Merge pull request #35 from tunisiano187/claude/gifted-babbage-hhngmb

fix(deps): replace python-jose with PyJWT, bump aiohttp/cryptography/react-router

Author: tunisiano187

.github/workflows/ci.yml

@@ -25,14 +25,14 @@ jobs:
           pip install --upgrade pip
           # Install only what the tests need — avoids building heavy native
           # extensions (asyncpg, cryptography/bcrypt, etc.) that are mocked.
-          # python-jose and passlib are installed without extras to avoid cffi/C-extension issues.
-          # HS256 only needs Python stdlib hmac; bcrypt is handled by passlib's pbkdf2 fallback.
+          # PyJWT uses stdlib hmac for HS256 — no cffi/C-extension needed.
+          # bcrypt is handled by passlib's pbkdf2 fallback in test environments.
           pip install \
             pytest>=8 pytest-asyncio>=0.23 httpx>=0.27 ruff>=0.4 \
             fastapi>=0.111 pydantic>=2.7 "pydantic-settings>=2.3" \
             "sqlalchemy[asyncio]>=2.0" pyyaml>=6.0 \
             jinja2>=3.1 \
-            "passlib>=1.7" "python-jose>=3.3" "ecdsa>=0.18" "rsa>=4.0"
+            "passlib>=1.7" "PyJWT>=2.9"
 
       - name: Lint (ruff)
         run: ruff check .
@@ -194,8 +194,8 @@ jobs:
             fastapi>=0.111 pydantic>=2.7 "pydantic-settings>=2.3" \
             "sqlalchemy[asyncio]>=2.0" "asyncpg>=0.29" "alembic>=1.13" \
             pyyaml>=6.0 jinja2>=3.1 \
-            "passlib>=1.7" "python-jose>=3.3" "ecdsa>=0.18" "rsa>=4.0" \
-            "cryptography>=42"
+            "passlib>=1.7" "PyJWT>=2.9" \
+            "cryptography>=50"
 
       - name: Run Alembic migrations
         run: alembic upgrade head

pyproject.toml

@@ -25,11 +25,11 @@ dependencies = [
     "httpx>=0.27",
 
     # Auth
-    "python-jose[cryptography]>=3.3",
+    "PyJWT>=2.9",
     "passlib[bcrypt]>=1.7",
 
     # Crypto (CA / mTLS)
-    "cryptography>=42",
+    "cryptography>=50",
 
     # Redis
     "redis>=5.0",

server/services/auth.py

@@ -34,7 +34,8 @@ async def delete_user(user: str = Depends(require_min_role("admin"))):
 from fastapi import Depends, HTTPException, status
 from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
 
-from jose import JWTError, jwt
+import jwt
+from jwt.exceptions import InvalidTokenError as JWTError
 from passlib.context import CryptContext
 
 logger = logging.getLogger(__name__)

tests/conftest.py

@@ -27,14 +27,17 @@ def _stub_module(name: str) -> MagicMock:
     if _name not in sys.modules:
         _stub_module(_name)
 
-# Stub jose and passlib ONLY when the native cryptography extension is broken.
+# Stub passlib ONLY when the native cryptography extension is broken.
 #
 # In CI (GitHub Actions) all packages are properly installed and working.
 # In the dev container the `cryptography` Rust extension (loaded via _cffi_backend)
-# is broken — importing jose triggers a Rust thread panic (PanicException).
+# is broken — importing passlib[bcrypt] triggers a Rust thread panic (PanicException).
+#
+# PyJWT (our JWT library) uses stdlib hmac for HS256 and does NOT require cffi,
+# so it works even in broken-cffi environments — no stub needed for jwt.
 #
 # We detect the broken environment by probing _cffi_backend with a plain
-# ImportError (not a Rust panic) BEFORE touching jose/cryptography.
+# ImportError (not a Rust panic) BEFORE touching passlib/cryptography.
 
 def _cffi_available() -> bool:
     """Return True if the _cffi_backend C extension loads cleanly."""
@@ -46,27 +49,8 @@ def _cffi_available() -> bool:
 
 
 if not _cffi_available():
-    # Native crypto stack is broken — stub jose and passlib so auth-service
-    # imports work without the cryptography native extension.
-    import json as _json
-    from datetime import datetime as _datetime
-
-    _jose = _stub_module("jose")
-    _jose.JWTError = Exception
-
-    def _fake_jwt_encode(payload, *args, **kwargs):
-        safe = {k: v.isoformat() if isinstance(v, _datetime) else v for k, v in payload.items()}
-        return _json.dumps(safe)
-
-    def _fake_jwt_decode(token, *args, **kwargs):
-        return _json.loads(token)
-
-    _jose.jwt = MagicMock()
-    _jose.jwt.encode = _fake_jwt_encode
-    _jose.jwt.decode = _fake_jwt_decode
-    _stub_module("jose.jwt")
-    _stub_module("jose.exceptions")
-
+    # Native crypto stack is broken — stub passlib so auth-service imports
+    # work without the cryptography native extension.
     _passlib = _stub_module("passlib")
     _passlib_ctx = _stub_module("passlib.context")
     _ctx_cls = MagicMock()

tests/test_auth.py

@@ -44,7 +44,7 @@ def test_role_preserved(self) -> None:
 
     def test_legacy_token_defaults_to_admin(self) -> None:
         """Tokens without a role claim (pre-RBAC) are treated as admin."""
-        from jose import jwt
+        import jwt
         from datetime import datetime, timedelta, timezone
 
         payload = {

ui/package-lock.json

@@ -11,7 +11,7 @@
   "dependencies": {
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
-    "react-router-dom": "^6.30.4"
+    "react-router-dom": "^7.18.2"
   },
   "devDependencies": {
     "@types/react": "^18.3.28",