♻️ refactor: simplify auth system to spotify-only workflow

Author: mariuspruvot

backend/src/adapters/auth/__init__.py

@@ -1,9 +1,9 @@
 """Authentication adapters package."""
 
 from src.adapters.auth.supabase import (
+    SupabaseAuthMappers,
     SupabaseAuthRepository,
     SupabaseClient,
-    SupabaseAuthMappers,
 )
 
 __all__ = [

backend/src/adapters/auth/supabase/auth_repository.py

@@ -4,79 +4,76 @@
 from src.adapters.auth.supabase.mappers import SupabaseAuthMappers
 from src.core.config import AuthConfig, SupabaseConfig
 from src.core.exceptions import AuthenticationError
-from src.domain.interfaces.auth_repository import AuthRepository
 from src.domain.models.auth_session import (
     AuthSession,
-    LoginRequest,
-    OAuthCallback,
-    OAuthRequest,
-    RegisterRequest,
-    TokenPair,
+    SpotifyOAuthCallback,
+    SpotifyOAuthRequest,
 )
 from src.domain.models.user import User
 from src.infrastructure.logging import get_logger
 
 logger = get_logger("adapters.auth.supabase.repository")
 
 
-class SupabaseAuthRepository(AuthRepository):
+class SupabaseAuthRepository:
     """Supabase implementation of AuthRepository using OAuth."""
 
     def __init__(self, supabase_config: SupabaseConfig, auth_config: AuthConfig):
         self.client = SupabaseClient(supabase_config, auth_config)
         self.mappers = SupabaseAuthMappers()
 
-    # OAuth methods (primary)
-    async def get_oauth_url(self, request: OAuthRequest) -> str:
-        """Get OAuth authorization URL for the specified provider."""
+    # Spotify OAuth methods
+    async def get_spotify_oauth_url(self, request: SpotifyOAuthRequest) -> str:
+        """Get Spotify OAuth authorization URL."""
         try:
             return await self.client.get_oauth_url(
-                provider=request.provider,
+                provider="spotify",
                 redirect_url=request.redirect_url,
                 scopes=request.scopes,
             )
         except Exception as e:
-            logger.error(f"OAuth URL generation failed: {str(e)}")
-            raise AuthenticationError(f"OAuth URL generation failed: {str(e)}")
+            logger.error(f"Spotify OAuth URL generation failed: {str(e)}")
+            raise AuthenticationError(f"Spotify OAuth URL generation failed: {str(e)}")
 
-    async def exchange_oauth_code(
-        self, callback: OAuthCallback
+    async def exchange_spotify_oauth_code(
+        self, callback: SpotifyOAuthCallback
     ) -> tuple[User, AuthSession]:
-        """Exchange OAuth code for user and session."""
+        """Exchange Spotify OAuth code for user and session."""
         try:
             # Exchange the code for a session
             session_data = await self.client.exchange_oauth_code(callback.code)
 
             if not session_data.get("user"):
-                raise AuthenticationError("OAuth exchange failed: No user returned")
+                raise AuthenticationError(
+                    "Spotify OAuth exchange failed: No user returned"
+                )
 
-            # Map to domain models
-            provider = "spotify"  # Default for now, could be extracted from callback
-            user = self.mappers.user_from_oauth_session(session_data, provider)
-            session = self.mappers.session_from_supabase(session_data, provider)
+            # Map to domain models - always Spotify
+            user = self.mappers.user_from_oauth_session(session_data, "spotify")
+            session = self.mappers.session_from_supabase(session_data, "spotify")
 
-            logger.info(f"OAuth exchange successful for user: {user.email}")
+            logger.info(f"Spotify OAuth exchange successful for user: {user.email}")
             return user, session
         except Exception as e:
-            logger.error(f"OAuth code exchange failed: {str(e)}")
+            logger.error(f"Spotify OAuth code exchange failed: {str(e)}")
             if isinstance(e, AuthenticationError):
                 raise
-            raise AuthenticationError(f"OAuth exchange failed: {str(e)}")
+            raise AuthenticationError(f"Spotify OAuth exchange failed: {str(e)}")
 
-    async def refresh_oauth_session(self, refresh_token: str) -> AuthSession:
-        """Refresh OAuth session using refresh token."""
+    async def refresh_spotify_session(self, refresh_token: str) -> AuthSession:
+        """Refresh Spotify OAuth session using refresh token."""
         try:
             # Set the refresh token and refresh the session
             session_data = await self.client.refresh_session()
 
-            provider = "spotify"  # Should be stored/determined from context
-            session = self.mappers.session_from_supabase(session_data, provider)
+            # Always Spotify
+            session = self.mappers.session_from_supabase(session_data, "spotify")
 
-            logger.info("OAuth session refreshed successfully")
+            logger.info("Spotify OAuth session refreshed successfully")
             return session
         except Exception as e:
-            logger.error(f"OAuth session refresh failed: {str(e)}")
-            raise AuthenticationError(f"Session refresh failed: {str(e)}")
+            logger.error(f"Spotify OAuth session refresh failed: {str(e)}")
+            raise AuthenticationError(f"Spotify session refresh failed: {str(e)}")
 
     # Session management
     async def verify_session_token(self, token: str) -> User | None:
@@ -86,9 +83,6 @@ async def verify_session_token(self, token: str) -> User | None:
             if not user_data:
                 return None
 
-            # Determine provider from user metadata or default to spotify
-            provider = user_data.get("app_metadata", {}).get("provider", "spotify")
-
             user = self.mappers.user_from_supabase(user_data)
             logger.debug(f"Session token verified for user: {user.email}")
             return user
@@ -136,114 +130,3 @@ async def get_user_by_auth_id(self, auth_id: str) -> User | None:
         except Exception as e:
             logger.error(f"User lookup by auth_id failed: {str(e)}")
             return None
-
-    # Fallback email/password methods (optional)
-    async def register_user(self, request: RegisterRequest) -> User:
-        """Register a new user with email/password (fallback)."""
-        try:
-            response = await self.client.sign_up_with_email(
-                request.email, request.password
-            )
-
-            if not response.get("user"):
-                raise AuthenticationError("Registration failed: No user returned")
-
-            user = self.mappers.user_from_supabase(response["user"])
-            logger.info(f"User registered successfully: {user.email}")
-            return user
-        except Exception as e:
-            logger.error(f"Registration failed: {str(e)}")
-            if isinstance(e, AuthenticationError):
-                raise
-            raise AuthenticationError(f"Registration failed: {str(e)}")
-
-    async def authenticate_user(self, request: LoginRequest) -> User:
-        """Authenticate user with email/password (fallback)."""
-        try:
-            response = await self.client.sign_in_with_email(
-                request.email, request.password
-            )
-
-            if not response.get("user"):
-                raise AuthenticationError("Authentication failed: Invalid credentials")
-
-            user = self.mappers.user_from_supabase(response["user"])
-            logger.info(f"User authenticated successfully: {user.email}")
-            return user
-        except Exception as e:
-            logger.error(f"Authentication failed: {str(e)}")
-            if isinstance(e, AuthenticationError):
-                raise
-            raise AuthenticationError("Invalid email or password")
-
-    async def generate_tokens(self, user: User, remember_me: bool = False) -> TokenPair:
-        """Generate access and refresh tokens for user."""
-        try:
-            token_data = self.client.generate_jwt_tokens(
-                user.auth_id or user.id, remember_me
-            )
-            tokens = self.mappers.tokens_from_data(token_data)
-            logger.debug(f"Tokens generated for user: {user.email}")
-            return tokens
-        except Exception as e:
-            logger.error(f"Token generation failed: {str(e)}")
-            raise AuthenticationError(f"Token generation failed: {str(e)}")
-
-    async def verify_access_token(self, token: str) -> User | None:
-        """Verify access token and return user."""
-        try:
-            user_data = await self.client.get_user_from_token(token)
-            if not user_data:
-                return None
-
-            user = self.mappers.user_from_supabase(user_data)
-            logger.debug(f"Access token verified for user: {user.email}")
-            return user
-        except Exception as e:
-            logger.warning(f"Access token verification failed: {str(e)}")
-            return None
-
-    async def verify_refresh_token(self, token: str) -> User | None:
-        """Verify refresh token and return user."""
-        try:
-            # For refresh tokens, we verify the JWT structure first
-            user_data = await self.client.get_user_from_token(token)
-            if not user_data:
-                return None
-
-            user = self.mappers.user_from_supabase(user_data)
-            logger.debug(f"Refresh token verified for user: {user.email}")
-            return user
-        except Exception as e:
-            logger.warning(f"Refresh token verification failed: {str(e)}")
-            return None
-
-    async def refresh_tokens(self, refresh_token: str) -> TokenPair:
-        """Generate new tokens from refresh token."""
-        try:
-            # First verify the refresh token
-            user = await self.verify_refresh_token(refresh_token)
-            if not user:
-                raise AuthenticationError("Invalid refresh token")
-
-            # Generate new tokens
-            token_data = self.client.generate_jwt_tokens(user.auth_id or user.id)
-            tokens = self.mappers.tokens_from_data(token_data)
-            logger.info(f"Tokens refreshed for user: {user.email}")
-            return tokens
-        except Exception as e:
-            logger.error(f"Token refresh failed: {str(e)}")
-            if isinstance(e, AuthenticationError):
-                raise
-            raise AuthenticationError(f"Token refresh failed: {str(e)}")
-
-    async def revoke_token(self, token: str) -> bool:
-        """Revoke a token (logout)."""
-        try:
-            result = await self.client.sign_out(token)
-            logger.info("Token revoked successfully")
-            return result
-        except Exception as e:
-            logger.warning(f"Token revocation failed: {str(e)}")
-            # Be permissive with logout
-            return True

backend/src/adapters/auth/supabase/client.py

@@ -1,8 +1,10 @@
 """Supabase client for OAuth authentication."""
 
-from supabase import Client, create_client
+from typing import Any
+
 from src.core.config import AuthConfig, SupabaseConfig
 from src.infrastructure.logging import get_logger
+from supabase import Client, create_client
 
 logger = get_logger("adapters.auth.supabase.client")
 
@@ -29,16 +31,17 @@ async def get_oauth_url(
     ) -> str:
         """Get OAuth authorization URL for the specified provider."""
         try:
-            credentials = {"provider": provider}
+            # Build OAuth credentials for Supabase
+            credentials: dict[str, Any] = {"provider": provider}
             if redirect_url or scopes:
-                options = {}
+                options: dict[str, Any] = {}
                 if redirect_url:
                     options["redirect_to"] = redirect_url
                 if scopes:
                     options["scopes"] = scopes
                 credentials["options"] = options
 
-            response = self.client.auth.sign_in_with_oauth(credentials)
+            response = self.client.auth.sign_in_with_oauth(credentials)  # type: ignore
 
             if hasattr(response, "url") and response.url:
                 logger.info(f"OAuth URL generated for provider: {provider}")
@@ -56,11 +59,11 @@ async def exchange_oauth_code(
         """Exchange OAuth authorization code for session."""
         try:
             # Build code exchange parameters
-            code_params = {"auth_code": code}
+            code_params: dict[str, Any] = {"auth_code": code}
             if code_verifier:
                 code_params["code_verifier"] = code_verifier
 
-            response = self.client.auth.exchange_code_for_session(code_params)
+            response = self.client.auth.exchange_code_for_session(code_params)  # type: ignore
             logger.info("OAuth code exchanged successfully")
             return response.model_dump()
         except Exception as e:
@@ -116,26 +119,3 @@ async def sign_out(self) -> bool:
             logger.warning(f"Sign out failed: {str(e)}")
             # Return True anyway - sign out should be permissive
             return True
-
-    # Fallback email/password methods
-    async def sign_up_with_email(self, email: str, password: str) -> dict:
-        """Sign up user with email and password (fallback)."""
-        try:
-            response = self.client.auth.sign_up({"email": email, "password": password})
-            logger.info(f"User signed up: {email}")
-            return response.model_dump()
-        except Exception as e:
-            logger.error(f"Sign up failed for {email}: {str(e)}")
-            raise
-
-    async def sign_in_with_email(self, email: str, password: str) -> dict:
-        """Sign in user with email and password (fallback)."""
-        try:
-            response = self.client.auth.sign_in_with_password(
-                {"email": email, "password": password}
-            )
-            logger.info(f"User signed in: {email}")
-            return response.model_dump()
-        except Exception as e:
-            logger.error(f"Sign in failed for {email}: {str(e)}")
-            raise

backend/src/adapters/auth/supabase/mappers.py

@@ -1,7 +1,8 @@
 """Mappers to convert Supabase data to domain models."""
 
 from datetime import datetime
-from src.domain.models.auth_session import AuthSession, TokenPair
+
+from src.domain.models.auth_session import AuthSession
 from src.domain.models.user import User
 
 
@@ -38,36 +39,38 @@ def user_from_supabase(supabase_user: dict) -> User:
             is_active=True,  # Supabase users are active by default
         )
 
-    @staticmethod
-    def tokens_from_data(token_data: dict) -> TokenPair:
-        """Convert token data to TokenPair domain model."""
-        return TokenPair(
-            access_token=token_data["access_token"],
-            refresh_token=token_data["refresh_token"],
-            token_type="bearer",
-            expires_in=token_data.get("expires_in", 900),  # Default 15 minutes
-        )
-
-    @staticmethod
-    def tokens_from_supabase_session(session_data: dict) -> TokenPair:
-        """Convert Supabase session to TokenPair domain model."""
-        session = session_data.get("session", {})
-        return TokenPair(
-            access_token=session.get("access_token", ""),
-            refresh_token=session.get("refresh_token", ""),
-            token_type="bearer",
-            expires_in=session.get("expires_in", 3600),  # Supabase default
-        )
-
     @staticmethod
     def session_from_supabase(session_data: dict, provider: str) -> AuthSession:
         """Convert Supabase OAuth session to AuthSession domain model."""
         session = session_data.get("session", {})
         user = session_data.get("user", {})
 
-        # Extract provider token from session
-        provider_token = session.get("provider_token")
-        provider_refresh_token = session.get("provider_refresh_token")
+        # Extract Spotify tokens - check multiple possible locations
+        provider_token = None
+        provider_refresh_token = None
+
+        # Method 1: Direct from session (most common)
+        if session.get("provider_token"):
+            provider_token = session.get("provider_token")
+            provider_refresh_token = session.get("provider_refresh_token")
+
+        # Method 2: From user metadata (alternative location)
+        elif user.get("user_metadata", {}).get("provider_token"):
+            user_metadata = user.get("user_metadata", {})
+            provider_token = user_metadata.get("provider_token")
+            provider_refresh_token = user_metadata.get("provider_refresh_token")
+
+        # Method 3: From app metadata (admin/system tokens)
+        elif user.get("app_metadata", {}).get("provider_token"):
+            app_metadata = user.get("app_metadata", {})
+            provider_token = app_metadata.get("provider_token")
+            provider_refresh_token = app_metadata.get("provider_refresh_token")
+
+        # Method 4: From session user (nested structure)
+        elif session.get("user", {}).get("user_metadata", {}).get("provider_token"):
+            session_user_metadata = session.get("user", {}).get("user_metadata", {})
+            provider_token = session_user_metadata.get("provider_token")
+            provider_refresh_token = session_user_metadata.get("provider_refresh_token")
 
         return AuthSession(
             user_id=user.get("id", ""),