Simplify auth - remove middleware, keep session handling only

app/auth.py

@@ -1,50 +1,18 @@
 """
 Authentication module for Universal Model Trainer
 Provides password-based authentication with session management
+SIMPLIFIED VERSION - No middleware, direct session checks
 """
 
-from fastapi import HTTPException, Request, status
+from fastapi import HTTPException, Request, status, Depends
 from starlette.middleware.sessions import SessionMiddleware
 from starlette.responses import JSONResponse, HTMLResponse
-from starlette.types import ASGIApp, Receive, Scope, Send
-from itsdangerous import TimestampSigner, BadSignature
-import base64
-import json
 import secrets
-import time
-from typing import Optional, Callable
+from typing import Optional
 from app.config import settings
 
 
-def decode_session_cookie(cookie_value: str) -> dict:
-    """
-    Decode session cookie value to dictionary.
-    Must match Starlette's SessionMiddleware encoding exactly:
-    1. TimestampSigner signs the data
-    2. Data is base64 encoded JSON
-    """
-    if not cookie_value:
-        return {}
-    try:
-        # Create the same signer that SessionMiddleware uses
-        signer = TimestampSigner(
-            settings.SESSION_SECRET_KEY,
-            salt="cookie-session"
-        )
-        
-        # Unsign the cookie value
-        unsigned_value = signer.unsign(cookie_value)
-        
-        # Decode base64 and parse JSON
-        decoded = base64.urlsafe_b64decode(unsigned_value)
-        return json.loads(decoded)
-    except (BadSignature, Exception) as e:
-        # Log error for debugging but don't crash
-        print(f"Session decode error: {e}")
-        return {}
-
-
-def setup_auth(app: ASGIApp) -> None:
+def setup_auth(app) -> None:
     """Add session middleware to the FastAPI app"""
     app.add_middleware(
         SessionMiddleware,
@@ -59,13 +27,20 @@ def setup_auth(app: ASGIApp) -> None:
 def verify_password(password: str) -> bool:
     """Verify password against env variable using constant-time comparison"""
     if not settings.APP_PASSWORD:
-        # No password configured - allow access
-        return True
+        return True  # No password configured
     return secrets.compare_digest(password, settings.APP_PASSWORD)
 
 
-async def get_current_user(request: Request) -> Optional[dict]:
-    """Check if user is logged in via session"""
+def is_auth_enabled() -> bool:
+    """Check if authentication is enabled"""
+    return bool(settings.APP_PASSWORD)
+
+
+def get_current_user(request: Request) -> Optional[dict]:
+    """Get current user from session if authenticated"""
+    if not settings.APP_PASSWORD:
+        return {"authenticated": True, "username": "anonymous"}
+    
     user = request.session.get("user")
     if user and user.get("authenticated"):
         return user
@@ -73,12 +48,11 @@ async def get_current_user(request: Request) -> Optional[dict]:
 
 
 async def require_auth(request: Request) -> dict:
-    """Dependency that requires authentication"""
-    # If no password is configured, allow access
+    """Dependency that requires authentication - returns user or raises 401"""
     if not settings.APP_PASSWORD:
         return {"authenticated": True, "username": "anonymous"}
     
-    user = await get_current_user(request)
+    user = get_current_user(request)
     if not user:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
@@ -88,107 +62,6 @@ async def require_auth(request: Request) -> dict:
     return user
 
 
-class AuthMiddleware:
-    """
-    Middleware to protect all /api and dashboard routes
-    Allows public access to login, static files, and health checks
-    
-    IMPORTANT: This middleware decodes the session cookie directly because
-    SessionMiddleware hasn't run yet when this middleware executes.
-    Starlette middleware runs in REVERSE order - so AuthMiddleware (added first)
-    runs BEFORE SessionMiddleware (added second).
-    """
-    
-    # Paths that don't require authentication (exact match)
-    PUBLIC_PATHS = [
-        "/login",
-        "/api/auth/login",
-        "/api/auth/logout",
-        "/api/auth/check",
-        "/api/auth/status",
-        "/health",
-        "/favicon.ico",
-    ]
-    
-    # Path prefixes that don't require authentication
-    PUBLIC_PREFIXES = [
-        "/static/",
-    ]
-    
-    def __init__(self, app: ASGIApp):
-        self.app = app
-    
-    async def __call__(self, scope: Scope, receive: Receive, send: Send):
-        # Only handle HTTP requests
-        if scope["type"] != "http":
-            await self.app(scope, receive, send)
-            return
-        
-        path = scope["path"]
-        
-        # Check if auth is configured
-        if not settings.APP_PASSWORD:
-            await self.app(scope, receive, send)
-            return
-        
-        # Allow root path "/" - the dashboard handles its own auth check
-        if path == "/":
-            await self.app(scope, receive, send)
-            return
-        
-        # Allow public paths
-        if path in self.PUBLIC_PATHS:
-            await self.app(scope, receive, send)
-            return
-        
-        # Allow public prefixes
-        for prefix in self.PUBLIC_PREFIXES:
-            if path.startswith(prefix):
-                await self.app(scope, receive, send)
-                return
-        
-        # Check session cookie directly (SessionMiddleware hasn't run yet)
-        headers = dict(scope.get("headers", []))
-        cookie_header = headers.get(b"cookie", b"").decode("utf-8", errors="ignore")
-        
-        # Parse cookies
-        session_value = None
-        for cookie in cookie_header.split(";"):
-            cookie = cookie.strip()
-            if cookie.startswith("trainer_session="):
-                session_value = cookie.split("=", 1)[1] if "=" in cookie else None
-                break
-        
-        # Decode and check session
-        if session_value:
-            session = decode_session_cookie(session_value)
-            if session.get("user", {}).get("authenticated"):
-                await self.app(scope, receive, send)
-                return
-        
-        # Unauthorized - return appropriate response
-        accept = headers.get(b"accept", b"").decode("utf-8", errors="ignore")
-        
-        # Check if this is an API request or browser request
-        is_api_request = path.startswith("/api/") or "application/json" in accept
-        
-        if is_api_request and "text/html" not in accept:
-            # API request - return JSON error
-            response = JSONResponse(
-                {"detail": "Authentication required", "login_url": "/login"},
-                status_code=401
-            )
-        else:
-            # Browser request - redirect to login
-            response = HTMLResponse(
-                content='<script>window.location.href="/login";</script>',
-                status_code=302,
-                headers={"location": "/login"}
-            )
-        
-        await response(scope, receive, send)
-
-
 def is_authenticated(request: Request) -> bool:
     """Check if request is authenticated (helper for templates)"""
     if not settings.APP_PASSWORD:
@@ -378,4 +251,4 @@ def get_login_html(error: str = None) -> str:
         document.getElementById('password').focus();
     </script>
 </body>
-</html>'''
+</html>'''