Merge pull request #124 from bg-playground/copilot/add-jwt-authentication-backend

Add JWT-based authentication and authorization to backend

Author: bg-playground

backend/.env.example

@@ -11,3 +11,8 @@ BACKEND_CORS_ORIGINS=["http://localhost:3000", "http://localhost:8000"]
 AUTO_SUGGESTIONS_ENABLED=true
 AUTO_SUGGESTIONS_ALGORITHM=tfidf
 AUTO_SUGGESTIONS_THRESHOLD=0.3
+
+# Authentication — CHANGE THESE IN PRODUCTION!
+SECRET_KEY=change-me-in-production-use-a-real-secret-key
+ACCESS_TOKEN_EXPIRE_MINUTES=60
+ALGORITHM=HS256

backend/alembic/env.py

@@ -28,6 +28,7 @@
 import app.models.requirement  # noqa: E402, F401
 import app.models.suggestion  # noqa: E402, F401
 import app.models.test_case  # noqa: E402, F401
+import app.models.user  # noqa: E402, F401
 from app.models.base import Base  # noqa: E402
 
 target_metadata = Base.metadata

backend/alembic/versions/b1c2d3e4f5a6_add_users_table.py

@@ -0,0 +1,42 @@
+"""add users table
+
+Revision ID: b1c2d3e4f5a6
+Revises: a61ce9bc5970
+Create Date: 2026-02-22 15:00:00.000000
+
+"""
+
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision: str = "b1c2d3e4f5a6"
+down_revision: Union[str, None] = "a61ce9bc5970"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    user_role = sa.Enum("admin", "reviewer", "viewer", name="userrole")
+
+    op.create_table(
+        "users",
+        sa.Column("id", sa.CHAR(36), primary_key=True),
+        sa.Column("email", sa.String(255), nullable=False, unique=True),
+        sa.Column("hashed_password", sa.String(255), nullable=False),
+        sa.Column("full_name", sa.String(255), nullable=True),
+        sa.Column("role", user_role, nullable=False, server_default="reviewer"),
+        sa.Column("is_active", sa.Boolean(), nullable=False, server_default="true"),
+        sa.Column("created_at", sa.DateTime(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(), nullable=False),
+    )
+    op.create_index("idx_users_email", "users", ["email"])
+
+
+def downgrade() -> None:
+    op.drop_index("idx_users_email", table_name="users")
+    op.drop_table("users")
+    sa.Enum(name="userrole").drop(op.get_bind())

backend/app/api/analytics.py

@@ -5,14 +5,19 @@
 from fastapi import APIRouter, Depends
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.auth.dependencies import get_current_user
 from app.db.session import get_db
+from app.models.user import User
 from app.services.analytics import SuggestionAnalytics
 
 router = APIRouter()
 
 
 @router.get("/analytics/acceptance-rates", response_model=list[dict[str, Any]])
-async def get_acceptance_rates(db: AsyncSession = Depends(get_db)):
+async def get_acceptance_rates(
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
     """
     Get acceptance/rejection rates for link suggestions over time.
 
@@ -24,7 +29,10 @@ async def get_acceptance_rates(db: AsyncSession = Depends(get_db)):
 
 
 @router.get("/analytics/confidence-distribution", response_model=list[dict[str, Any]])
-async def get_confidence_distribution(db: AsyncSession = Depends(get_db)):
+async def get_confidence_distribution(
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
     """
     Get distribution of confidence scores across suggestions.
 
@@ -36,7 +44,10 @@ async def get_confidence_distribution(db: AsyncSession = Depends(get_db)):
 
 
 @router.get("/analytics/generation-trends", response_model=list[dict[str, Any]])
-async def get_generation_trends(db: AsyncSession = Depends(get_db)):
+async def get_generation_trends(
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
     """
     Get trends in suggestion generation volume over time.
 
@@ -47,7 +58,10 @@ async def get_generation_trends(db: AsyncSession = Depends(get_db)):
 
 
 @router.get("/analytics/review-velocity", response_model=dict[str, Any])
-async def get_review_velocity(db: AsyncSession = Depends(get_db)):
+async def get_review_velocity(
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
     """
     Get review velocity metrics — how quickly suggestions are being reviewed.
 
@@ -58,7 +72,10 @@ async def get_review_velocity(db: AsyncSession = Depends(get_db)):
 
 
 @router.get("/analytics/algorithm-comparison", response_model=list[dict[str, Any]])
-async def get_algorithm_comparison(db: AsyncSession = Depends(get_db)):
+async def get_algorithm_comparison(
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
     """
     Compare performance metrics across algorithms (tfidf, keyword, hybrid, etc.).
 

backend/app/api/auth.py

@@ -0,0 +1,44 @@
+"""API endpoints for Authentication"""
+
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.auth.dependencies import get_current_user
+from app.auth.security import create_access_token, verify_password
+from app.crud.user import create_user, get_user_by_email
+from app.db.session import get_db
+from app.models.user import User
+from app.schemas.user import TokenResponse, UserCreate, UserLogin, UserResponse
+
+router = APIRouter()
+
+
+@router.post("/auth/register", response_model=UserResponse, status_code=status.HTTP_201_CREATED)
+async def register(user_create: UserCreate, db: AsyncSession = Depends(get_db)):
+    """Register a new user"""
+    existing = await get_user_by_email(db, user_create.email)
+    if existing:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Email already registered")
+    return await create_user(db, user_create)
+
+
+@router.post("/auth/login", response_model=TokenResponse)
+async def login(user_login: UserLogin, db: AsyncSession = Depends(get_db)):
+    """Authenticate and return a JWT token"""
+    user = await get_user_by_email(db, user_login.email)
+    if not user or not verify_password(user_login.password, user.hashed_password):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Incorrect email or password",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+    if not user.is_active:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Inactive user")
+    access_token = create_access_token(data={"sub": str(user.id)})
+    return TokenResponse(access_token=access_token)
+
+
+@router.get("/auth/me", response_model=UserResponse)
+async def get_me(current_user: User = Depends(get_current_user)):
+    """Return the currently authenticated user"""
+    return current_user

backend/app/api/links.py

@@ -6,8 +6,10 @@
 from fastapi import APIRouter, Depends, HTTPException, Query, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.auth.dependencies import get_current_user
 from app.crud import link as crud
 from app.db.session import get_db
+from app.models.user import User
 from app.schemas.link import (
     BulkReviewRequest,
     LinkCreate,
@@ -21,7 +23,11 @@
 
 # Link endpoints
 @router.post("/links", response_model=LinkResponse, status_code=status.HTTP_201_CREATED)
-async def create_link(link: LinkCreate, db: AsyncSession = Depends(get_db)):
+async def create_link(
+    link: LinkCreate,
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
     """Create a new requirement-test case link"""
     try:
         return await crud.create_link(db, link)
@@ -36,13 +42,22 @@ async def create_link(link: LinkCreate, db: AsyncSession = Depends(get_db)):
 
 
 @router.get("/links", response_model=list[LinkResponse])
-async def list_links(skip: int = 0, limit: int = 100, db: AsyncSession = Depends(get_db)):
+async def list_links(
+    skip: int = 0,
+    limit: int = 100,
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
     """List all links"""
     return await crud.get_links(db, skip=skip, limit=limit)
 
 
 @router.get("/links/{link_id}", response_model=LinkResponse)
-async def get_link(link_id: UUID, db: AsyncSession = Depends(get_db)):
+async def get_link(
+    link_id: UUID,
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
     """Get a specific link by ID"""
     link = await crud.get_link(db, link_id)
     if not link:
@@ -51,19 +66,31 @@ async def get_link(link_id: UUID, db: AsyncSession = Depends(get_db)):
 
 
 @router.get("/requirements/{requirement_id}/links", response_model=list[LinkResponse])
-async def get_requirement_links(requirement_id: UUID, db: AsyncSession = Depends(get_db)):
+async def get_requirement_links(
+    requirement_id: UUID,
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
     """Get all links for a specific requirement"""
     return await crud.get_links_by_requirement(db, requirement_id)
 
 
 @router.get("/test-cases/{test_case_id}/links", response_model=list[LinkResponse])
-async def get_test_case_links(test_case_id: UUID, db: AsyncSession = Depends(get_db)):
+async def get_test_case_links(
+    test_case_id: UUID,
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
     """Get all links for a specific test case"""
     return await crud.get_links_by_test_case(db, test_case_id)
 
 
 @router.delete("/links/{link_id}", status_code=status.HTTP_204_NO_CONTENT)
-async def delete_link(link_id: UUID, db: AsyncSession = Depends(get_db)):
+async def delete_link(
+    link_id: UUID,
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
     """Delete a link"""
     deleted = await crud.delete_link(db, link_id)
     if not deleted:
@@ -72,7 +99,12 @@ async def delete_link(link_id: UUID, db: AsyncSession = Depends(get_db)):
 
 # Suggestion endpoints
 @router.get("/suggestions", response_model=list[SuggestionResponse])
-async def list_suggestions(skip: int = 0, limit: int = 100, db: AsyncSession = Depends(get_db)):
+async def list_suggestions(
+    skip: int = 0,
+    limit: int = 100,
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
     """List all link suggestions"""
     return await crud.get_suggestions(db, skip=skip, limit=limit)
 
@@ -87,6 +119,7 @@ async def list_pending_suggestions(
     limit: int | None = Query(100, le=500, description="Maximum results to return"),
     search: str | None = Query(None, description="Search term to filter by requirement/test case title or description"),
     db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(get_current_user),
 ):
     """List pending suggestions with filtering and sorting"""
     return await crud.get_pending_suggestions(
@@ -102,7 +135,11 @@ async def list_pending_suggestions(
 
 
 @router.get("/suggestions/{suggestion_id}", response_model=SuggestionResponse)
-async def get_suggestion(suggestion_id: UUID, db: AsyncSession = Depends(get_db)):
+async def get_suggestion(
+    suggestion_id: UUID,
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
     """Get a specific suggestion by ID"""
     suggestion = await crud.get_suggestion(db, suggestion_id)
     if not suggestion:
@@ -111,7 +148,12 @@ async def get_suggestion(suggestion_id: UUID, db: AsyncSession = Depends(get_db)
 
 
 @router.post("/suggestions/{suggestion_id}/review", response_model=SuggestionResponse)
-async def review_suggestion(suggestion_id: UUID, review: SuggestionReview, db: AsyncSession = Depends(get_db)):
+async def review_suggestion(
+    suggestion_id: UUID,
+    review: SuggestionReview,
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
     """Review a suggestion (accept/reject)"""
     reviewed = await crud.review_suggestion(db, suggestion_id, review)
     if not reviewed:
@@ -120,7 +162,11 @@ async def review_suggestion(suggestion_id: UUID, review: SuggestionReview, db: A
 
 
 @router.post("/suggestions/bulk-review", response_model=dict[str, Any])
-async def bulk_review_suggestions(request: BulkReviewRequest, db: AsyncSession = Depends(get_db)):
+async def bulk_review_suggestions(
+    request: BulkReviewRequest,
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
     """Review multiple suggestions at once"""
     reviewed = await crud.bulk_review_suggestions(
         db, request.suggestion_ids, request.status, request.feedback, request.reviewed_by

backend/app/api/requirements.py

@@ -6,9 +6,11 @@
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.ai_suggestions.event_driven import generate_suggestions_for_requirement
+from app.auth.dependencies import get_current_user
 from app.config import settings
 from app.crud import requirement as crud
 from app.db.session import get_db
+from app.models.user import User
 from app.schemas.requirement import (
     RequirementCreate,
     RequirementResponse,
@@ -23,6 +25,7 @@ async def create_requirement(
     requirement: RequirementCreate,
     background_tasks: BackgroundTasks,
     db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(get_current_user),
 ):
     """Create a new requirement"""
     # Check if external_id already exists
@@ -48,13 +51,22 @@ async def create_requirement(
 
 
 @router.get("/requirements", response_model=list[RequirementResponse])
-async def list_requirements(skip: int = 0, limit: int = 100, db: AsyncSession = Depends(get_db)):
+async def list_requirements(
+    skip: int = 0,
+    limit: int = 100,
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
     """List all requirements"""
     return await crud.get_requirements(db, skip=skip, limit=limit)
 
 
 @router.get("/requirements/{requirement_id}", response_model=RequirementResponse)
-async def get_requirement(requirement_id: UUID, db: AsyncSession = Depends(get_db)):
+async def get_requirement(
+    requirement_id: UUID,
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
     """Get a specific requirement by ID"""
     requirement = await crud.get_requirement(db, requirement_id)
     if not requirement:
@@ -68,6 +80,7 @@ async def update_requirement(
     requirement: RequirementUpdate,
     background_tasks: BackgroundTasks,
     db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(get_current_user),
 ):
     """Update a requirement"""
     updated = await crud.update_requirement(db, requirement_id, requirement)
@@ -86,7 +99,11 @@ async def update_requirement(
 
 
 @router.delete("/requirements/{requirement_id}", status_code=status.HTTP_204_NO_CONTENT)
-async def delete_requirement(requirement_id: UUID, db: AsyncSession = Depends(get_db)):
+async def delete_requirement(
+    requirement_id: UUID,
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
     """Delete a requirement"""
     deleted = await crud.delete_requirement(db, requirement_id)
     if not deleted: