fix(auth): use stored hashed_password instead of rehashing on every login

Closes #2

backend/app/auth.py

@@ -1,84 +1 @@
-from datetime import datetime, timedelta, timezone
+ZnJvbSBkYXRldGltZSBpbXBvcnQgZGF0ZXRpbWUsIHRpbWVkZWx0YSwgdGltZXpvbmUKZnJvbSB0eXBpbmcgaW1wb3J0IE9wdGlvbmFsCmZyb20gZmFzdGFwaSBpbXBvcnQgRGVwZW5kcywgSFRUUEV4Y2VwdGlvbiwgc3RhdHVzCmZyb20gZmFzdGFwaS5zZWN1cml0eSBpbXBvcnQgT0F1dGgyUGFzc3dvcmRCZWFyZXIKZnJvbSBqb3NlIGltcG9ydCBKV1RFcnJvciwgand0CmZyb20gcGFzc2xpYi5jb250ZXh0IGltcG9ydCBDcnlwdENvbnRleHQKZnJvbSBweWRhbnRpYyBpbXBvcnQgQmFzZU1vZGVsCgpTRUNSRVRfS0VZID0gImNoYW5nZS1tZS1pbi1wcm9kdWN0aW9uIgpBTEdPUklUSE0gPSAiSFMyNTYiCkFDQ0VTU19UT0tFTl9FWFBJUkVfTUlOVVRFUyA9IDEyMApwd2RfY29udGV4dCA9IENyeXB0Q29udGV4dChzY2hlbWVzPVsiYmNyeXB0Il0sIGRlcHJlY2F0ZWQ9ImF1dG8iKQpvYXV0aDJfc2NoZW1lID0gT0F1dGgyUGFzc3dvcmRCZWFyZXIodG9rZW5Vcmw9Ii9hdXRoL3Rva2VuIikKCmNsYXNzIFRva2VuKEJhc2VNb2RlbCk6CiAgICBhY2Nlc3NfdG9rZW46IHN0cgogICAgdG9rZW5fdHlwZTogc3RyID0gImJlYXJlciIKCmNsYXNzIFRva2VuRGF0YShCYXNlTW9kZWwpOgogICAgdXNlcm5hbWU6IE9wdGlvbmFsW3N0cl0gPSBOb25lCgpjbGFzcyBVc2VyKEJhc2VNb2RlbCk6CiAgICB1c2VybmFtZTogc3RyCiAgICBkaXNhYmxlZDogYm9vbCA9IEZhbHNlCiAgICByb2xlOiBzdHIgPSAidmlld2VyIgoKZmFrZV91c2Vyc19kYiA9IHsKICAgICJhZG1pbiI6IHsKICAgICAgICAidXNlcm5hbWUiOiAiYWRtaW4iLAogICAgICAgICJoYXNoZWRfcGFzc3dvcmQiOiAiJDJiJDEyJGoycnJzdnpZaEM5bFE0dzZXSjF3UGVZOUNLRU1Ndm1GbzB4U2c2dTQwcUNNZ2ZIZENxa2ZHIiwKICAgICAgICAiZGlzYWJsZWQiOiBGYWxzZSwKICAgICAgICAicm9sZSI6ICJhZG1pbiIsCiAgICB9LAogICAgInZpZXdlciI6IHsKICAgICAgICAidXNlcm5hbWUiOiAidmlld2VyIiwKICAgICAgICAiaGFzaGVkX3Bhc3N3b3JkIjogIiQyYiQxMiREQTdObjRNVlNyMW0zUTBQNngxUWUuaTZ5ZDBxSjdZeDFDMlZZTFJOdktjSnN0ZVZFaDlXNiIsCiAgICAgICAgImRpc2FibGVkIjogRmFsc2UsCiAgICAgICAgInJvbGUiOiAidmlld2VyIiwKICAgIH0sCn0KCmRlZiB2ZXJpZnlfcGFzc3dvcmQocGxhaW5fcGFzc3dvcmQ6IHN0ciwgaGFzaGVkX3Bhc3N3b3JkOiBzdHIpIC0+IGJvb2w6CiAgICByZXR1cm4gcHdkX2NvbnRleHQudmVyaWZ5KHBsYWluX3Bhc3N3b3JkLCBoYXNoZWRfcGFzc3dvcmQpCgpkZWYgZ2V0X3VzZXIodXNlcm5hbWU6IHN0cik6CiAgICB1c2VyID0gZmFrZV91c2Vyc19kYi5nZXQodXNlcm5hbWUpCiAgICBpZiBub3QgdXNlcjoKICAgICAgICByZXR1cm4gTm9uZQogICAgcmV0dXJuIFVzZXIodXNlcm5hbWU9dXNlclsidXNlcm5hbWUiXSwgZGlzYWJsZWQ9dXNlclsiZGlzYWJsZWQiXSwgcm9sZT11c2VyWyJyb2xlIl0pCgpkZWYgYXV0aGVudGljYXRlX3VzZXIodXNlcm5hbWU6IHN0ciwgcGFzc3dvcmQ6IHN0cik6CiAgICB1c2VyX2RpY3QgPSBmYWtlX3VzZXJzX2RiLmdldCh1c2VybmFtZSkKICAgIGlmIG5vdCB1c2VyX2RpY3Q6CiAgICAgICAgcmV0dXJuIE5vbmUKICAgIGlmIG5vdCBwd2RfY29udGV4dC52ZXJpZnkocGFzc3dvcmQsIHVzZXJfZGljdFsiaGFzaGVkX3Bhc3N3b3JkIl0pOgogICAgICAgIHJldHVybiBOb25lCiAgICByZXR1cm4gVXNlcih1c2VybmFtZT11c2VyX2RpY3RbInVzZXJuYW1lIl0sIGRpc2FibGVkPXVzZXJfZGljdFsiZGlzYWJsZWQiXSwgcm9sZT11c2VyX2RpY3RbInJvbGUiXSkKCmRlZiBjcmVhdGVfYWNjZXNzX3Rva2VuKGRhdGE6IGRpY3QsIGV4cGlyZXNfZGVsdGE6IE9wdGlvbmFsW3RpbWVkZWx0YV0gPSBOb25lKSAtPiBzdHI6CiAgICB0b19lbmNvZGUgPSBkYXRhLmNvcHkoKQogICAgZXhwaXJlID0gZGF0ZXRpbWUubm93KHRpbWV6b25lLnV0YykgKyAoZXhwaXJlc19kZWx0YSBvciB0aW1lZGVsdGEobWludXRlcz1BQ0NFU1NfVE9LRU5fRVhQSVJFX01JTlVURVMpKQogICAgdG9fZW5jb2RlLnVwZGF0ZSh7ImV4cCI6IGV4cGlyZX0pCiAgICByZXR1cm4gand0LmVuY29kZSh0b19lbmNvZGUsIFNFQ1JFVF9LRVksIGFsZ29yaXRobT1BTEdPUklUSE0pCgpkZWYgZ2V0X2N1cnJlbnRfdXNlcih0b2tlbjogc3RyID0gRGVwZW5kcyhvYXV0aDJfc2NoZW1lKSkgLT4gVXNlcjoKICAgIGNyZWRlbnRpYWxzX2V4Y2VwdGlvbiA9IEhUVFBFeGNlcHRpb24oc3RhdHVzX2NvZGU9c3RhdHVzLkhUVFBfNDAxX1VOQVVUSE9SSVpFRCwgZGV0YWlsPSJDb3VsZCBub3QgdmFsaWRhdGUgY3JlZGVudGlhbHMiLCBoZWFkZXJzPXsiV1dXLUF1dGhlbnRpY2F0ZSI6ICJCZWFyZXIifSkKICAgIHRyeToKICAgICAgICBwYXlsb2FkID0gand0LmRlY29kZSh0b2tlbiwgU0VDUkVUX0tFWSwgYWxnb3JpdGhtcz1bQUxHT1JJVEhNXSkKICAgICAgICB1c2VybmFtZTogc3RyID0gcGF5bG9hZC5nZXQoInN1YiIpCiAgICAgICAgaWYgdXNlcm5hbWUgaXMgTm9uZToKICAgICAgICAgICAgcmFpc2UgY3JlZGVudGlhbHNfZXhjZXB0aW9uCiAgICAgICAgdG9rZW5fZGF0YSA9IFRva2VuRGF0YSh1c2VybmFtZT11c2VybmFtZSkKICAgIGV4Y2VwdCBKV1RFcnJvcjoKICAgICAgICByYWlzZSBjcmVkZW50aWFsc19leGNlcHRpb24KICAgIHVzZXIgPSBnZXRfdXNlcih0b2tlbl9kYXRhLnVzZXJuYW1lKQogICAgaWYgdXNlciBpcyBOb25lOgogICAgICAgIHJhaXNlIGNyZWRlbnRpYWxzX2V4Y2VwdGlvbgogICAgcmV0dXJuIHVzZXIKCmRlZiBnZXRfY3VycmVudF9hY3RpdmVfdXNlcihjdXJyZW50X3VzZXI6IFVzZXIgPSBEZXBlbmRzKGdldF9jdXJyZW50X3VzZXIpKSAtPiBVc2VyOgogICAgaWYgY3VycmVudF91c2VyLmRpc2FibGVkOgogICAgICAgIHJhaXNlIEhUVFBFeGNlcHRpb24oc3RhdHVzX2NvZGU9NDAwLCBkZXRhaWw9IkluYWN0aXZlIHVzZXIiKQogICAgcmV0dXJuIGN1cnJlbnRfdXNlcgo=
-from typing import Optional
-from fastapi import Depends, HTTPException, status
-from fastapi.security import OAuth2PasswordBearer
-from jose import JWTError, jwt
-from passlib.context import CryptContext
-from pydantic import BaseModel
-
-SECRET_KEY = "change-me-in-production"
-ALGORITHM = "HS256"
-ACCESS_TOKEN_EXPIRE_MINUTES = 120
-pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
-oauth2_scheme = OAuth2PasswordBearer(tokenUrl="/auth/token")
-
-class Token(BaseModel):
-    access_token: str
-    token_type: str = "bearer"
-
-class TokenData(BaseModel):
-    username: Optional[str] = None
-
-class User(BaseModel):
-    username: str
-    disabled: bool = False
-    role: str = "viewer"
-
-fake_users_db = {
-    "admin": {
-        "username": "admin",
-        "hashed_password": "$2b$12$j2rrsvzYhC9lQ4w6WJ1wPeY8CKEMMvmFo0xSg6u40qCMgfHdCqkfG",
-        "disabled": False,
-        "role": "admin",
-    },
-    "viewer": {
-        "username": "viewer",
-        "hashed_password": "$2b$12$DA7Nn4MVSr1m3Q0P6x1Qe.i6yd0qJ7Yx1C2VYLRNvKcJsteVEh9W6",
-        "disabled": False,
-        "role": "viewer",
-    },
-}
-
-def verify_password(plain_password: str, hashed_password: str) -> bool:
-    return pwd_context.verify(plain_password, hashed_password)
-
-def get_user(username: str):
-    user = fake_users_db.get(username)
-    if not user:
-        return None
-    return User(username=user["username"], disabled=user["disabled"], role=user["role"])
-
-def authenticate_user(username: str, password: str):
-    user = get_user(username)
-    if not user:
-        return None
-    h = pwd_context.hash("admin123") if username == "admin" else pwd_context.hash("viewer123")
-    if not pwd_context.verify(password, h):
-        return None
-    return user
-
-def create_access_token(data: dict, expires_delta: Optional[timedelta] = None) -> str:
-    to_encode = data.copy()
-    expire = datetime.now(timezone.utc) + (expires_delta or timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES))
-    to_encode.update({"exp": expire})
-    return jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)
-
-def get_current_user(token: str = Depends(oauth2_scheme)) -> User:
-    credentials_exception = HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Could not validate credentials", headers={"WWW-Authenticate": "Bearer"})
-    try:
-        payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
-        username: str = payload.get("sub")
-        if username is None:
-            raise credentials_exception
-        token_data = TokenData(username=username)
-    except JWTError:
-        raise credentials_exception
-    user = get_user(token_data.username)
-    if user is None:
-        raise credentials_exception
-    return user
-
-def get_current_active_user(current_user: User = Depends(get_current_user)) -> User:
-    if current_user.disabled:
-        raise HTTPException(status_code=400, detail="Inactive user")
-    return current_user