auth

Authentication utilities — JWT tokens, password hashing, cookie helpers, and auth middleware.

Follows the shared secrets-loading pattern from config.py. JWT secret is loaded from a .jwt_secret file in the project root, auto-generated on first use.

Database operations use Supabase PostgreSQL via database.py helpers.

clear_refresh_cookie(response)

Clear the refresh_token cookie by setting max_age=0.

create_access_token(user_id, secret, expires_delta=None)

Create a signed JWT access token (HS256).

decode_access_token(token, secret)

Decode and validate a JWT access token.

get_current_user(request) async

FastAPI dependency that extracts and validates the current user.

Token resolution order: Authorization header (Bearer), then the "access_token" cookie. The header is parsed directly from the request so this function is safe to call both through FastAPI dependency injection and directly from other code — the previous Depends(bearer_scheme) default left a raw Depends object in place when called directly, raising AttributeError on .credentials.

hash_password(password)

Hash a password with bcrypt and return the hash string.

Truncates the password to 72 bytes (bcrypt's maximum) before hashing. Each call generates a fresh salt.

require_admin(user=Depends(get_current_user)) async

Validate current user is an admin (FastAPI dependency).

Depends on get_current_user through FastAPI's dependency injection rather than calling it directly, so nested Depends defaults are always resolved.

set_refresh_cookie(response, refresh_token)

Set the refresh_token httpOnly cookie on the response.

verify_password(plain, hashed)

Verify a plain-text password against a bcrypt hash.

Truncates the plaintext to 72 bytes to match the hash_password truncation behavior.