Skip to content

# AUTH_SERVICE_FIX

## Overview

The auth-service (FastAPI + asyncpg) is responsible for registration, login, JWT issuance and token introspection for the entire DAARION stack. A 500 error was triggered because the configured Postgres database (`postgresql://.../daarion`) did not exist on NODE1, so every `/api/auth/login` call failed with `asyncpg.exceptions.InvalidCatalogNameError`. The fix introduced:

- creation of the `daarion` database inside `dagi-postgres`;
- execution of migration `011_create_auth_tables.sql` to provision the schema;
- addition of admin/test accounts via `/api/auth/register`;
- resilient configuration that supports both `AUTH_*` and legacy env names;
- smoke-tested register/login/refresh/me flows.

## Environment variables

Name(s) | Purpose
--- | ---
`AUTH_DATABASE_URL` / `DATABASE_URL` | Postgres DSN (`postgresql://postgres:postgres@dagi-postgres:5432/daarion`)
`AUTH_JWT_SECRET` / `JWT_SECRET` | HMAC secret for both access & refresh tokens
`AUTH_JWT_ALGORITHM` / `JWT_ALGO` / `JWT_ALGORITHM` | JWT signing algorithm (`HS256`)
`AUTH_ACCESS_TOKEN_TTL` / `ACCESS_TOKEN_TTL` | Access token lifetime in seconds (default 1800)
`AUTH_REFRESH_TOKEN_TTL` / `REFRESH_TOKEN_TTL` | Refresh token lifetime in seconds (default 604800)
`AUTH_PORT` / `PORT` | Service port (default `7020`)
`AUTH_DEBUG` / `DEBUG` | Toggle FastAPI reload/logging
`AUTH_BCRYPT_ROUNDS` / `BCRYPT_ROUNDS` | Cost factor for password hashing
`SYNAPSE_ADMIN_URL` | Matrix admin endpoint (defaults to `http://daarion-synapse:8008`)
`SYNAPSE_REGISTRATION_SECRET` | Shared secret for Matrix auto-provisioning

⚠️ The config module now checks both `AUTH_*` and legacy names so existing docker-compose files continue to work.

## Database schema (minimal)

`migrations/011_create_auth_tables.sql` must be applied to the `daarion` database. Core tables:

- `auth_users` — user profile + status flags (`is_active`, `is_admin`).
- `auth_roles` + `auth_user_roles` — role definitions/mapping (default roles inserted by migration).
- `auth_sessions` — refresh-token sessions (with `expires_at` & `revoked_at`).

Commands executed on NODE1:

    docker exec dagi-postgres psql -U postgres -c "CREATE DATABASE daarion;"
    docker cp migrations/011_create_auth_tables.sql dagi-postgres:/tmp/011.sql
    docker exec dagi-postgres psql -U postgres -d daarion -f /tmp/011.sql

## Endpoints

Method | Path | Description
--- | --- | ---
`GET` | `/healthz` | Returns `{ "status": "ok" }` when DB + settings are valid
`POST` | `/api/auth/register` | Creates a user, hashes password, provisions Matrix user (`matrix_user_id` in response)
`POST` | `/api/auth/login` | Issues `access_token`, `refresh_token`, returns user payload + roles
`POST` | `/api/auth/refresh` | Validates refresh token/session and rotates tokens
`POST` | `/api/auth/logout` | Revokes refresh token/session
`GET` | `/api/auth/me` | Reads user profile using `Authorization: Bearer <access_token>`
`POST` | `/api/auth/introspect` | Validates any access token (for internal services)

## JWT token

    {
      "sub": "e4ea9638-a845-49b8-bd84-41deb3971ee0",
      "email": "admin@daarion.space",
      "name": "Admin",
      "roles": ["user", "admin"],
      "type": "access",
      "iss": "daarion-auth",
      "exp": 1764244050
    }

Gateway & frontend:

- Pass `Authorization: Bearer <access_token>` to protected endpoints.
- Extract `sub` as `user_id`, `roles` for RBAC, and (optionally) fetch `matrix_user_id` from `/api/auth/register` response or the user profile.

## Smoke test flow

1. Register:
   `curl -X POST http://<auth-host>:7020/api/auth/register -d '{"email":"user@daarion.space","password":"Password123!","display_name":"User"}'`
2. Login:
   `curl -X POST http://<auth-host>:7020/api/auth/login -d '{"email":"user@daarion.space","password":"Password123!"}'`
3. Authorize requests:
   `curl http://<auth-host>:7020/api/auth/me -H "Authorization: Bearer <access_token>"`
4. Matrix heartbeat:
   After login in the web UI, `usePresenceHeartbeat` calls `/api/internal/matrix/presence/online` with the issued token, and `matrix-presence-aggregator` sees non-zero online counts.

With these fixes the auth-service is stable, compatible with matrix-gateway, and ready for the next milestone (2D City Map + Agent Presence).