Fix S1-5 and S1-6: Implement real auth resolution and JWT verification

- Add field validator for api_keys to parse comma-separated strings
- Update verify_auth to return User object instead of dict
- Implement actual JWT verification using python-jose
- Add current_user parameter to all route functions in cases.py and jobs.py
- Replace hardcoded user_id=1 with current_user.id in all routes and audit logs
- Remove router-level dependency and use per-route Depends(verify_auth)

Author: ruisoares1

pybrain/api/config.py

@@ -86,6 +86,14 @@ class Settings(BaseSettings):
         description="List of valid API keys for research mode authentication",
     )
 
+    @field_validator("api_keys", mode="before")
+    @classmethod
+    def parse_api_keys(cls, v):
+        """Parse comma-separated API keys string."""
+        if isinstance(v, str):
+            return [k.strip() for k in v.split(",") if k.strip()]
+        return v
+
     # CORS
     allowed_origins: List[str] = Field(
         default_factory=lambda: ["http://localhost:3000", "http://localhost:8080"],

pybrain/api/main.py

@@ -3,17 +3,19 @@
 """
 
 from contextlib import asynccontextmanager
+from datetime import datetime, timedelta
 from fastapi import FastAPI, HTTPException, Depends, status, Request
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
 from fastapi.responses import JSONResponse
 import redis.asyncio as redis
-from sqlalchemy import text
+from sqlalchemy import text, select
 from sqlalchemy.ext.asyncio import AsyncSession
 import logging
 
 from pybrain.api.config import settings
-from pybrain.api.db.base import engine, init_db
+from pybrain.api.db.base import engine, init_db, get_db
+from pybrain.api.db.models import User
 from pybrain.api.routes import cases, jobs
 
 logger = logging.getLogger(__name__)
@@ -104,9 +106,10 @@ async def readiness_check():
 # Auth middleware
 async def verify_auth(
     credentials: HTTPAuthorizationCredentials = Depends(security),
-) -> dict:
+    db: AsyncSession = Depends(get_db),
+) -> User:
     """
-    Verify JWT or API key authentication.
+    Verify JWT or API key authentication and return User object.
     In research mode, API keys are accepted.
     """
     if credentials is None:
@@ -120,12 +123,84 @@ async def verify_auth(
 
     # Check if it's an API key (research mode)
     if settings.api_keys and token in settings.api_keys:
-        return {"type": "api_key", "key": token}
+        # Look up user by api_key
+        result = await db.execute(
+            select(User).where(User.api_key == token, User.is_active == True)
+        )
+        user = result.scalar_one_or_none()
+        if user is None:
+            # Create a default user for research mode
+            user = User(
+                username="research_user",
+                api_key=token,
+                is_active=True,
+                created_at=datetime.utcnow(),
+                updated_at=datetime.utcnow(),
+            )
+            db.add(user)
+            await db.commit()
+            await db.refresh(user)
+        return user
+
+    # Try JWT verification
+    try:
+        from jose import jwt, JWTError
+
+        payload = jwt.decode(
+            token, settings.jwt_secret, algorithms=[settings.jwt_algorithm]
+        )
+        user_id = payload.get("sub")
+        if user_id is None:
+            raise JWTError("Missing sub claim")
+
+        user = await db.get(User, int(user_id))
+        if user is None or not user.is_active:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="User not found or inactive",
+            )
+        return user
+    except ImportError:
+        # python-jose not installed, fall back to development mode
+        pass
+    except JWTError as e:
+        if settings.environment == "development":
+            # Dev fallback: create default user
+            result = await db.execute(select(User).where(User.username == "dev"))
+            user = result.scalar_one_or_none()
+            if user is None:
+                user = User(
+                    username="dev",
+                    api_key="dev",
+                    is_active=True,
+                    created_at=datetime.utcnow(),
+                    updated_at=datetime.utcnow(),
+                )
+                db.add(user)
+                await db.commit()
+                await db.refresh(user)
+            return user
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=f"Invalid token: {e}",
+        )
 
-    # TODO: Verify JWT token
-    # For now, accept any token in development mode
+    # Development mode fallback
     if settings.environment == "development":
-        return {"type": "jwt", "token": token}
+        result = await db.execute(select(User).where(User.username == "dev"))
+        user = result.scalar_one_or_none()
+        if user is None:
+            user = User(
+                username="dev",
+                api_key="dev",
+                is_active=True,
+                created_at=datetime.utcnow(),
+                updated_at=datetime.utcnow(),
+            )
+            db.add(user)
+            await db.commit()
+            await db.refresh(user)
+        return user
 
     raise HTTPException(
         status_code=status.HTTP_401_UNAUTHORIZED,
@@ -135,8 +210,8 @@ async def verify_auth(
 
 
 # Include routers
-app.include_router(cases.router, dependencies=[Depends(verify_auth)])
-app.include_router(jobs.router, dependencies=[Depends(verify_auth)])
+app.include_router(cases.router)
+app.include_router(jobs.router)
 
 
 # Root endpoint

pybrain/api/routes/cases.py

@@ -15,10 +15,11 @@
 import tempfile
 
 from pybrain.api.db.base import get_db
-from pybrain.api.db.models import Case, Job, LongitudinalLink
+from pybrain.api.db.models import Case, Job, LongitudinalLink, User
 from pybrain.api.storage import storage
 from pybrain.api.audit import log_patient_data_access, log_patient_data_modification, log_api_call
 from pybrain.api.routes.jobs import create_segmentation_job
+from pybrain.api.main import verify_auth
 import logging
 
 logger = logging.getLogger(__name__)
@@ -34,6 +35,7 @@ async def create_case(
     patient_sex: Optional[str] = Form(None),
     analysis_mode: str = Form("auto"),
     db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(verify_auth),
 ) -> Dict[str, Any]:
     """
     Upload DICOM zip or NIfTI files and create a case.
@@ -61,7 +63,7 @@ async def create_case(
             shutil.copyfileobj(files.file, f)
 
         # Extract if zip file
-        if files.filename.endswith(".zip"):
+        if files.filename and files.filename.endswith(".zip"):
             extract_path = Path(tempfile.mkdtemp())
             with zipfile.ZipFile(temp_path, "r") as zip_ref:
                 zip_ref.extractall(extract_path)
@@ -86,7 +88,7 @@ async def create_case(
     # Create case record
     case = Case(
         id=case_id,
-        user_id=1,  # TODO: Get from auth context
+        user_id=current_user.id,
         patient_name=patient_name,
         patient_age=patient_age,
         patient_sex=patient_sex,
@@ -100,7 +102,7 @@ async def create_case(
     # Log audit
     await log_patient_data_modification(
         db=db,
-        user_id=1,  # TODO: Get from auth context
+        user_id=current_user.id,
         case_id=case_id,
         action="create",
         new_values={
@@ -122,6 +124,7 @@ async def create_case(
 async def get_case(
     case_id: str,
     db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(verify_auth),
 ) -> Dict[str, Any]:
     """
     Get case status and results.
@@ -141,7 +144,7 @@ async def get_case(
     # Log audit
     await log_patient_data_access(
         db=db,
-        user_id=1,  # TODO: Get from auth context
+        user_id=current_user.id,
         case_id=case_id,
     )
 
@@ -165,6 +168,7 @@ async def get_case(
 async def get_segmentation(
     case_id: str,
     db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(verify_auth),
 ) -> FileResponse:
     """
     Download segmentation as NIfTI.
@@ -187,7 +191,7 @@ async def get_segmentation(
     # Log audit
     await log_patient_data_access(
         db=db,
-        user_id=1,  # TODO: Get from auth context
+        user_id=current_user.id,
         case_id=case_id,
     )
 
@@ -210,6 +214,7 @@ async def get_segmentation(
 async def get_report(
     case_id: str,
     db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(verify_auth),
 ) -> FileResponse:
     """
     Download PDF report.
@@ -232,7 +237,7 @@ async def get_report(
     # Log audit
     await log_patient_data_access(
         db=db,
-        user_id=1,  # TODO: Get from auth context
+        user_id=current_user.id,
         case_id=case_id,
     )
 
@@ -255,6 +260,7 @@ async def get_report(
 async def get_dicom_seg(
     case_id: str,
     db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(verify_auth),
 ) -> FileResponse:
     """
     Stream DICOM-SEG file.
@@ -277,7 +283,7 @@ async def get_dicom_seg(
     # Log audit
     await log_patient_data_access(
         db=db,
-        user_id=1,  # TODO: Get from auth context
+        user_id=current_user.id,
         case_id=case_id,
     )
 
@@ -300,6 +306,7 @@ async def get_dicom_seg(
 async def trigger_segmentation(
     case_id: str,
     db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(verify_auth),
 ) -> Dict[str, Any]:
     """
     Trigger segmentation for a case.
@@ -327,6 +334,7 @@ async def trigger_longitudinal(
     case_id: str,
     prior_id: str,
     db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(verify_auth),
 ) -> Dict[str, Any]:
     """
     Trigger longitudinal comparison between current and prior case.
@@ -357,6 +365,7 @@ async def trigger_longitudinal(
 async def delete_case(
     case_id: str,
     db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(verify_auth),
 ) -> Dict[str, Any]:
     """
     Soft delete a case (audit trail preserved).
@@ -380,7 +389,7 @@ async def delete_case(
     # Log audit
     await log_patient_data_modification(
         db=db,
-        user_id=1,  # TODO: Get from auth context
+        user_id=current_user.id,
         case_id=case_id,
         action="delete",
         old_values={"status": case.status},