fix: add JWT secret warning and missing security tests

backend/auth/jwt.py

@@ -1,6 +1,7 @@
 import os
 import secrets
 import hashlib
+import warnings
 from datetime import datetime, timedelta, timezone
 from jose import jwt, JWTError
 
@@ -8,6 +9,12 @@ _SECRET = os.getenv("JWT_SECRET", "dev-secret-key-32-chars-minimum!!")
 _ALGORITHM = "HS256"
 _ACCESS_EXPIRE_MINUTES = int(os.getenv("JWT_ACCESS_EXPIRE_MINUTES", "15"))
 
+if _SECRET == "dev-secret-key-32-chars-minimum!!":
+    warnings.warn(
+        "JWT_SECRET is using the insecure development default. Set JWT_SECRET in your environment.",
+        stacklevel=1,
+    )
+
 
 def create_access_token(user_id: str, role: str, batch_id: str | None, email: str) -> str:
     exp = datetime.now(timezone.utc) + timedelta(minutes=_ACCESS_EXPIRE_MINUTES)

tests/test_jwt.py

@@ -28,3 +28,35 @@ def test_refresh_token_hashes_consistently():
     import hashlib
     raw, hashed = generate_refresh_token()
     assert hashlib.sha256(raw.encode()).hexdigest() == hashed
+
+
+def test_expired_token_raises():
+    from datetime import datetime, timedelta, timezone
+    from jose import jwt as jose_jwt
+    import os
+    secret = os.getenv("JWT_SECRET", "dev-secret-key-32-chars-minimum!!")
+    expired_payload = {
+        "user_id": "u1", "role": "student", "batch_id": None, "email": "a@b.com",
+        "exp": datetime.now(timezone.utc) - timedelta(seconds=1),
+    }
+    expired_token = jose_jwt.encode(expired_payload, secret, algorithm="HS256")
+    with pytest.raises(ValueError):
+        verify_access_token(expired_token)
+
+
+def test_wrong_secret_raises():
+    token = create_access_token("u1", "student", None, "a@b.com")
+    from jose import jwt as jose_jwt
+    # Tamper: re-sign with different secret
+    import os
+    wrong_secret = "wrong-secret-completely-different!!"
+    payload = jose_jwt.decode(token, os.getenv("JWT_SECRET", "dev-secret-key-32-chars-minimum!!"), algorithms=["HS256"])
+    tampered = jose_jwt.encode(payload, wrong_secret, algorithm="HS256")
+    with pytest.raises(ValueError):
+        verify_access_token(tampered)
+
+
+def test_batch_id_none_roundtrip():
+    token = create_access_token("u1", "student", None, "a@b.com")
+    payload = verify_access_token(token)
+    assert payload["batch_id"] is None