.execute("DELETE FROM RefreshTokens WHERE username = ?", (username,))
-
-    conn.commit()
-    conn.close()
+    try:
+        conn = get_db_connection()
+        cur = conn.cursor()
+        cur.execute("SELECT token FROM BlacklistedTokens WHERE token = ?", (token,))
+        if not cur.fetchone():
+            cur.execute("INSERT INTO BlacklistedTokens (token) VALUES (?)", (token,))
+        cur.execute("DELETE FROM RefreshTokens WHERE username = ?", (username,))
+        conn.commit()
+        conn.close()
+    except Exception as e:
+        app.logger.exception("DB write error on logout: %s", e)
+        return jsonify({"message": "Database is unavailable"}), 503
 
-    # ✅ Clear cookies
     resp = make_response(jsonify({"message": "Logged out successfully!"}))
     resp.delete_cookie('access_token', path='/')
     resp.delete_cookie('refresh_token', path='/')
-
     return resp
 
-@app.route('/check-auth', methods=['GET'])
+@app.get("/check-auth")
 @token_required
 def check_auth(username):
     return jsonify({"message": "Authenticated", "username": username}), 200
 
-
-
-
-
+# ------------------------------------------------------------------------------
+# Local run (Gunicorn will import `verification:app` on Spaces)
+# ------------------------------------------------------------------------------
 if __name__ == '__main__':
-    app.run(debug=True)
+    port = int(os.getenv("PORT", "5000"))
+    app.run(host="0.0.0.0", port=port, debug=True)