Feature/auth gate api

[sal94]

What changed (by area)

• Auth domain: app/models/users.py, app/repositories/users.py, app/services/auth.py, app/security/{hashing.py,jwt.py,init.py}, app/schemas/auth.py.
  • Added User/UserToken tables, PBKDF2 password hashing, minimal HS256 JWT encode/decode, and service logic for signup/login issuing stored JTIs with expiry/version checks.
  • Migration: alembic/versions/7f4a0e6c50f9_add_users_and_tokens.py.
• API surface/routing: app/constants.py (API_PREFIX), app/main.py, app/api/deps.py, app/api/routers/{auth.py,health.py,albums.py,assets.py}, app/services/{albums.py,assets.py}, app/models/init.py.
  • All API routes now under /api. Albums/assets are protected via bearer dependency; auth endpoints + health are public. URLs emitted from services now point to /api/....
• Tests/fixtures: tests/conftest.py, tests/test_auth.py.
  • Clients now base at /api; fixture auto-signs up a user and injects Authorization header. New tests cover signup/login, duplicates, and protected-route rejection.
• Docs/env/deps: README.md (auth section and config note), .env note (auth keys), pyproject.toml/poetry.lock (email-validator dep).

Where to look for review

1. Security correctness:
   • app/security/jwt.py: homegrown HS256 JWT—check signature verification and payload handling.
   • app/security/hashing.py: PBKDF2 params and string format.
   • app/services/auth.py: token issuance/validation (exp/jti/version checks), error paths with WWW-Authenticate.
   • app/settings.py: JWT secret/env validation.
2. Data model/migration:
   • app/models/users.py & migration: timezone-aware expires_at/revoked_at, uniqueness on email/jti.
3. API surface changes:
   • app/main.py, app/api/deps.py, app/api/routers/*: /api prefix, which routes are public vs. protected, health path.
   • Service URL generation (app/services/{albums,assets}.py): new /api/... URLs.
4. Tests/fixtures:
   • tests/conftest.py: auth-enabled client fixture; make sure it doesn’t mask auth bugs.
   • tests/test_auth.py: coverage of signup/login/401s.
5. Docs:
   • README.md: auth flow summary and next steps; confirms /api routing.

[chatgpt-codex-connector]

💡 Codex Review

throwbackmemo/.github/workflows/ci.yml

Lines 120 to 124 in de30519

	- name: Prepare env file to send to server
	run: |
	cat <<EOF > .env
	APP_ENV=${APP_ENV}
	LOG_LEVEL=${{ vars.LOG_LEVEL || 'info' }}

Include AUTH_SECRET_KEY in deploy env

The deploy workflow writes the production .env used by docker compose, but this block (lines 120-124) only includes DB/Redis/S3 values and never sets AUTH_SECRET_KEY. app/settings.py now raises a ValueError when APP_ENV=production and the JWT secret is missing (lines 92-99), so a push to main will produce an env file that causes the migrate/api/worker containers to crash before start-up. Add the secret to the generated env file so production deployments can boot.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".