Merge pull request #3 from DevanshuNEU/feat/supabase-auth

Feat/supabase auth

Author: DevanshuNEU

.env.example

@@ -13,7 +13,8 @@ PINECONE_INDEX_NAME=codeintel
 # Supabase (Required)
 # Get from: https://app.supabase.com/project/_/settings/api
 SUPABASE_URL=https://your-project.supabase.co
-SUPABASE_KEY=eyJ...
+SUPABASE_ANON_KEY=eyJ...
+SUPABASE_JWT_SECRET=your-jwt-secret  # From Project Settings → API → JWT Secret
 
 # Backend API
 API_KEY=change-this-secret-key-for-production

backend/.env.example

@@ -5,7 +5,8 @@ PINECONE_INDEX_NAME=codeintel
 
 # Supabase
 SUPABASE_URL=https://your-project.supabase.co
-SUPABASE_KEY=your_supabase_anon_key_here
+SUPABASE_ANON_KEY=your_supabase_anon_key_here
+SUPABASE_JWT_SECRET=your_jwt_secret_here
 
 # Backend API
 BACKEND_API_URL=http://localhost:8000

backend/main.py

@@ -2,7 +2,7 @@
 CodeIntel Backend API
 FastAPI backend for codebase intelligence
 """
-from fastapi import FastAPI, HTTPException, Header, WebSocket, WebSocketDisconnect
+from fastapi import FastAPI, HTTPException, Header, WebSocket, WebSocketDisconnect, Depends
 from fastapi.middleware.cors import CORSMiddleware
 from pydantic import BaseModel
 from typing import Optional, List
@@ -25,12 +25,19 @@
 from services.supabase_service import get_supabase_service
 from services.input_validator import InputValidator, CostController
 
+# Import routers
+from routes.auth import router as auth_router
+from middleware.auth import get_current_user
+
 app = FastAPI(
     title="CodeIntel API",
     description="Codebase Intelligence API for MCP",
     version="0.2.0"
 )
 
+# Include routers
+app.include_router(auth_router)
+
 # CORS middleware
 app.add_middleware(
     CORSMiddleware,
@@ -135,21 +142,23 @@ async def health_check():
 
 
 @app.get("/api/repos")
-async def list_repositories(api_key: str = Header(None, alias="Authorization")):
-    """List all repositories"""
-    verify_api_key(api_key)
+async def list_repositories(current_user: dict = Depends(get_current_user)):
+    """List all repositories for authenticated user"""
+    user_id = current_user["user_id"]
 
+    # TODO: Filter repos by user_id once we add user_id column to repositories table
+    # For now, return all repos (will fix in next section)
     repos = repo_manager.list_repos()
     return {"repositories": repos}
 
 
 @app.post("/api/repos")
 async def add_repository(
     request: AddRepoRequest,
-    api_key: str = Header(None, alias="Authorization")
+    current_user: dict = Depends(get_current_user)
 ):
     """Add a new repository with validation and cost controls"""
-    key_data = verify_api_key(api_key)
+    user_id = current_user["user_id"]
 
     # Validate repository name
     valid_name, name_error = InputValidator.validate_repo_name(request.name)
@@ -162,10 +171,9 @@ async def add_repository(
         raise HTTPException(status_code=400, detail=f"Invalid Git URL: {url_error}")
 
     # Check repository limit
-    user_id = key_data.get("user_id")
-    api_key_hash = hashlib.sha256(api_key.replace("Bearer ", "").encode()).hexdigest()
+    user_id_hash = hashlib.sha256(user_id.encode()).hexdigest()
 
-    can_add, limit_error = cost_controller.check_repo_limit(user_id, api_key_hash)
+    can_add, limit_error = cost_controller.check_repo_limit(user_id, user_id_hash)
     if not can_add:
         raise HTTPException(status_code=429, detail=limit_error)
 
@@ -175,7 +183,7 @@ async def add_repository(
             git_url=request.git_url,
             branch=request.branch,
             user_id=user_id,
-            api_key_hash=api_key_hash
+            api_key_hash=user_id_hash
         )
 
         # Check repo size before allowing indexing

backend/middleware/__init__.py

@@ -0,0 +1,4 @@
+"""Authentication middleware package"""
+from .auth import get_current_user, get_optional_user
+
+__all__ = ["get_current_user", "get_optional_user"]

backend/middleware/auth.py

@@ -0,0 +1,56 @@
+"""
+Authentication Middleware
+Protects routes requiring authentication
+"""
+from fastapi import Depends, HTTPException, status
+from fastapi.security import HTTPBearer
+from fastapi.security.http import HTTPAuthorizationCredentials
+from typing import Dict, Any, Optional
+from services.auth import get_auth_service
+
+# HTTP Bearer token scheme
+security = HTTPBearer()
+
+
+async def get_current_user(
+    credentials: HTTPAuthorizationCredentials = Depends(security)
+) -> Dict[str, Any]:
+    """
+    Dependency to get current authenticated user from JWT token
+    
+    Usage:
+        @app.get("/protected")
+        async def protected_route(user: Dict = Depends(get_current_user)):
+            return {"user_id": user["user_id"]}
+    
+    Returns:
+        Dict with user_id, email, and metadata
+        
+    Raises:
+        HTTPException: 401 if token invalid
+    """
+    auth_service = get_auth_service()
+    return auth_service.verify_jwt(credentials.credentials)
+
+
+async def get_optional_user(
+    credentials: Optional[HTTPAuthorizationCredentials] = Depends(HTTPBearer(auto_error=False))
+) -> Optional[Dict[str, Any]]:
+    """
+    Optional authentication - returns None if no token provided
+    
+    Usage:
+        @app.get("/optional-auth")
+        async def route(user: Optional[Dict] = Depends(get_optional_user)):
+            if user:
+                return {"message": f"Hello {user['email']}"}
+            return {"message": "Hello guest"}
+    """
+    if not credentials:
+        return None
+    
+    try:
+        auth_service = get_auth_service()
+        return auth_service.verify_jwt(credentials.credentials)
+    except:
+        return None

backend/requirements.txt

@@ -5,6 +5,7 @@ httpx>=0.27.0
 python-dotenv>=1.0.0
 pydantic>=2.0.0
 pydantic-settings>=2.0.0
+email-validator>=2.0.0  # Required for EmailStr validation
 
 # WebSocket support
 websockets>=13.0
@@ -29,6 +30,7 @@ aiofiles>=24.0.0
 
 # Supabase (postgrest-py handled as dependency)
 supabase>=2.0.0
+pyjwt>=2.8.0  # JWT token verification for Supabase Auth
 
 # Testing
 pytest>=8.0.0

backend/routes/__init__.py

@@ -0,0 +1,4 @@
+"""API Routes package"""
+from .auth import router as auth_router
+
+__all__ = ["auth_router"]

backend/routes/auth.py

@@ -0,0 +1,106 @@
+"""
+Authentication Routes
+Handles user signup, login, and session management
+"""
+from fastapi import APIRouter, HTTPException, Depends, status
+from pydantic import BaseModel, EmailStr
+from typing import Optional, Dict, Any
+from services.auth import get_auth_service
+from middleware.auth import get_current_user
+
+# Create router
+router = APIRouter(prefix="/api/auth", tags=["Authentication"])
+
+
+# Request/Response Models
+class SignupRequest(BaseModel):
+    email: EmailStr
+    password: str
+    github_username: Optional[str] = None
+
+
+class LoginRequest(BaseModel):
+    email: EmailStr
+    password: str
+
+
+class RefreshRequest(BaseModel):
+    refresh_token: str
+
+
+class AuthResponse(BaseModel):
+    user: Dict[str, Any]
+    session: Dict[str, Any]
+
+
+# Routes
+@router.post("/signup", response_model=AuthResponse)
+async def signup(request: SignupRequest):
+    """
+    Sign up a new user with Supabase Auth
+    
+    - **email**: Valid email address
+    - **password**: Password (min 6 characters recommended)
+    - **github_username**: Optional GitHub username for profile
+    
+    Returns user data and session tokens (access_token, refresh_token)
+    """
+    auth_service = get_auth_service()
+    return await auth_service.signup(
+        email=request.email,
+        password=request.password,
+        github_username=request.github_username
+    )
+
+
+@router.post("/login", response_model=AuthResponse)
+async def login(request: LoginRequest):
+    """
+    Login with email and password
+    
+    - **email**: Registered email address
+    - **password**: User password
+    
+    Returns user data and session tokens
+    """
+    auth_service = get_auth_service()
+    return await auth_service.login(
+        email=request.email,
+        password=request.password
+    )
+
+
+@router.post("/refresh")
+async def refresh(request: RefreshRequest):
+    """
+    Refresh access token using refresh token
+    
+    - **refresh_token**: Valid refresh token from login/signup
+    
+    Returns new access token
+    """
+    auth_service = get_auth_service()
+    return await auth_service.refresh_session(request.refresh_token)
+
+
+@router.post("/logout")
+async def logout(user: Dict = Depends(get_current_user)):
+    """
+    Logout current user and invalidate session
+    
+    Requires: Valid JWT token in Authorization header
+    """
+    auth_service = get_auth_service()
+    return await auth_service.logout(token="")  # Supabase handles session
+
+
+@router.get("/me")
+async def get_current_user_info(user: Dict = Depends(get_current_user)):
+    """
+    Get current authenticated user information
+    
+    Requires: Valid JWT token in Authorization header
+    
+    Returns user profile data
+    """
+    return {"user": user}