ali_mohaghegh 3cd76d335f fix(auth): Casdoor JWT verification and 401 semantics; add /auth/login password-grant endpoint ...

- verify kid from the JWT header (pyjwt decode() returns claims, not the
  header — the old lookup was always None and rejected every token)
- convert JWK entries to crypto keys explicitly (pyjwt 2.13 dropped dict
  keys) and fetch the JWKS from /.well-known/jwks
- 401 for missing/invalid/expired/wrong-issuer/wrong-audience tokens
  (was 403/400); 403 stays for valid-but-roleless users; 503 when Casdoor
  is unreachable; new CASDOOR_ISSUER setting separates the in-network
  endpoint from the browser-facing issuer
- dev-header fallback in inventory/pm scopes now requires an explicit
  X-User-Role header (no auth info at all -> 401)
- new POST /api/v1/auth/login: password grant against Casdoor, local JWT
  verification, auto-provisioning, returns token + profile with the role
  resolved from the app users table

2026-08-29 14:43:49 +03:30

..

__init__.py

feat(backend): add FastAPI backend — procurement, inventory domain, Casdoor auth, PM arrival endpoints

2026-08-25 19:08:14 +03:30

errors.py

fix(auth): Casdoor JWT verification and 401 semantics; add /auth/login password-grant endpoint

2026-08-29 14:43:49 +03:30

pagination.py

feat(backend): add FastAPI backend — procurement, inventory domain, Casdoor auth, PM arrival endpoints

2026-08-25 19:08:14 +03:30

security.py

feat(backend): add FastAPI backend — procurement, inventory domain, Casdoor auth, PM arrival endpoints

2026-08-25 19:08:14 +03:30

serialization.py

feat(backend): add FastAPI backend — procurement, inventory domain, Casdoor auth, PM arrival endpoints

2026-08-25 19:08:14 +03:30