Michael Chihlas
b21d2fc234
Fourth commit in the session-expiration-policy series. The gate that ends "logged in forever" — refresh now rejects tokens whose original login (auth_time) is older than abs_max seconds. Algorithm (plan §4.5): 1. Decode JWT (dep already handles idle expiry). 2. Load user; reject inactive/missing as invalid_refresh_token. 3. Resolve effective auth_time/idle_max/abs_max, grandfathering pre-PR tokens by snapshotting current account policy. 4. Atomically revoke the JTI regardless of outcome — this consumes the token whether or not the absolute check passes, so an absolute-expired token cannot be replayed forever. 5. If the atomic UPDATE matched zero rows -> invalid_refresh_token. 6. If now >= auth_time + abs_max -> commit the revoke explicitly (so it survives the rollback hook in get_admin_db) and 401 session_expired_absolute. 7. Otherwise mint via _mint_with_claims, carrying claims forward. Boundary check uses `>=`, not `>` — a deadline equal to now is expired. _refresh_session_tokens (commit 3) replaced by two narrower helpers: _resolve_refresh_claims (grandfather logic, no mint) and _mint_with_claims (mint with explicit claims, no grandfather). Makes the endpoint's algorithm read top-down without indirection. Tests added in test_session_policy.py: - #8: backdate auth_time by exactly abs_max -> session_expired_absolute at the deadline boundary. - #9: same token tried twice; first returns session_expired_absolute AND consumes the row; second returns invalid_refresh_token. - #12: legacy token without auth_time/idle_max/abs_max gets one successful rotation; new JWT carries fresh policy snapshot from the account (3d/14d defaults under Strict). 25/25 across test_session_policy + test_auth + test_oauth_callbacks. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Troubleshooting Decision Tree - Backend API
FastAPI backend for the Troubleshooting Decision Tree application.
Quick Start
1. Set up Python environment
cd backend
python -m venv venv
# Windows
venv\Scripts\activate
# macOS/Linux
source venv/bin/activate
pip install -r requirements.txt
2. Start PostgreSQL database
Using Docker:
docker-compose up -d
Or install PostgreSQL locally and create a database:
CREATE DATABASE decision_tree;
3. Configure environment
Copy the example env file and update as needed:
cp .env.example .env
4. Run database migrations
alembic upgrade head
5. Start the server
uvicorn app.main:app --reload --host 0.0.0.0 --port 8000
The API will be available at:
- API: http://localhost:8000
- Docs: http://localhost:8000/api/docs
- ReDoc: http://localhost:8000/api/redoc
API Endpoints
Authentication
POST /api/v1/auth/register- Register new userPOST /api/v1/auth/login- Login (form data)POST /api/v1/auth/login/json- Login (JSON body)POST /api/v1/auth/refresh- Refresh tokenGET /api/v1/auth/me- Get current userPOST /api/v1/auth/logout- Logout
Trees
GET /api/v1/trees- List all treesGET /api/v1/trees/categories- List categoriesGET /api/v1/trees/search?q=query- Search treesGET /api/v1/trees/{id}- Get specific treePOST /api/v1/trees- Create tree (engineer/admin)PUT /api/v1/trees/{id}- Update tree (engineer/admin)DELETE /api/v1/trees/{id}- Delete tree (admin)
Sessions
GET /api/v1/sessions- List user's sessionsGET /api/v1/sessions/{id}- Get specific sessionPOST /api/v1/sessions- Start new sessionPUT /api/v1/sessions/{id}- Update sessionPOST /api/v1/sessions/{id}/complete- Complete sessionPOST /api/v1/sessions/{id}/export- Export session
Development
Create new migration
alembic revision --autogenerate -m "description"
Run migrations
alembic upgrade head
Rollback migration
alembic downgrade -1
Project Structure
backend/
├── alembic/ # Database migrations
│ └── versions/
├── app/
│ ├── api/
│ │ ├── endpoints/ # API route handlers
│ │ ├── deps.py # Dependencies (auth, etc.)
│ │ └── router.py # Main router
│ ├── core/
│ │ ├── config.py # Settings
│ │ ├── database.py # DB connection
│ │ └── security.py # JWT, password hashing
│ ├── models/ # SQLAlchemy models
│ ├── schemas/ # Pydantic schemas
│ └── main.py # FastAPI app
├── tests/
├── alembic.ini
├── docker-compose.yml
├── requirements.txt
└── README.md