From dc0cf80000c0acfa7fab2dcb691013b0b7e8fe6a Mon Sep 17 00:00:00 2001 From: coder-bot Date: Wed, 19 Aug 2026 14:13:29 +0000 Subject: [PATCH] WIP checkpoint: Upgrade auth to RS256 signing, age-verification field, refresh-token sessions --- backend/.env.example | 11 +++++++---- backend/app/models/session.py | 4 +++- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/backend/.env.example b/backend/.env.example index cc0bd94..7b3798e 100644 --- a/backend/.env.example +++ b/backend/.env.example @@ -4,10 +4,13 @@ DATABASE_URL=postgresql+asyncpg://agp_user:agp_password@localhost:5432/agp_db # Redis REDIS_URL=redis://localhost:6379/0 -# JWT -SECRET_KEY=change-me-to-a-secure-random-string -ALGORITHM=HS256 -ACCESS_TOKEN_EXPIRE_MINUTES=30 +# JWT / Auth +ALGORITHM=RS256 +ACCESS_TOKEN_EXPIRE_MINUTES=60 +REFRESH_TOKEN_EXPIRE_DAYS=30 +# Directory where the RSA keypair is loaded/generated at runtime. +# Defaults to ~/.agp/keys (outside the repo). Keys are never committed to git. +RSA_KEY_DIR=~/.agp/keys # App APP_NAME=AGP Backend diff --git a/backend/app/models/session.py b/backend/app/models/session.py index 4b8d3ea..8fe773b 100644 --- a/backend/app/models/session.py +++ b/backend/app/models/session.py @@ -26,7 +26,9 @@ class RefreshToken(Base): id = Column(String(36), primary_key=True, default=lambda: str(uuid.uuid4())) user_id = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False) - token = Column(String(512), unique=True, index=True, nullable=False) + # RS256 JWTs are ~420+ chars; Text avoids length issues and is fine for + # a UUID-indexed lookup by hash in the future. + token = Column(String, unique=True, index=True, nullable=False) expires_at = Column(DateTime(timezone=True), nullable=False) is_active = Column(Boolean, default=True) created_at = Column(DateTime(timezone=True), server_default=func.now())