From 6d78aefa623c1e2789056e6d08b1d70222b22c97 Mon Sep 17 00:00:00 2001
From: gustavoschaedler <gustavopoa@gmail.com>
Date: Tue, 20 Jun 2023 00:19:30 +0100
Subject: [PATCH] Add random SECRET_KEY to test

Changed the SECRET_KEY to a randomly generated one using the command `openssl rand -hex 32`. Additionally, added code to raise an exception when facing JWTError in `get_current_user`. Added a new user in `fake_users_db` who is currently disabled. Finally, changed the endpoint to show all users instead of `me`.
---
 src/backend/langflow/auth/auth.py     | 11 ++++++++---
 src/backend/langflow/models/user.py   | 17 ++++++++++++-----
 src/backend/langflow/routers/items.py |  9 +++++++--
 3 files changed, 27 insertions(+), 10 deletions(-)

diff --git a/src/backend/langflow/auth/auth.py b/src/backend/langflow/auth/auth.py
index 503b2bd5b..ec45d48f4 100644
--- a/src/backend/langflow/auth/auth.py
+++ b/src/backend/langflow/auth/auth.py
@@ -9,7 +9,9 @@ from ..models.token import TokenData
 from ..models.user import get_user, fake_users_db, User
 
 
-SECRET_KEY = "your_secret_key"
+# to get a string like this run:
+# openssl rand -hex 32
+SECRET_KEY = "698619adad2d916f1f32d264540976964b3c0d3828e0870a65add5800a8cc6b9"
 ALGORITHM = "HS256"
 ACCESS_TOKEN_EXPIRE_MINUTES = 30
 
@@ -37,6 +39,7 @@ def create_access_token(data: dict, expires_delta: timedelta = None):
 
 def authenticate_user(fake_db, username: str, password: str):
     user = get_user(fake_db, username)
+    
     if not user:
         return False
     if not verify_password(password, user.hashed_password):
@@ -50,14 +53,16 @@ async def get_current_user(token: Annotated[str, Depends(oauth2_scheme)]):
         detail="Could not validate credentials",
         headers={"WWW-Authenticate": "Bearer"},
     )
+    
     try:
         payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
         username: str = payload.get("sub")
         if username is None:
             raise credentials_exception
         token_data = TokenData(username=username)
-    except JWTError:
-        raise credentials_exception
+    except JWTError as e:
+        raise credentials_exception from e
+
     user = get_user(fake_users_db, username=token_data.username)
     if user is None:
         raise credentials_exception
diff --git a/src/backend/langflow/models/user.py b/src/backend/langflow/models/user.py
index 1023a6a65..c47c85464 100644
--- a/src/backend/langflow/models/user.py
+++ b/src/backend/langflow/models/user.py
@@ -13,12 +13,19 @@ class UserInDB(User):
 
 
 fake_users_db = {
-    "johndoe": {
-        "username": "johndoe",
-        "full_name": "John Doe",
-        "email": "johndoe@example.com",
-        "hashed_password": "$2b$12$EixZaYVK1fsbw1ZfbX3OXePaWxn96p36WQoeG6Lruj3vjPGga31lW",
+    "gustavo": {
+        "username": "gustavo",
+        "full_name": "Gustavo Schaedler",
+        "email": "gustavopoa@gmail.com",
+        "hashed_password": "$2b$12$f4R8IHUaVxVchhpWrwhckeJXnPalW1vUbJzcvb1KeovJcuMwE861K", #secret
         "disabled": False,
+    },
+    "gustavo_disabled": {
+        "username": "gustavo_disabled",
+        "full_name": "Gustavo Disabled",
+        "email": "gustavo_disabled@gmail.com",
+        "hashed_password": "$2b$12$f4R8IHUaVxVchhpWrwhckeJXnPalW1vUbJzcvb1KeovJcuMwE861K", #secret
+        "disabled": True,
     }
 }
 
diff --git a/src/backend/langflow/routers/items.py b/src/backend/langflow/routers/items.py
index e6d21340e..7ca1ff320 100644
--- a/src/backend/langflow/routers/items.py
+++ b/src/backend/langflow/routers/items.py
@@ -5,8 +5,13 @@ from ..auth.auth import get_current_active_user
 router = APIRouter()
 
 
-@router.get("/users/me/items/")
+@router.get("/users/all/")
 async def read_own_items(
   current_user: User = Depends(get_current_active_user)
 ):
-    return [{"item_id": "Foo", "owner": current_user.username}]
+    return [
+      {
+        "item_id": "my_id",
+        "owner": current_user.username
+      }
+    ]