Repository: aipotheosis-labs/aci
File: aipolabs/server/routes/auth.py (Python)

Code before:
                profile_picture=user_info["picture"],
            ),
        )
        _onboard_new_user(db_session, user)

        db_session.commit()

    # Generate JWT token for the user
    # TODO: try/except, retry?
    jwt_token = create_access_token(
        str(user.id),
        timedelta(minutes=config.JWT_ACCESS_TOKEN_EXPIRE_MINUTES),
    )
    logger.debug(
        f"JWT generated successfully for user={user.id}, jwt_token={jwt_token[:4]}...{jwt_token[-4:]}"
    )

    return AuthResponse(access_token=jwt_token, token_type="bearer", user_id=user.id)


# TODO: For the Feb 2025 release, we decided to create default project (and agent, api key, app confiiguration, etc)
# for new users to decrease friction of onboarding. Need to revisit if we should keep this (or some of it)
# for the future releases.
def _onboard_new_user(db_session: Session, user: User) -> None:
    logger.info(f"onboarding new user={user.id}")
    project = crud.projects.create_project(db_session, owner_id=user.id, name="Default Project")
    logger.info(f"created default project={project.id} for user={user.id}")
    agent = crud.projects.create_agent(
        db_session,
        project.id,
        name="Default Agent",
        description="Default Agent",
        excluded_apps=[],
        excluded_functions=[],
    )
    logger.info(f"created default agent={agent.id} for project={project.id}")


Review comment (bug):
the JWT_ACCESS_TOKEN_EXPIRE_MINUTES is the time interval in minute. Currently set as 1440 so by itself it means 24 hours.

and is the max_age here used as an expiration time for the JWT http bearer token? The JWT token when issued by us already have a expiration time (valid for JWT_ACCESS_TOKEN_EXPIRE_MINUTES), and it was checked in validate_http_bearer when calling `payload.validate()`. Having another expiration rule here might lead to conflicting behaviours. (and confuse reader of codebase too). Is there a common approach for resolving this issue, or is it ok because cookie is handled by browser and JWT token validation is more like a failsafe on our side.

Btw, i assume you wanted to set the value to 60 minutes? consider longer value (like the current one 24h) because we don't have a way to refresh token yet. Otherwise user need to login every 1 hour.


Code after:
                email=user_info["email"],
                profile_picture=user_info["picture"],
            ),
        )
        _onboard_new_user(db_session, user)

        db_session.commit()

    # Generate JWT token for the user
    # TODO: try/except, retry?
    jwt_token = create_access_token(
        str(user.id),
        timedelta(minutes=config.JWT_ACCESS_TOKEN_EXPIRE_MINUTES),
    )
    logger.debug(
        f"JWT generated successfully for user={user.id}, jwt_token={jwt_token[:4]}...{jwt_token[-4:]}"
    )

    response = RedirectResponse(url=f"{config.DEV_PORTAL_URL}")
    response.set_cookie(
        key="accessToken",
        value=jwt_token,
        # httponly=True, # TODO: set after initial release
        # secure=True, # TODO: set after initial release
        samesite="lax",
        max_age=config.JWT_ACCESS_TOKEN_EXPIRE_MINUTES * 60,
    )
    return response


# TODO: For the Feb 2025 release, we decided to create default project (and agent, api key, app confiiguration, etc)
# for new users to decrease friction of onboarding. Need to revisit if we should keep this (or some of it)
# for the future releases.
def _onboard_new_user(db_session: Session, user: User) -> None:
    logger.info(f"onboarding new user={user.id}")
    project = crud.projects.create_project(db_session, owner_id=user.id, name="Default Project")
    logger.info(f"created default project={project.id} for user={user.id}")
    agent = crud.projects.create_agent(
        db_session,
        project.id,
        name="Default Agent",
        description="Default Agent",
        excluded_apps=[],
        excluded_functions=[],
    )
    logger.info(f"created default agent={agent.id} for project={project.id}")