WIP checkpoint: Upgrade auth to RS256 signing, age-verification field, refresh-token sessions

backend/app/routers/auth.py

@@ -70,7 +70,7 @@ def _create_access_token(data: dict) -> str:
     to_encode.update({"exp": expire})
     return jwt.encode(
         to_encode,
-        settings.private_key,
+        settings.private_pem,
         algorithm=settings.ALGORITHM,
     )
 
@@ -84,7 +84,7 @@ def _create_refresh_token(data: dict) -> str:
     to_encode.update({"exp": expire})
     return jwt.encode(
         to_encode,
-        settings.private_key,
+        settings.private_pem,
         algorithm=settings.ALGORITHM,
     )
 
@@ -119,6 +119,20 @@ def calculate_age(birth_date, today=None) -> int:
     return age
 
 
+def _issue_refresh_token(user_id: int, db: AsyncSession) -> str:
+    """Create and persist a refresh token for the given user."""
+    refresh_token_value = _create_refresh_token({"sub": str(user_id)})
+    refresh_token_record = RefreshToken(
+        id=str(uuid.uuid4()),
+        user_id=user_id,
+        token=refresh_token_value,
+        expires_at=datetime.now(timezone.utc)
+        + timedelta(days=settings.REFRESH_TOKEN_EXPIRE_DAYS),
+    )
+    db.add(refresh_token_record)
+    return refresh_token_value
+
+
 # --- Endpoints ---
 
 @router.post("/register", response_model=TokenResponse, status_code=status.HTTP_201_CREATED)
@@ -166,15 +180,8 @@ async def register(req: RegisterRequest, db: AsyncSession = Depends(get_db)):
     # Create access token
     access_token = _create_access_token({"sub": str(user.id)})
 
-    # Create refresh token and persist it
-    refresh_token_value = _create_refresh_token({"sub": str(user.id)})
-    refresh_token_record = RefreshToken(
-        id=str(uuid.uuid4()),
-        user_id=user.id,
-        token=refresh_token_value,
-        expires_at=datetime.now(timezone.utc) + timedelta(days=settings.REFRESH_TOKEN_EXPIRE_DAYS),
-    )
-    db.add(refresh_token_record)
+    # Create and persist refresh token
+    refresh_token_value = _issue_refresh_token(user.id, db)
     await db.commit()
 
     return TokenResponse(
@@ -209,15 +216,8 @@ async def login(form: OAuth2PasswordRequestForm = Depends(), db: AsyncSession =
     # Create access token
     access_token = _create_access_token({"sub": str(user.id)})
 
-    # Create refresh token and persist it
-    refresh_token_value = _create_refresh_token({"sub": str(user.id)})
-    refresh_token_record = RefreshToken(
-        id=str(uuid.uuid4()),
-        user_id=user.id,
-        token=refresh_token_value,
-        expires_at=datetime.now(timezone.utc) + timedelta(days=settings.REFRESH_TOKEN_EXPIRE_DAYS),
-    )
-    db.add(refresh_token_record)
+    # Create and persist refresh token
+    refresh_token_value = _issue_refresh_token(user.id, db)
     await db.commit()
 
     return TokenResponse(