Update main.py

main.py

@@ -181,70 +181,82 @@ def send_rotation_notification(job_id, shift_record):
     except Exception as e:
         logger.error(f"Error sending rotation notification for job {job_id}: {e}")
 
+# === Auth Middleware ===
+# Add this import at the top if not already there
+# from firebase_admin import auth as firebase_auth # Already imported
+
 # === Auth Middleware ===
 def verify_token(req):
     """
     Verify Firebase ID token and check if user is admin.
+    Automatically creates admin entry in DB if email is in ADMIN_EMAILS but UID is not found.
     Returns decoded token dict if valid admin, None otherwise.
     """
     auth_header = req.headers.get("Authorization")
-    logger.debug(f"Verifying token for request to {req.path}. Authorization header present: {bool(auth_header)}")
-
     if not auth_header:
-        logger.warning("Authorization header missing.")
         return None
 
     try:
         # Extract token
         if auth_header.startswith("Bearer "):
             token = auth_header[7:].strip()
-            logger.debug("Bearer prefix found in Authorization header.")
         else:
             token = auth_header.strip()
-            logger.debug("No Bearer prefix found, using header as token.")
-
-        if not token:
-             logger.warning("Authorization header is empty or only whitespace.")
-             return None
 
-        logger.debug("Attempting to verify Firebase ID token...")
         # Verify the token
         decoded = firebase_auth.verify_id_token(token)
-        logger.debug(f"Token verified successfully. Decoded token UID: {decoded.get('uid')}")
-
-        # Get user UID from decoded token
+        
+        # Get user UID and email from decoded token
         uid = decoded.get('uid')
+        email = decoded.get('email') # Firebase ID tokens usually contain the email
+        
         if not uid:
-            logger.warning("Verified token does not contain a UID.")
+            print("Verified token does not contain a UID.")
             return None
 
-        logger.debug(f"Checking admin status for UID: {uid}")
-        # Check if user is admin by querying Firebase Realtime Database
+        # Check if user is admin by querying Firebase Realtime Database using UID
         admins_ref = db.reference("/admins")
         admin_data = admins_ref.child(uid).get()
-        logger.debug(f"Admin data retrieved for UID {uid}: {admin_data}")
 
         if admin_data and admin_data.get("is_admin", False):
-            logger.info(f"User {uid} ({admin_data.get('email', 'Unknown Email')}) is authorized as admin.")
+            # User is already an admin in the database
+            return decoded
+        elif email and email in ADMIN_EMAILS:
+            # User's email is in the approved list, but UID not found in DB.
+            # This is likely their first time accessing the API.
+            # Automatically create their admin entry using their UID.
+            print(f"First time admin access for {email} (UID: {uid}). Creating database entry.")
+            admins_ref.child(uid).set({
+                "email": email,
+                "is_admin": True,
+                "first_seen": datetime.datetime.utcnow().isoformat() + 'Z' # UTC Timestamp
+            })
+            print(f"Admin entry created for UID {uid}.")
+            # Return the decoded token as they are now an admin
             return decoded
         else:
-            logger.warning(f"User {uid} is not an admin or admin data not found.")
+            # User is not in the approved admin list
+            print(f"User {uid} ({email}) is not in the approved admin list or not found in DB.")
             return None
-
+            
     except firebase_auth.InvalidIdTokenError as e:
-        logger.error(f"Invalid Firebase ID token provided: {e}")
+        print(f"Invalid Firebase ID token provided: {e}")
         return None
     except firebase_auth.ExpiredIdTokenError as e:
-        logger.error(f"Firebase ID token has expired: {e}")
+        print(f"Firebase ID token has expired: {e}")
         return None
     except firebase_auth.RevokedIdTokenError as e:
-        logger.error(f"Firebase ID token has been revoked: {e}")
+        print(f"Firebase ID token has been revoked: {e}")
         return None
     except Exception as e:
-        logger.error(f"Unexpected error during token verification: {e}", exc_info=True) # exc_info logs the full traceback
+        print(f"Unexpected error during token verification: {e}")
+        # Consider logging the full traceback in production
+        # import traceback
+        # print(traceback.format_exc())
         return None
 
 
+
 # === Admin Setup (Legacy - kept for compatibility) ===
 def setup_admins():
     ref = db.reference("admins")