3 Commits

Author	SHA1	Message	Date
Fusion	0fcfc745ff	fix: add alias=session to Cookie dependencies ... FastAPI uses parameter name as cookie name by default. get_current_user_id was looking for 'session_cookie' but we set the cookie as 'session'. Add alias='session' to match.	2026-05-19 10:56:11 +02:00
Fusion	d214ab82db	debug: add logging to auth cookie handling ... Add debug logging to understand why /auth/me succeeds but /users/me/config fails with 401.	2026-05-19 10:52:33 +02:00
Fusion	2ce7862058	feat: simplify auth flow - replace JWT with session cookies ... Replace complex JWT + refresh token authentication with simple session-based auth using signed cookies. **Removed:** - JWT token service (jwt_service.py) - Refresh token store (refresh_store.py) - Refresh token model and database table - JWKS fetching and OIDC token verification - python-jose dependency **Added:** - Session service (session.py) with HMAC-SHA256 signed cookies - Auth dependencies module for shared auth logic - Session-based auth endpoints **Updated:** - All API endpoints to use session-based auth - Config: removed JWT settings, added SESSION_SECRET/SESSION_TTL_HOURS - Tests: rewritten for session-based flow - Frontend: no changes needed (already uses cookies) Quality gates: ruff ✓, mypy ✓, typecheck ✓, lint ✓	2026-05-18 22:54:53 +02:00