feat: add session secret warning and improve device auth token consumption logic

Author: Zingzy

app.py

@@ -124,6 +124,14 @@ async def lifespan(app: FastAPI) -> AsyncIterator[None]:
 
         await ensure_indexes(app.state.db)
 
+        # Warn if session secret is missing when auth is enabled
+        if settings.jwt and not settings.secret_key:
+            log.warning(
+                "secret_key_empty",
+                detail="SECRET_KEY is empty — session cookies are unsigned. "
+                "Set a strong SECRET_KEY when auth/OAuth is enabled.",
+            )
+
         # Warn if CORS private origins not configured in production
         if settings.is_production and not settings.cors_private_origins:
             log.warning(

repositories/token_repository.py

@@ -59,6 +59,34 @@ async def find_by_hash_and_type(
             )
             raise
 
+    async def consume_by_hash(
+        self, token_hash: str, token_type: str
+    ) -> VerificationTokenDoc | None:
+        """Atomically find an unused, non-expired token and mark it as used.
+
+        Returns the pre-update document, or None if no matching token exists.
+        """
+        now = datetime.now(timezone.utc)
+        try:
+            doc = await self._col.find_one_and_update(
+                {
+                    "token_hash": token_hash,
+                    "token_type": token_type,
+                    "used_at": None,
+                    "expires_at": {"$gt": now},
+                },
+                {"$set": {"used_at": now}},
+            )
+            return VerificationTokenDoc.from_mongo(doc)
+        except PyMongoError as exc:
+            log.error(
+                "token_repo_consume_by_hash_failed",
+                token_type=token_type,
+                error=str(exc),
+                error_type=type(exc).__name__,
+            )
+            raise
+
     async def mark_as_used(self, token_id: ObjectId) -> bool:
         """
         Mark a token as consumed by setting ``used_at`` to now.

schemas/dto/requests/auth.py

@@ -122,5 +122,7 @@ class DeviceTokenRequest(BaseModel):
     model_config = ConfigDict(populate_by_name=True)
 
     code: str = Field(
+        min_length=1,
+        max_length=128,
         description="One-time auth code from the device callback page",
     )

services/auth_service.py

@@ -627,23 +627,12 @@ async def exchange_device_code(self, code: str) -> tuple[UserDoc, str, str]:
             AuthenticationError: Code invalid, expired, or already used.
         """
         token_hash = hash_token(code)
-        token_doc = await self._token_repo.find_by_hash_and_type(
+        token_doc = await self._token_repo.consume_by_hash(
             token_hash, TOKEN_TYPE_DEVICE_AUTH
         )
         if not token_doc:
             raise AuthenticationError("invalid or expired device auth code")
 
-        expires_at = token_doc.expires_at
-        if not expires_at.tzinfo:
-            expires_at = expires_at.replace(tzinfo=timezone.utc)
-
-        if expires_at <= datetime.now(timezone.utc):
-            raise AuthenticationError("device auth code has expired")
-
-        marked = await self._token_repo.mark_as_used(token_doc.id)
-        if not marked:
-            raise AppError("failed to consume device auth code")
-
         user = await self._user_repo.find_by_id(token_doc.user_id)
         if not user or user.status != UserStatus.ACTIVE:
             raise AuthenticationError("user not found or inactive")

tests/unit/services/test_auth_service.py

@@ -884,47 +884,27 @@ async def test_exchange_device_code_success(self):
                 "attempts": 0,
             }
         )
-        svc._token_repo.find_by_hash_and_type.return_value = token_doc
-        svc._token_repo.mark_as_used.return_value = True
+        svc._token_repo.consume_by_hash.return_value = token_doc
         svc._user_repo.find_by_id.return_value = make_user_doc(email_verified=True)
 
         _user, access, refresh = await svc.exchange_device_code(raw_code)
         assert isinstance(access, str)
         assert isinstance(refresh, str)
-        svc._token_repo.mark_as_used.assert_awaited_once()
+        svc._token_repo.consume_by_hash.assert_awaited_once()
 
     @pytest.mark.asyncio
     async def test_exchange_device_code_invalid(self):
         svc = make_auth_service()
-        svc._token_repo.find_by_hash_and_type.return_value = None
+        svc._token_repo.consume_by_hash.return_value = None
 
         with pytest.raises(AuthenticationError, match="invalid or expired"):
             await svc.exchange_device_code("bad-code")
 
     @pytest.mark.asyncio
     async def test_exchange_device_code_expired(self):
-        from datetime import timedelta
-
-        from schemas.models.token import TOKEN_TYPE_DEVICE_AUTH, VerificationTokenDoc
-        from shared.crypto import hash_token
-
+        """Expired codes are filtered out by consume_by_hash (expires_at in query)."""
         svc = make_auth_service()
-        raw_code = "expired-code"
-        past = datetime(2020, 1, 1, tzinfo=timezone.utc)
-        token_doc = VerificationTokenDoc.from_mongo(
-            {
-                "_id": ObjectId(),
-                "user_id": USER_OID,
-                "email": "test@example.com",
-                "token_hash": hash_token(raw_code),
-                "token_type": TOKEN_TYPE_DEVICE_AUTH,
-                "expires_at": past,
-                "created_at": past - timedelta(minutes=5),
-                "used_at": None,
-                "attempts": 0,
-            }
-        )
-        svc._token_repo.find_by_hash_and_type.return_value = token_doc
+        svc._token_repo.consume_by_hash.return_value = None
 
-        with pytest.raises(AuthenticationError, match="expired"):
-            await svc.exchange_device_code(raw_code)
+        with pytest.raises(AuthenticationError, match="invalid or expired"):
+            await svc.exchange_device_code("expired-code")