Repository: aipotheosis-labs/aci
File: aipolabs/server/routes/auth.py (Python)

Code before:
    )
    logger.debug(
        "JWT generated successfully",
        extra={"user_id": user.id, "jwt_token": jwt_token[:4] + "..." + jwt_token[-4:]},
    )

    response = RedirectResponse(url=f"{config.DEV_PORTAL_URL}")
    response.set_cookie(
        # TODO: need to get rid of this when we switch to secure http cookie authentication
        # Allow the frontend domain to see the accessToken as well
        domain=config.AIPOLABS_ROOT_DOMAIN,
        key="accessToken",
        value=jwt_token,
        # httponly=True, # TODO: set after initial release
        # secure=True, # TODO: set after initial release
        samesite="lax",
        max_age=config.JWT_ACCESS_TOKEN_EXPIRE_MINUTES * 60,
    )
    return response


@router.post("/logout/", include_in_schema=True)
async def logout() -> Response:
    response = Response(status_code=status.HTTP_200_OK)
    response.delete_cookie(
        key="accessToken",
        domain=config.AIPOLABS_ROOT_DOMAIN,
        samesite="lax",
    )
    return response


# TODO: For the Feb 2025 release, we decided to create default project (and agent, api key, app confiiguration, etc)
# for new users to decrease friction of onboarding. Need to revisit if we should keep this (or some of it)
# for the future releases.
def _onboard_new_user(db_session: Session, user: User) -> None:
    logger.info(
        "onboarding new user",
        extra={"user_id": user.id},
    )
    project = crud.projects.create_project(db_session, owner_id=user.id, name="Default Project")
    logger.info(
        "created default project",
        extra={"project_id": project.id, "user_id": user.id},
    )
    agent = crud.projects.create_agent(
        db_session,
        project.id,
        name="Default Agent",
        description="Default Agent",
        excluded_apps=[],

Review comment (security):
now that `accessToken` is used in multiple places (including test), it might be the time to move this to config file and access it with something like config.COOKIE_KEY_FOR_AUTH_TOKEN 

Code after:
    )
    logger.debug(
        "JWT generated successfully",
        extra={"user_id": user.id, "jwt_token": jwt_token[:4] + "..." + jwt_token[-4:]},
    )

    response = RedirectResponse(url=f"{config.DEV_PORTAL_URL}")
    response.set_cookie(
        # TODO: need to get rid of this when we switch to secure http cookie authentication
        # Allow the dev portal domain to see the cookie as well
        domain=config.AIPOLABS_ROOT_DOMAIN,
        key=config.COOKIE_KEY_FOR_AUTH_TOKEN,
        value=jwt_token,
        # httponly=True, # TODO: set after initial release
        # secure=True, # TODO: set after initial release
        samesite="lax",
        max_age=config.JWT_ACCESS_TOKEN_EXPIRE_MINUTES * 60,
    )
    return response


@router.post("/logout/", include_in_schema=True)
async def logout() -> Response:
    response = Response(status_code=status.HTTP_200_OK)
    response.delete_cookie(
        key=config.COOKIE_KEY_FOR_AUTH_TOKEN,
        domain=config.AIPOLABS_ROOT_DOMAIN,
        samesite="lax",
    )
    return response


# TODO: For the Feb 2025 release, we decided to create default project (and agent, api key, app confiiguration, etc)
# for new users to decrease friction of onboarding. Need to revisit if we should keep this (or some of it)
# for the future releases.
def _onboard_new_user(db_session: Session, user: User) -> None:
    logger.info(
        "onboarding new user",
        extra={"user_id": user.id},
    )
    project = crud.projects.create_project(db_session, owner_id=user.id, name="Default Project")
    logger.info(
        "created default project",
        extra={"project_id": project.id, "user_id": user.id},
    )
    agent = crud.projects.create_agent(
        db_session,
        project.id,
        name="Default Agent",
        description="Default Agent",
        excluded_apps=[],