Update main.py

main.py

@@ -181,10 +181,6 @@ def send_rotation_notification(job_id, shift_record):
     except Exception as e:
         logger.error(f"Error sending rotation notification for job {job_id}: {e}")
 
-# === Auth Middleware ===
-# Add this import at the top if not already there
-# from firebase_admin import auth as firebase_auth # Already imported
-
 # === Auth Middleware ===
 def verify_token(req):
     """
@@ -192,8 +188,12 @@ def verify_token(req):
     Automatically creates admin entry in DB if email is in ADMIN_EMAILS but UID is not found.
     Returns decoded token dict if valid admin, None otherwise.
     """
+    # Use the logger instance created in your full script
+    logger = logging.getLogger('guards_api')
+
     auth_header = req.headers.get("Authorization")
     if not auth_header:
+        logger.warning("Authorization header missing.")
         return None
 
     try:
@@ -205,10 +205,12 @@ def verify_token(req):
 
         # Verify the token
         decoded = firebase_auth.verify_id_token(token)
+        logger.debug(f"Token verified successfully. Decoded token keys: {list(decoded.keys())}")
 
         # Get user UID and email from decoded token
         uid = decoded.get('uid')
-        email = decoded.get('email')  # Firebase ID tokens usually contain the email
+        email = decoded.get('email') # This should be present in the token
+        logger.debug(f"Extracted UID: {uid}, Email: {email}")
 
         if not uid:
             logger.error("Verified token does not contain a UID.")
@@ -217,10 +219,11 @@ def verify_token(req):
         # Check if user is admin by querying Firebase Realtime Database using UID
         admins_ref = db.reference("/admins")
         admin_data = admins_ref.child(uid).get()
+        logger.debug(f"Admin data retrieved for UID {uid}: {admin_data}")
 
         if admin_data and admin_data.get("is_admin", False):
             # User is already an admin in the database
-            logger.info(f"User {uid} ({email}) is authorized as admin.")
+            logger.info(f"User {uid} ({email}) is authorized as admin (found in DB).")
             return decoded
 
         elif email and email in ADMIN_EMAILS:
@@ -228,18 +231,25 @@ def verify_token(req):
             # This is likely their first time accessing the API.
             # Automatically create their admin entry using their UID.
             logger.info(f"First time admin access for {email} (UID: {uid}). Creating database entry.")
-            admins_ref.child(uid).set({
-                "email": email,
-                "is_admin": True,
-                "first_seen": datetime.datetime.utcnow().isoformat() + 'Z'  # UTC Timestamp
-            })
-            logger.info(f"Admin entry created for UID {uid}.")
-            # Return the decoded token as they are now an admin
-            return decoded
+            try:
+                admins_ref.child(uid).set({
+                    "email": email,
+                    "is_admin": True
+                    # Removed first_seen to keep it simple like original, add back if needed
+                })
+                logger.info(f"Admin entry created for UID {uid}.")
+                # Return the decoded token as they are now an admin
+                return decoded
+            except Exception as db_error:
+                logger.error(f"Failed to create admin entry for UID {uid} in database: {db_error}")
+                # Even if DB write fails, if they are in ADMIN_EMAILS, we could consider them authorized
+                # but it's safer to deny access if we can't record it.
+                # Alternatively: return decoded (less safe) or return None (safer)
+                return None
 
         else:
-            # User is not in the approved admin list
-            logger.warning(f"User {uid} ({email}) is not in the approved admin list or not found in DB.")
+            # User is not in the approved admin list or email not found in token
+            logger.warning(f"User {uid} ({email}) is not in the approved admin list or email not found.")
             return None
 
     except firebase_auth.InvalidIdTokenError as e:
@@ -252,10 +262,9 @@ def verify_token(req):
         logger.error(f"Firebase ID token has been revoked: {e}")
         return None
     except Exception as e:
-        logger.error(f"Unexpected error during token verification: {e}")
+        logger.error(f"Unexpected error during token verification: {e}", exc_info=True) # exc_info logs the full traceback
         return None
 
-
 # === Admin Setup (Legacy - kept for compatibility) ===
 def setup_admins():
     ref = db.reference("admins")