fix: auth quality issues — token cleanup, delete_cookie params, broad exception catch, dead import

backend/auth/deps.py

@@ -8,7 +8,7 @@ oauth2_scheme = OAuth2PasswordBearer(tokenUrl="/api/auth/login")
 async def get_current_user(token: str = Depends(oauth2_scheme)) -> dict:
     try:
         return verify_access_token(token)
-    except ValueError:
+    except Exception:
         raise HTTPException(status_code=401, detail="Invalid or expired token")
 
 

backend/db/queries.py

@@ -72,3 +72,10 @@ async def delete_refresh_token(token_hash: str) -> None:
         await conn.execute(
             "DELETE FROM refresh_tokens WHERE token_hash = $1", token_hash
         )
+
+
+async def delete_old_refresh_tokens(user_id: str) -> None:
+    async with get_pool().acquire() as conn:
+        await conn.execute(
+            "DELETE FROM refresh_tokens WHERE user_id = $1", user_id
+        )

backend/main.py

@@ -1,6 +1,5 @@
 from contextlib import asynccontextmanager
 from fastapi import FastAPI
-from fastapi.staticfiles import StaticFiles
 
 from backend.db.connection import init_db_pool
 from backend.routers import auth

backend/routers/auth.py

@@ -59,6 +59,7 @@ async def _issue_tokens(response: Response, user: dict) -> AuthResponse:
     )
     raw, hashed = generate_refresh_token()
     expires_at = datetime.now(timezone.utc) + timedelta(days=_REFRESH_EXPIRE_DAYS)
+    await queries.delete_old_refresh_tokens(str(user["id"]))
     await queries.create_refresh_token(str(user["id"]), hashed, expires_at)
     _set_refresh_cookie(response, raw)
     return AuthResponse(
@@ -126,5 +127,10 @@ async def logout(response: Response, refresh_token: Optional[str] = Cookie(None)
     if refresh_token:
         token_hash = hashlib.sha256(refresh_token.encode()).hexdigest()
         await queries.delete_refresh_token(token_hash)
-    response.delete_cookie("refresh_token")
+    response.delete_cookie(
+        "refresh_token",
+        httponly=True,
+        samesite="lax",
+        secure=os.getenv("APP_URL", "").startswith("https"),
+    )
     return {"ok": True}