add-hash pwd

requirements.txt

@@ -6,4 +6,5 @@ requests
 python-multipart
 pillow
 pyjwt
-sqlalchemy
+sqlalchemy
+passlib[bcrypt]

src/server/utils/auth.py

@@ -9,16 +9,23 @@ from sqlalchemy import create_engine, Column, String
 from sqlalchemy.ext.declarative import declarative_base
 from sqlalchemy.orm import sessionmaker
 
+from passlib.context import CryptContext
+
 # SQLite database setup
 DATABASE_URL = "sqlite:///users.db"
 engine = create_engine(DATABASE_URL, connect_args={"check_same_thread": False})  # For SQLite threading
 Base = declarative_base()
 SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)
 
+# Password hashing setup
+pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
+
+
+
 class User(Base):
     __tablename__ = "users"
     username = Column(String, primary_key=True, index=True)
-    password = Column(String)  # In production, hash this with bcrypt
+    password = Column(String)  # Now stores hashed passwords
 
 # Create the database tables
 Base.metadata.create_all(bind=engine)
@@ -27,12 +34,14 @@ Base.metadata.create_all(bind=engine)
 def seed_initial_data():
     db = SessionLocal()
     if not db.query(User).filter_by(username="testuser").first():
-        db.add(User(username="testuser", password="password123"))
+        hashed_password = pwd_context.hash("password123")
+        db.add(User(username="testuser", password=hashed_password))
         db.commit()
     db.close()
 
 seed_initial_data()  # Run once at startup
 
+
 class Settings(BaseSettings):
     api_key_secret: str = Field(..., env="API_KEY_SECRET")
     token_expiration_minutes: int = Field(30, env="TOKEN_EXPIRATION_MINUTES")
@@ -123,7 +132,7 @@ async def login(login_request: LoginRequest) -> TokenResponse:
     db = SessionLocal()
     user = db.query(User).filter_by(username=login_request.username).first()
     db.close()
-    if not user or user.password != login_request.password:  # Use password hashing in production
+    if not user or not pwd_context.verify(login_request.password, user.password):
         logger.warning(f"Login failed for user: {login_request.username}")
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid username or password")
     token = await create_access_token(user_id=user.username)