refactor(backend): Improve auth setup & OpenAPI generation (#10720)

Our current auth setup (`autogpt_libs.auth` + its usage) is quite
inconsistent and doesn't do all of its jobs properly. The 401 responses
you get when unauthenticated are not included in the OpenAPI spec,
causing these to be unaccounted for in the generated frontend API
client. Usage of the FastAPI dependencies supplied by
`autogpt_libs.auth.depends` aren't consistently used the same way,
making maintenance on these hard to oversee. API tests use many
different ways to get around the auth requirement, making this also hard
to maintain and oversee.
This pull request aims to fix all of this and give us a consistent,
clean, and self-documenting API auth implementation.

- Resolves #10715

### Changes 🏗️

- Homogenize use of `autogpt_libs.auth` security dependencies throughout
the backend
- Fix OpenAPI schema generation for 401 responses
  - Handle possible 401 responses in frontend
- Tighten validation and add warnings for weak settings in
`autogpt_libs.auth.config`
- Increase test coverage for `autogpt_libs.auth` to 100%
- Standardize auth setup for API tests
- Rename `APIKeyValidator` to `APIKeyAuthenticator` and move to its own
module in `backend.server`

### Checklist 📋

#### For code changes:
- [x] I have clearly listed my changes in the PR description
- [x] I have made a test plan
- [x] I have tested my changes according to the test plan:
  - [x] All tests for `autogpt_libs.auth` pass
  - [x] All tests for `backend.server` pass
  - [x] @ntindle does a security audit for these changes
- [x] OpenAPI spec for authenticated routes is generated with the
appropriate `401` response

---------

Co-authored-by: Nicholas Tindle <nicholas.tindle@agpt.co>

.github/workflows/platform-backend-ci.yml

@@ -201,7 +201,7 @@ jobs:
           DIRECT_URL: ${{ steps.supabase.outputs.DB_URL }}
           SUPABASE_URL: ${{ steps.supabase.outputs.API_URL }}
           SUPABASE_SERVICE_ROLE_KEY: ${{ steps.supabase.outputs.SERVICE_ROLE_KEY }}
-          SUPABASE_JWT_SECRET: ${{ steps.supabase.outputs.JWT_SECRET }}
+          JWT_VERIFY_KEY: ${{ steps.supabase.outputs.JWT_SECRET }}
           REDIS_HOST: "localhost"
           REDIS_PORT: "6379"
           REDIS_PASSWORD: "testpassword"

autogpt_platform/autogpt_libs/autogpt_libs/auth/__init__.py

@@ -1,13 +1,13 @@
-from .depends import requires_admin_user, requires_user
-from .jwt_utils import parse_jwt_token
-from .middleware import APIKeyValidator, auth_middleware
+from .config import verify_settings
+from .dependencies import get_user_id, requires_admin_user, requires_user
+from .helpers import add_auth_responses_to_openapi
 from .models import User
 
 __all__ = [
-    "parse_jwt_token",
-    "requires_user",
+    "verify_settings",
+    "get_user_id",
     "requires_admin_user",
-    "APIKeyValidator",
-    "auth_middleware",
+    "requires_user",
+    "add_auth_responses_to_openapi",
     "User",
 ]

autogpt_platform/autogpt_libs/autogpt_libs/auth/config.py

@@ -1,11 +1,90 @@
+import logging
 import os
 
+from jwt.algorithms import get_default_algorithms, has_crypto
+
+logger = logging.getLogger(__name__)
+
+
+class AuthConfigError(ValueError):
+    """Raised when authentication configuration is invalid."""
+
+    pass
+
+
+ALGO_RECOMMENDATION = (
+    "We highly recommend using an asymmetric algorithm such as ES256, "
+    "because when leaked, a shared secret would allow anyone to "
+    "forge valid tokens and impersonate users. "
+    "More info: https://supabase.com/docs/guides/auth/signing-keys#choosing-the-right-signing-algorithm"  # noqa
+)
+
 
 class Settings:
     def __init__(self):
-        self.JWT_SECRET_KEY: str = os.getenv("SUPABASE_JWT_SECRET", "")
-        self.ENABLE_AUTH: bool = os.getenv("ENABLE_AUTH", "false").lower() == "true"
-        self.JWT_ALGORITHM: str = "HS256"
+        self.JWT_VERIFY_KEY: str = os.getenv(
+            "JWT_VERIFY_KEY", os.getenv("SUPABASE_JWT_SECRET", "")
+        ).strip()
+        self.JWT_ALGORITHM: str = os.getenv("JWT_SIGN_ALGORITHM", "HS256").strip()
+
+        self.validate()
+
+    def validate(self):
+        if not self.JWT_VERIFY_KEY:
+            raise AuthConfigError(
+                "JWT_VERIFY_KEY must be set. "
+                "An empty JWT secret would allow anyone to forge valid tokens."
+            )
+
+        if len(self.JWT_VERIFY_KEY) < 32:
+            logger.warning(
+                "⚠️ JWT_VERIFY_KEY appears weak (less than 32 characters). "
+                "Consider using a longer, cryptographically secure secret."
+            )
+
+        supported_algorithms = get_default_algorithms().keys()
+
+        if not has_crypto:
+            logger.warning(
+                "⚠️ Asymmetric JWT verification is not available "
+                "because the 'cryptography' package is not installed. "
+                + ALGO_RECOMMENDATION
+            )
+
+        if (
+            self.JWT_ALGORITHM not in supported_algorithms
+            or self.JWT_ALGORITHM == "none"
+        ):
+            raise AuthConfigError(
+                f"Invalid JWT_SIGN_ALGORITHM: '{self.JWT_ALGORITHM}'. "
+                "Supported algorithms are listed on "
+                "https://pyjwt.readthedocs.io/en/stable/algorithms.html"
+            )
+
+        if self.JWT_ALGORITHM.startswith("HS"):
+            logger.warning(
+                f"⚠️ JWT_SIGN_ALGORITHM is set to '{self.JWT_ALGORITHM}', "
+                "a symmetric shared-key signature algorithm. " + ALGO_RECOMMENDATION
+            )
 
 
-settings = Settings()
+_settings: Settings = None  # type: ignore
+
+
+def get_settings() -> Settings:
+    global _settings
+
+    if not _settings:
+        _settings = Settings()
+
+    return _settings
+
+
+def verify_settings() -> None:
+    global _settings
+
+    if not _settings:
+        _settings = Settings()  # calls validation indirectly
+        return
+
+    _settings.validate()

autogpt_platform/autogpt_libs/autogpt_libs/auth/config_test.py

@@ -0,0 +1,306 @@
+"""
+Comprehensive tests for auth configuration to ensure 100% line and branch coverage.
+These tests verify critical security checks preventing JWT token forgery.
+"""
+
+import logging
+import os
+
+import pytest
+from pytest_mock import MockerFixture
+
+from autogpt_libs.auth.config import AuthConfigError, Settings
+
+
+def test_environment_variable_precedence(mocker: MockerFixture):
+    """Test that environment variables take precedence over defaults."""
+    secret = "environment-secret-key-with-proper-length-123456"
+    mocker.patch.dict(os.environ, {"JWT_VERIFY_KEY": secret}, clear=True)
+
+    settings = Settings()
+    assert settings.JWT_VERIFY_KEY == secret
+
+
+def test_environment_variable_backwards_compatible(mocker: MockerFixture):
+    """Test that SUPABASE_JWT_SECRET is read if JWT_VERIFY_KEY is not set."""
+    secret = "environment-secret-key-with-proper-length-123456"
+    mocker.patch.dict(os.environ, {"SUPABASE_JWT_SECRET": secret}, clear=True)
+
+    settings = Settings()
+    assert settings.JWT_VERIFY_KEY == secret
+
+
+def test_auth_config_error_inheritance():
+    """Test that AuthConfigError is properly defined as an Exception."""
+    assert issubclass(AuthConfigError, Exception)
+    error = AuthConfigError("test message")
+    assert str(error) == "test message"
+
+
+def test_settings_static_after_creation(mocker: MockerFixture):
+    """Test that settings maintain their values after creation."""
+    secret = "immutable-secret-key-with-proper-length-12345"
+    mocker.patch.dict(os.environ, {"JWT_VERIFY_KEY": secret}, clear=True)
+
+    settings = Settings()
+    original_secret = settings.JWT_VERIFY_KEY
+
+    # Changing environment after creation shouldn't affect settings
+    os.environ["JWT_VERIFY_KEY"] = "different-secret"
+
+    assert settings.JWT_VERIFY_KEY == original_secret
+
+
+def test_settings_load_with_valid_secret(mocker: MockerFixture):
+    """Test auth enabled with a valid JWT secret."""
+    valid_secret = "a" * 32  # 32 character secret
+    mocker.patch.dict(os.environ, {"JWT_VERIFY_KEY": valid_secret}, clear=True)
+
+    settings = Settings()
+    assert settings.JWT_VERIFY_KEY == valid_secret
+
+
+def test_settings_load_with_strong_secret(mocker: MockerFixture):
+    """Test auth enabled with a cryptographically strong secret."""
+    strong_secret = "super-secret-jwt-token-with-at-least-32-characters-long"
+    mocker.patch.dict(os.environ, {"JWT_VERIFY_KEY": strong_secret}, clear=True)
+
+    settings = Settings()
+    assert settings.JWT_VERIFY_KEY == strong_secret
+    assert len(settings.JWT_VERIFY_KEY) >= 32
+
+
+def test_secret_empty_raises_error(mocker: MockerFixture):
+    """Test that auth enabled with empty secret raises AuthConfigError."""
+    mocker.patch.dict(os.environ, {"JWT_VERIFY_KEY": ""}, clear=True)
+
+    with pytest.raises(Exception) as exc_info:
+        Settings()
+    assert "JWT_VERIFY_KEY" in str(exc_info.value)
+
+
+def test_secret_missing_raises_error(mocker: MockerFixture):
+    """Test that auth enabled without secret env var raises AuthConfigError."""
+    mocker.patch.dict(os.environ, {}, clear=True)
+
+    with pytest.raises(Exception) as exc_info:
+        Settings()
+    assert "JWT_VERIFY_KEY" in str(exc_info.value)
+
+
+@pytest.mark.parametrize("secret", [" ", "  ", "\t", "\n", " \t\n "])
+def test_secret_only_whitespace_raises_error(mocker: MockerFixture, secret: str):
+    """Test that auth enabled with whitespace-only secret raises error."""
+    mocker.patch.dict(os.environ, {"JWT_VERIFY_KEY": secret}, clear=True)
+
+    with pytest.raises(ValueError):
+        Settings()
+
+
+def test_secret_weak_logs_warning(
+    mocker: MockerFixture, caplog: pytest.LogCaptureFixture
+):
+    """Test that weak JWT secret triggers warning log."""
+    weak_secret = "short"  # Less than 32 characters
+    mocker.patch.dict(os.environ, {"JWT_VERIFY_KEY": weak_secret}, clear=True)
+
+    with caplog.at_level(logging.WARNING):
+        settings = Settings()
+        assert settings.JWT_VERIFY_KEY == weak_secret
+        assert "key appears weak" in caplog.text.lower()
+        assert "less than 32 characters" in caplog.text
+
+
+def test_secret_31_char_logs_warning(
+    mocker: MockerFixture, caplog: pytest.LogCaptureFixture
+):
+    """Test that 31-character secret triggers warning (boundary test)."""
+    secret_31 = "a" * 31  # Exactly 31 characters
+    mocker.patch.dict(os.environ, {"JWT_VERIFY_KEY": secret_31}, clear=True)
+
+    with caplog.at_level(logging.WARNING):
+        settings = Settings()
+        assert len(settings.JWT_VERIFY_KEY) == 31
+        assert "key appears weak" in caplog.text.lower()
+
+
+def test_secret_32_char_no_warning(
+    mocker: MockerFixture, caplog: pytest.LogCaptureFixture
+):
+    """Test that 32-character secret does not trigger warning (boundary test)."""
+    secret_32 = "a" * 32  # Exactly 32 characters
+    mocker.patch.dict(os.environ, {"JWT_VERIFY_KEY": secret_32}, clear=True)
+
+    with caplog.at_level(logging.WARNING):
+        settings = Settings()
+        assert len(settings.JWT_VERIFY_KEY) == 32
+        assert "JWT secret appears weak" not in caplog.text
+
+
+def test_secret_whitespace_stripped(mocker: MockerFixture):
+    """Test that JWT secret whitespace is stripped."""
+    secret = "a" * 32
+    mocker.patch.dict(os.environ, {"JWT_VERIFY_KEY": f"  {secret}  "}, clear=True)
+
+    settings = Settings()
+    assert settings.JWT_VERIFY_KEY == secret
+
+
+def test_secret_with_special_characters(mocker: MockerFixture):
+    """Test JWT secret with special characters."""
+    special_secret = "!@#$%^&*()_+-=[]{}|;:,.<>?`~" + "a" * 10  # 40 chars total
+    mocker.patch.dict(os.environ, {"JWT_VERIFY_KEY": special_secret}, clear=True)
+
+    settings = Settings()
+    assert settings.JWT_VERIFY_KEY == special_secret
+
+
+def test_secret_with_unicode(mocker: MockerFixture):
+    """Test JWT secret with unicode characters."""
+    unicode_secret = "秘密🔐キー" + "a" * 25  # Ensure >32 bytes
+    mocker.patch.dict(os.environ, {"JWT_VERIFY_KEY": unicode_secret}, clear=True)
+
+    settings = Settings()
+    assert settings.JWT_VERIFY_KEY == unicode_secret
+
+
+def test_secret_very_long(mocker: MockerFixture):
+    """Test JWT secret with excessive length."""
+    long_secret = "a" * 1000  # 1000 character secret
+    mocker.patch.dict(os.environ, {"JWT_VERIFY_KEY": long_secret}, clear=True)
+
+    settings = Settings()
+    assert settings.JWT_VERIFY_KEY == long_secret
+    assert len(settings.JWT_VERIFY_KEY) == 1000
+
+
+def test_secret_with_newline(mocker: MockerFixture):
+    """Test JWT secret containing newlines."""
+    multiline_secret = "secret\nwith\nnewlines" + "a" * 20
+    mocker.patch.dict(os.environ, {"JWT_VERIFY_KEY": multiline_secret}, clear=True)
+
+    settings = Settings()
+    assert settings.JWT_VERIFY_KEY == multiline_secret
+
+
+def test_secret_base64_encoded(mocker: MockerFixture):
+    """Test JWT secret that looks like base64."""
+    base64_secret = "dGhpc19pc19hX3NlY3JldF9rZXlfd2l0aF9wcm9wZXJfbGVuZ3Ro"
+    mocker.patch.dict(os.environ, {"JWT_VERIFY_KEY": base64_secret}, clear=True)
+
+    settings = Settings()
+    assert settings.JWT_VERIFY_KEY == base64_secret
+
+
+def test_secret_numeric_only(mocker: MockerFixture):
+    """Test JWT secret with only numbers."""
+    numeric_secret = "1234567890" * 4  # 40 character numeric secret
+    mocker.patch.dict(os.environ, {"JWT_VERIFY_KEY": numeric_secret}, clear=True)
+
+    settings = Settings()
+    assert settings.JWT_VERIFY_KEY == numeric_secret
+
+
+def test_algorithm_default_hs256(mocker: MockerFixture):
+    """Test that JWT algorithm defaults to HS256."""
+    mocker.patch.dict(os.environ, {"JWT_VERIFY_KEY": "a" * 32}, clear=True)
+
+    settings = Settings()
+    assert settings.JWT_ALGORITHM == "HS256"
+
+
+def test_algorithm_whitespace_stripped(mocker: MockerFixture):
+    """Test that JWT algorithm whitespace is stripped."""
+    secret = "a" * 32
+    mocker.patch.dict(
+        os.environ,
+        {"JWT_VERIFY_KEY": secret, "JWT_SIGN_ALGORITHM": "  HS256  "},
+        clear=True,
+    )
+
+    settings = Settings()
+    assert settings.JWT_ALGORITHM == "HS256"
+
+
+def test_no_crypto_warning(mocker: MockerFixture, caplog: pytest.LogCaptureFixture):
+    """Test warning when crypto package is not available."""
+    secret = "a" * 32
+    mocker.patch.dict(os.environ, {"JWT_VERIFY_KEY": secret}, clear=True)
+
+    # Mock has_crypto to return False
+    mocker.patch("autogpt_libs.auth.config.has_crypto", False)
+
+    with caplog.at_level(logging.WARNING):
+        Settings()
+        assert "Asymmetric JWT verification is not available" in caplog.text
+        assert "cryptography" in caplog.text
+
+
+def test_algorithm_invalid_raises_error(mocker: MockerFixture):
+    """Test that invalid JWT algorithm raises AuthConfigError."""
+    secret = "a" * 32
+    mocker.patch.dict(
+        os.environ,
+        {"JWT_VERIFY_KEY": secret, "JWT_SIGN_ALGORITHM": "INVALID_ALG"},
+        clear=True,
+    )
+
+    with pytest.raises(AuthConfigError) as exc_info:
+        Settings()
+    assert "Invalid JWT_SIGN_ALGORITHM" in str(exc_info.value)
+    assert "INVALID_ALG" in str(exc_info.value)
+
+
+def test_algorithm_none_raises_error(mocker: MockerFixture):
+    """Test that 'none' algorithm raises AuthConfigError."""
+    secret = "a" * 32
+    mocker.patch.dict(
+        os.environ,
+        {"JWT_VERIFY_KEY": secret, "JWT_SIGN_ALGORITHM": "none"},
+        clear=True,
+    )
+
+    with pytest.raises(AuthConfigError) as exc_info:
+        Settings()
+    assert "Invalid JWT_SIGN_ALGORITHM" in str(exc_info.value)
+
+
+@pytest.mark.parametrize("algorithm", ["HS256", "HS384", "HS512"])
+def test_algorithm_symmetric_warning(
+    mocker: MockerFixture, caplog: pytest.LogCaptureFixture, algorithm: str
+):
+    """Test warning for symmetric algorithms (HS256, HS384, HS512)."""
+    secret = "a" * 32
+    mocker.patch.dict(
+        os.environ,
+        {"JWT_VERIFY_KEY": secret, "JWT_SIGN_ALGORITHM": algorithm},
+        clear=True,
+    )
+
+    with caplog.at_level(logging.WARNING):
+        settings = Settings()
+        assert algorithm in caplog.text
+        assert "symmetric shared-key signature algorithm" in caplog.text
+        assert settings.JWT_ALGORITHM == algorithm
+
+
+@pytest.mark.parametrize(
+    "algorithm",
+    ["ES256", "ES384", "ES512", "RS256", "RS384", "RS512", "PS256", "PS384", "PS512"],
+)
+def test_algorithm_asymmetric_no_warning(
+    mocker: MockerFixture, caplog: pytest.LogCaptureFixture, algorithm: str
+):
+    """Test that asymmetric algorithms do not trigger warning."""
+    secret = "a" * 32
+    mocker.patch.dict(
+        os.environ,
+        {"JWT_VERIFY_KEY": secret, "JWT_SIGN_ALGORITHM": algorithm},
+        clear=True,
+    )
+
+    with caplog.at_level(logging.WARNING):
+        settings = Settings()
+        # Should not contain the symmetric algorithm warning
+        assert "symmetric shared-key signature algorithm" not in caplog.text
+        assert settings.JWT_ALGORITHM == algorithm

autogpt_platform/autogpt_libs/autogpt_libs/auth/dependencies.py

@@ -0,0 +1,45 @@
+"""
+FastAPI dependency functions for JWT-based authentication and authorization.
+
+These are the high-level dependency functions used in route definitions.
+"""
+
+import fastapi
+
+from .jwt_utils import get_jwt_payload, verify_user
+from .models import User
+
+
+def requires_user(jwt_payload: dict = fastapi.Security(get_jwt_payload)) -> User:
+    """
+    FastAPI dependency that requires a valid authenticated user.
+
+    Raises:
+        HTTPException: 401 for authentication failures
+    """
+    return verify_user(jwt_payload, admin_only=False)
+
+
+def requires_admin_user(jwt_payload: dict = fastapi.Security(get_jwt_payload)) -> User:
+    """
+    FastAPI dependency that requires a valid admin user.
+
+    Raises:
+        HTTPException: 401 for authentication failures, 403 for insufficient permissions
+    """
+    return verify_user(jwt_payload, admin_only=True)
+
+
+def get_user_id(jwt_payload: dict = fastapi.Security(get_jwt_payload)) -> str:
+    """
+    FastAPI dependency that returns the ID of the authenticated user.
+
+    Raises:
+        HTTPException: 401 for authentication failures or missing user ID
+    """
+    user_id = jwt_payload.get("sub")
+    if not user_id:
+        raise fastapi.HTTPException(
+            status_code=401, detail="User ID not found in token"
+        )
+    return user_id

autogpt_platform/autogpt_libs/autogpt_libs/auth/dependencies_test.py

@@ -0,0 +1,335 @@
+"""
+Comprehensive integration tests for authentication dependencies.
+Tests the full authentication flow from HTTP requests to user validation.
+"""
+
+import os
+
+import pytest
+from fastapi import FastAPI, HTTPException, Security
+from fastapi.testclient import TestClient
+from pytest_mock import MockerFixture
+
+from autogpt_libs.auth.dependencies import (
+    get_user_id,
+    requires_admin_user,
+    requires_user,
+)
+from autogpt_libs.auth.models import User
+
+
+class TestAuthDependencies:
+    """Test suite for authentication dependency functions."""
+
+    @pytest.fixture
+    def app(self):
+        """Create a test FastAPI application."""
+        app = FastAPI()
+
+        @app.get("/user")
+        def get_user_endpoint(user: User = Security(requires_user)):
+            return {"user_id": user.user_id, "role": user.role}
+
+        @app.get("/admin")
+        def get_admin_endpoint(user: User = Security(requires_admin_user)):
+            return {"user_id": user.user_id, "role": user.role}
+
+        @app.get("/user-id")
+        def get_user_id_endpoint(user_id: str = Security(get_user_id)):
+            return {"user_id": user_id}
+
+        return app
+
+    @pytest.fixture
+    def client(self, app):
+        """Create a test client."""
+        return TestClient(app)
+
+    def test_requires_user_with_valid_jwt_payload(self, mocker: MockerFixture):
+        """Test requires_user with valid JWT payload."""
+        jwt_payload = {"sub": "user-123", "role": "user", "email": "user@example.com"}
+
+        # Mock get_jwt_payload to return our test payload
+        mocker.patch(
+            "autogpt_libs.auth.dependencies.get_jwt_payload", return_value=jwt_payload
+        )
+        user = requires_user(jwt_payload)
+        assert isinstance(user, User)
+        assert user.user_id == "user-123"
+        assert user.role == "user"
+
+    def test_requires_user_with_admin_jwt_payload(self, mocker: MockerFixture):
+        """Test requires_user accepts admin users."""
+        jwt_payload = {
+            "sub": "admin-456",
+            "role": "admin",
+            "email": "admin@example.com",
+        }
+
+        mocker.patch(
+            "autogpt_libs.auth.dependencies.get_jwt_payload", return_value=jwt_payload
+        )
+        user = requires_user(jwt_payload)
+        assert user.user_id == "admin-456"
+        assert user.role == "admin"
+
+    def test_requires_user_missing_sub(self):
+        """Test requires_user with missing user ID."""
+        jwt_payload = {"role": "user", "email": "user@example.com"}
+
+        with pytest.raises(HTTPException) as exc_info:
+            requires_user(jwt_payload)
+        assert exc_info.value.status_code == 401
+        assert "User ID not found" in exc_info.value.detail
+
+    def test_requires_user_empty_sub(self):
+        """Test requires_user with empty user ID."""
+        jwt_payload = {"sub": "", "role": "user"}
+
+        with pytest.raises(HTTPException) as exc_info:
+            requires_user(jwt_payload)
+        assert exc_info.value.status_code == 401
+
+    def test_requires_admin_user_with_admin(self, mocker: MockerFixture):
+        """Test requires_admin_user with admin role."""
+        jwt_payload = {
+            "sub": "admin-789",
+            "role": "admin",
+            "email": "admin@example.com",
+        }
+
+        mocker.patch(
+            "autogpt_libs.auth.dependencies.get_jwt_payload", return_value=jwt_payload
+        )
+        user = requires_admin_user(jwt_payload)
+        assert user.user_id == "admin-789"
+        assert user.role == "admin"
+
+    def test_requires_admin_user_with_regular_user(self):
+        """Test requires_admin_user rejects regular users."""
+        jwt_payload = {"sub": "user-123", "role": "user", "email": "user@example.com"}
+
+        with pytest.raises(HTTPException) as exc_info:
+            requires_admin_user(jwt_payload)
+        assert exc_info.value.status_code == 403
+        assert "Admin access required" in exc_info.value.detail
+
+    def test_requires_admin_user_missing_role(self):
+        """Test requires_admin_user with missing role."""
+        jwt_payload = {"sub": "user-123", "email": "user@example.com"}
+
+        with pytest.raises(KeyError):
+            requires_admin_user(jwt_payload)
+
+    def test_get_user_id_with_valid_payload(self, mocker: MockerFixture):
+        """Test get_user_id extracts user ID correctly."""
+        jwt_payload = {"sub": "user-id-xyz", "role": "user"}
+
+        mocker.patch(
+            "autogpt_libs.auth.dependencies.get_jwt_payload", return_value=jwt_payload
+        )
+        user_id = get_user_id(jwt_payload)
+        assert user_id == "user-id-xyz"
+
+    def test_get_user_id_missing_sub(self):
+        """Test get_user_id with missing user ID."""
+        jwt_payload = {"role": "user"}
+
+        with pytest.raises(HTTPException) as exc_info:
+            get_user_id(jwt_payload)
+        assert exc_info.value.status_code == 401
+        assert "User ID not found" in exc_info.value.detail
+
+    def test_get_user_id_none_sub(self):
+        """Test get_user_id with None user ID."""
+        jwt_payload = {"sub": None, "role": "user"}
+
+        with pytest.raises(HTTPException) as exc_info:
+            get_user_id(jwt_payload)
+        assert exc_info.value.status_code == 401
+
+
+class TestAuthDependenciesIntegration:
+    """Integration tests for auth dependencies with FastAPI."""
+
+    acceptable_jwt_secret = "test-secret-with-proper-length-123456"
+
+    @pytest.fixture
+    def create_token(self, mocker: MockerFixture):
+        """Helper to create JWT tokens."""
+        import jwt
+
+        mocker.patch.dict(
+            os.environ,
+            {"JWT_VERIFY_KEY": self.acceptable_jwt_secret},
+            clear=True,
+        )
+
+        def _create_token(payload, secret=self.acceptable_jwt_secret):
+            return jwt.encode(payload, secret, algorithm="HS256")
+
+        return _create_token
+
+    def test_endpoint_auth_enabled_no_token(self):
+        """Test endpoints require token when auth is enabled."""
+        app = FastAPI()
+
+        @app.get("/test")
+        def test_endpoint(user: User = Security(requires_user)):
+            return {"user_id": user.user_id}
+
+        client = TestClient(app)
+
+        # Should fail without auth header
+        response = client.get("/test")
+        assert response.status_code == 401
+
+    def test_endpoint_with_valid_token(self, create_token):
+        """Test endpoint with valid JWT token."""
+        app = FastAPI()
+
+        @app.get("/test")
+        def test_endpoint(user: User = Security(requires_user)):
+            return {"user_id": user.user_id, "role": user.role}
+
+        client = TestClient(app)
+
+        token = create_token(
+            {"sub": "test-user", "role": "user", "aud": "authenticated"},
+            secret=self.acceptable_jwt_secret,
+        )
+
+        response = client.get("/test", headers={"Authorization": f"Bearer {token}"})
+        assert response.status_code == 200
+        assert response.json()["user_id"] == "test-user"
+
+    def test_admin_endpoint_requires_admin_role(self, create_token):
+        """Test admin endpoint rejects non-admin users."""
+        app = FastAPI()
+
+        @app.get("/admin")
+        def admin_endpoint(user: User = Security(requires_admin_user)):
+            return {"user_id": user.user_id}
+
+        client = TestClient(app)
+
+        # Regular user token
+        user_token = create_token(
+            {"sub": "regular-user", "role": "user", "aud": "authenticated"},
+            secret=self.acceptable_jwt_secret,
+        )
+
+        response = client.get(
+            "/admin", headers={"Authorization": f"Bearer {user_token}"}
+        )
+        assert response.status_code == 403
+
+        # Admin token
+        admin_token = create_token(
+            {"sub": "admin-user", "role": "admin", "aud": "authenticated"},
+            secret=self.acceptable_jwt_secret,
+        )
+
+        response = client.get(
+            "/admin", headers={"Authorization": f"Bearer {admin_token}"}
+        )
+        assert response.status_code == 200
+        assert response.json()["user_id"] == "admin-user"
+
+
+class TestAuthDependenciesEdgeCases:
+    """Edge case tests for authentication dependencies."""
+
+    def test_dependency_with_complex_payload(self):
+        """Test dependencies handle complex JWT payloads."""
+        complex_payload = {
+            "sub": "user-123",
+            "role": "admin",
+            "email": "test@example.com",
+            "app_metadata": {"provider": "email", "providers": ["email"]},
+            "user_metadata": {
+                "full_name": "Test User",
+                "avatar_url": "https://example.com/avatar.jpg",
+            },
+            "aud": "authenticated",
+            "iat": 1234567890,
+            "exp": 9999999999,
+        }
+
+        user = requires_user(complex_payload)
+        assert user.user_id == "user-123"
+        assert user.email == "test@example.com"
+
+        admin = requires_admin_user(complex_payload)
+        assert admin.role == "admin"
+
+    def test_dependency_with_unicode_in_payload(self):
+        """Test dependencies handle unicode in JWT payloads."""
+        unicode_payload = {
+            "sub": "user-😀-123",
+            "role": "user",
+            "email": "测试@example.com",
+            "name": "日本語",
+        }
+
+        user = requires_user(unicode_payload)
+        assert "😀" in user.user_id
+        assert user.email == "测试@example.com"
+
+    def test_dependency_with_null_values(self):
+        """Test dependencies handle null values in payload."""
+        null_payload = {
+            "sub": "user-123",
+            "role": "user",
+            "email": None,
+            "phone": None,
+            "metadata": None,
+        }
+
+        user = requires_user(null_payload)
+        assert user.user_id == "user-123"
+        assert user.email is None
+
+    def test_concurrent_requests_isolation(self):
+        """Test that concurrent requests don't interfere with each other."""
+        payload1 = {"sub": "user-1", "role": "user"}
+        payload2 = {"sub": "user-2", "role": "admin"}
+
+        # Simulate concurrent processing
+        user1 = requires_user(payload1)
+        user2 = requires_admin_user(payload2)
+
+        assert user1.user_id == "user-1"
+        assert user2.user_id == "user-2"
+        assert user1.role == "user"
+        assert user2.role == "admin"
+
+    @pytest.mark.parametrize(
+        "payload,expected_error,admin_only",
+        [
+            (None, "Authorization header is missing", False),
+            ({}, "User ID not found", False),
+            ({"sub": ""}, "User ID not found", False),
+            ({"role": "user"}, "User ID not found", False),
+            ({"sub": "user", "role": "user"}, "Admin access required", True),
+        ],
+    )
+    def test_dependency_error_cases(
+        self, payload, expected_error: str, admin_only: bool
+    ):
+        """Test that errors propagate correctly through dependencies."""
+        # Import verify_user to test it directly since dependencies use FastAPI Security
+        from autogpt_libs.auth.jwt_utils import verify_user
+
+        with pytest.raises(HTTPException) as exc_info:
+            verify_user(payload, admin_only=admin_only)
+        assert expected_error in exc_info.value.detail
+
+    def test_dependency_valid_user(self):
+        """Test valid user case for dependency."""
+        # Import verify_user to test it directly since dependencies use FastAPI Security
+        from autogpt_libs.auth.jwt_utils import verify_user
+
+        # Valid case
+        user = verify_user({"sub": "user", "role": "user"}, admin_only=False)
+        assert user.user_id == "user"

autogpt_platform/autogpt_libs/autogpt_libs/auth/depends.py

@@ -1,46 +0,0 @@
-import fastapi
-
-from .config import settings
-from .middleware import auth_middleware
-from .models import DEFAULT_USER_ID, User
-
-
-def requires_user(payload: dict = fastapi.Depends(auth_middleware)) -> User:
-    return verify_user(payload, admin_only=False)
-
-
-def requires_admin_user(
-    payload: dict = fastapi.Depends(auth_middleware),
-) -> User:
-    return verify_user(payload, admin_only=True)
-
-
-def verify_user(payload: dict | None, admin_only: bool) -> User:
-    if not payload:
-        if settings.ENABLE_AUTH:
-            raise fastapi.HTTPException(
-                status_code=401, detail="Authorization header is missing"
-            )
-        # This handles the case when authentication is disabled
-        payload = {"sub": DEFAULT_USER_ID, "role": "admin"}
-
-    user_id = payload.get("sub")
-
-    if not user_id:
-        raise fastapi.HTTPException(
-            status_code=401, detail="User ID not found in token"
-        )
-
-    if admin_only and payload["role"] != "admin":
-        raise fastapi.HTTPException(status_code=403, detail="Admin access required")
-
-    return User.from_payload(payload)
-
-
-def get_user_id(payload: dict = fastapi.Depends(auth_middleware)) -> str:
-    user_id = payload.get("sub")
-    if not user_id:
-        raise fastapi.HTTPException(
-            status_code=401, detail="User ID not found in token"
-        )
-    return user_id

autogpt_platform/autogpt_libs/autogpt_libs/auth/depends_tests.py

@@ -1,68 +0,0 @@
-import pytest
-
-from .depends import requires_admin_user, requires_user, verify_user
-
-
-def test_verify_user_no_payload():
-    user = verify_user(None, admin_only=False)
-    assert user.user_id == "3e53486c-cf57-477e-ba2a-cb02dc828e1a"
-    assert user.role == "admin"
-
-
-def test_verify_user_no_user_id():
-    with pytest.raises(Exception):
-        verify_user({"role": "admin"}, admin_only=False)
-
-
-def test_verify_user_not_admin():
-    with pytest.raises(Exception):
-        verify_user(
-            {"sub": "3e53486c-cf57-477e-ba2a-cb02dc828e1a", "role": "user"},
-            admin_only=True,
-        )
-
-
-def test_verify_user_with_admin_role():
-    user = verify_user(
-        {"sub": "3e53486c-cf57-477e-ba2a-cb02dc828e1a", "role": "admin"},
-        admin_only=True,
-    )
-    assert user.user_id == "3e53486c-cf57-477e-ba2a-cb02dc828e1a"
-    assert user.role == "admin"
-
-
-def test_verify_user_with_user_role():
-    user = verify_user(
-        {"sub": "3e53486c-cf57-477e-ba2a-cb02dc828e1a", "role": "user"},
-        admin_only=False,
-    )
-    assert user.user_id == "3e53486c-cf57-477e-ba2a-cb02dc828e1a"
-    assert user.role == "user"
-
-
-def test_requires_user():
-    user = requires_user(
-        {"sub": "3e53486c-cf57-477e-ba2a-cb02dc828e1a", "role": "user"}
-    )
-    assert user.user_id == "3e53486c-cf57-477e-ba2a-cb02dc828e1a"
-    assert user.role == "user"
-
-
-def test_requires_user_no_user_id():
-    with pytest.raises(Exception):
-        requires_user({"role": "user"})
-
-
-def test_requires_admin_user():
-    user = requires_admin_user(
-        {"sub": "3e53486c-cf57-477e-ba2a-cb02dc828e1a", "role": "admin"}
-    )
-    assert user.user_id == "3e53486c-cf57-477e-ba2a-cb02dc828e1a"
-    assert user.role == "admin"
-
-
-def test_requires_admin_user_not_admin():
-    with pytest.raises(Exception):
-        requires_admin_user(
-            {"sub": "3e53486c-cf57-477e-ba2a-cb02dc828e1a", "role": "user"}
-        )

autogpt_platform/autogpt_libs/autogpt_libs/auth/helpers.py

@@ -0,0 +1,68 @@
+from fastapi import FastAPI
+from fastapi.openapi.utils import get_openapi
+
+from .jwt_utils import bearer_jwt_auth
+
+
+def add_auth_responses_to_openapi(app: FastAPI) -> None:
+    """
+    Set up custom OpenAPI schema generation that adds 401 responses
+    to all authenticated endpoints.
+
+    This is needed when using HTTPBearer with auto_error=False to get proper
+    401 responses instead of 403, but FastAPI only automatically adds security
+    responses when auto_error=True.
+    """
+
+    def custom_openapi():
+        if app.openapi_schema:
+            return app.openapi_schema
+
+        openapi_schema = get_openapi(
+            title=app.title,
+            version=app.version,
+            description=app.description,
+            routes=app.routes,
+        )
+
+        # Add 401 response to all endpoints that have security requirements
+        for path, methods in openapi_schema["paths"].items():
+            for method, details in methods.items():
+                security_schemas = [
+                    schema
+                    for auth_option in details.get("security", [])
+                    for schema in auth_option.keys()
+                ]
+                if bearer_jwt_auth.scheme_name not in security_schemas:
+                    continue
+
+                if "responses" not in details:
+                    details["responses"] = {}
+
+                details["responses"]["401"] = {
+                    "$ref": "#/components/responses/HTTP401NotAuthenticatedError"
+                }
+
+        # Ensure #/components/responses exists
+        if "components" not in openapi_schema:
+            openapi_schema["components"] = {}
+        if "responses" not in openapi_schema["components"]:
+            openapi_schema["components"]["responses"] = {}
+
+        # Define 401 response
+        openapi_schema["components"]["responses"]["HTTP401NotAuthenticatedError"] = {
+            "description": "Authentication required",
+            "content": {
+                "application/json": {
+                    "schema": {
+                        "type": "object",
+                        "properties": {"detail": {"type": "string"}},
+                    }
+                }
+            },
+        }
+
+        app.openapi_schema = openapi_schema
+        return app.openapi_schema
+
+    app.openapi = custom_openapi

autogpt_platform/autogpt_libs/autogpt_libs/auth/helpers_test.py

@@ -0,0 +1,435 @@
+"""
+Comprehensive tests for auth helpers module to achieve 100% coverage.
+Tests OpenAPI schema generation and authentication response handling.
+"""
+
+from unittest import mock
+
+from fastapi import FastAPI
+from fastapi.openapi.utils import get_openapi
+
+from autogpt_libs.auth.helpers import add_auth_responses_to_openapi
+from autogpt_libs.auth.jwt_utils import bearer_jwt_auth
+
+
+def test_add_auth_responses_to_openapi_basic():
+    """Test adding 401 responses to OpenAPI schema."""
+    app = FastAPI(title="Test App", version="1.0.0")
+
+    # Add some test endpoints with authentication
+    from fastapi import Depends
+
+    from autogpt_libs.auth.dependencies import requires_user
+
+    @app.get("/protected", dependencies=[Depends(requires_user)])
+    def protected_endpoint():
+        return {"message": "Protected"}
+
+    @app.get("/public")
+    def public_endpoint():
+        return {"message": "Public"}
+
+    # Apply the OpenAPI customization
+    add_auth_responses_to_openapi(app)
+
+    # Get the OpenAPI schema
+    schema = app.openapi()
+
+    # Verify basic schema properties
+    assert schema["info"]["title"] == "Test App"
+    assert schema["info"]["version"] == "1.0.0"
+
+    # Verify 401 response component is added
+    assert "components" in schema
+    assert "responses" in schema["components"]
+    assert "HTTP401NotAuthenticatedError" in schema["components"]["responses"]
+
+    # Verify 401 response structure
+    error_response = schema["components"]["responses"]["HTTP401NotAuthenticatedError"]
+    assert error_response["description"] == "Authentication required"
+    assert "application/json" in error_response["content"]
+    assert "schema" in error_response["content"]["application/json"]
+
+    # Verify schema properties
+    response_schema = error_response["content"]["application/json"]["schema"]
+    assert response_schema["type"] == "object"
+    assert "detail" in response_schema["properties"]
+    assert response_schema["properties"]["detail"]["type"] == "string"
+
+
+def test_add_auth_responses_to_openapi_with_security():
+    """Test that 401 responses are added only to secured endpoints."""
+    app = FastAPI()
+
+    # Mock endpoint with security
+    from fastapi import Security
+
+    from autogpt_libs.auth.dependencies import get_user_id
+
+    @app.get("/secured")
+    def secured_endpoint(user_id: str = Security(get_user_id)):
+        return {"user_id": user_id}
+
+    @app.post("/also-secured")
+    def another_secured(user_id: str = Security(get_user_id)):
+        return {"status": "ok"}
+
+    @app.get("/unsecured")
+    def unsecured_endpoint():
+        return {"public": True}
+
+    # Apply OpenAPI customization
+    add_auth_responses_to_openapi(app)
+
+    # Get schema
+    schema = app.openapi()
+
+    # Check that secured endpoints have 401 responses
+    if "/secured" in schema["paths"]:
+        if "get" in schema["paths"]["/secured"]:
+            secured_get = schema["paths"]["/secured"]["get"]
+            if "responses" in secured_get:
+                assert "401" in secured_get["responses"]
+                assert (
+                    secured_get["responses"]["401"]["$ref"]
+                    == "#/components/responses/HTTP401NotAuthenticatedError"
+                )
+
+    if "/also-secured" in schema["paths"]:
+        if "post" in schema["paths"]["/also-secured"]:
+            secured_post = schema["paths"]["/also-secured"]["post"]
+            if "responses" in secured_post:
+                assert "401" in secured_post["responses"]
+
+    # Check that unsecured endpoint does not have 401 response
+    if "/unsecured" in schema["paths"]:
+        if "get" in schema["paths"]["/unsecured"]:
+            unsecured_get = schema["paths"]["/unsecured"]["get"]
+            if "responses" in unsecured_get:
+                assert "401" not in unsecured_get.get("responses", {})
+
+
+def test_add_auth_responses_to_openapi_cached_schema():
+    """Test that OpenAPI schema is cached after first generation."""
+    app = FastAPI()
+
+    # Apply customization
+    add_auth_responses_to_openapi(app)
+
+    # Get schema twice
+    schema1 = app.openapi()
+    schema2 = app.openapi()
+
+    # Should return the same cached object
+    assert schema1 is schema2
+
+
+def test_add_auth_responses_to_openapi_existing_responses():
+    """Test handling endpoints that already have responses defined."""
+    app = FastAPI()
+
+    from fastapi import Security
+
+    from autogpt_libs.auth.jwt_utils import get_jwt_payload
+
+    @app.get(
+        "/with-responses",
+        responses={
+            200: {"description": "Success"},
+            404: {"description": "Not found"},
+        },
+    )
+    def endpoint_with_responses(jwt: dict = Security(get_jwt_payload)):
+        return {"data": "test"}
+
+    # Apply customization
+    add_auth_responses_to_openapi(app)
+
+    schema = app.openapi()
+
+    # Check that existing responses are preserved and 401 is added
+    if "/with-responses" in schema["paths"]:
+        if "get" in schema["paths"]["/with-responses"]:
+            responses = schema["paths"]["/with-responses"]["get"].get("responses", {})
+            # Original responses should be preserved
+            if "200" in responses:
+                assert responses["200"]["description"] == "Success"
+            if "404" in responses:
+                assert responses["404"]["description"] == "Not found"
+            # 401 should be added
+            if "401" in responses:
+                assert (
+                    responses["401"]["$ref"]
+                    == "#/components/responses/HTTP401NotAuthenticatedError"
+                )
+
+
+def test_add_auth_responses_to_openapi_no_security_endpoints():
+    """Test with app that has no secured endpoints."""
+    app = FastAPI()
+
+    @app.get("/public1")
+    def public1():
+        return {"message": "public1"}
+
+    @app.post("/public2")
+    def public2():
+        return {"message": "public2"}
+
+    # Apply customization
+    add_auth_responses_to_openapi(app)
+
+    schema = app.openapi()
+
+    # Component should still be added for consistency
+    assert "HTTP401NotAuthenticatedError" in schema["components"]["responses"]
+
+    # But no endpoints should have 401 responses
+    for path in schema["paths"].values():
+        for method in path.values():
+            if isinstance(method, dict) and "responses" in method:
+                assert "401" not in method["responses"]
+
+
+def test_add_auth_responses_to_openapi_multiple_security_schemes():
+    """Test endpoints with multiple security requirements."""
+    app = FastAPI()
+
+    from fastapi import Security
+
+    from autogpt_libs.auth.dependencies import requires_admin_user, requires_user
+    from autogpt_libs.auth.models import User
+
+    @app.get("/multi-auth")
+    def multi_auth(
+        user: User = Security(requires_user),
+        admin: User = Security(requires_admin_user),
+    ):
+        return {"status": "super secure"}
+
+    # Apply customization
+    add_auth_responses_to_openapi(app)
+
+    schema = app.openapi()
+
+    # Should have 401 response
+    if "/multi-auth" in schema["paths"]:
+        if "get" in schema["paths"]["/multi-auth"]:
+            responses = schema["paths"]["/multi-auth"]["get"].get("responses", {})
+            if "401" in responses:
+                assert (
+                    responses["401"]["$ref"]
+                    == "#/components/responses/HTTP401NotAuthenticatedError"
+                )
+
+
+def test_add_auth_responses_to_openapi_empty_components():
+    """Test when OpenAPI schema has no components section initially."""
+    app = FastAPI()
+
+    # Mock get_openapi to return schema without components
+    original_get_openapi = get_openapi
+
+    def mock_get_openapi(*args, **kwargs):
+        schema = original_get_openapi(*args, **kwargs)
+        # Remove components if it exists
+        if "components" in schema:
+            del schema["components"]
+        return schema
+
+    with mock.patch("autogpt_libs.auth.helpers.get_openapi", mock_get_openapi):
+        # Apply customization
+        add_auth_responses_to_openapi(app)
+
+        schema = app.openapi()
+
+        # Components should be created
+        assert "components" in schema
+        assert "responses" in schema["components"]
+        assert "HTTP401NotAuthenticatedError" in schema["components"]["responses"]
+
+
+def test_add_auth_responses_to_openapi_all_http_methods():
+    """Test that all HTTP methods are handled correctly."""
+    app = FastAPI()
+
+    from fastapi import Security
+
+    from autogpt_libs.auth.jwt_utils import get_jwt_payload
+
+    @app.get("/resource")
+    def get_resource(jwt: dict = Security(get_jwt_payload)):
+        return {"method": "GET"}
+
+    @app.post("/resource")
+    def post_resource(jwt: dict = Security(get_jwt_payload)):
+        return {"method": "POST"}
+
+    @app.put("/resource")
+    def put_resource(jwt: dict = Security(get_jwt_payload)):
+        return {"method": "PUT"}
+
+    @app.patch("/resource")
+    def patch_resource(jwt: dict = Security(get_jwt_payload)):
+        return {"method": "PATCH"}
+
+    @app.delete("/resource")
+    def delete_resource(jwt: dict = Security(get_jwt_payload)):
+        return {"method": "DELETE"}
+
+    # Apply customization
+    add_auth_responses_to_openapi(app)
+
+    schema = app.openapi()
+
+    # All methods should have 401 response
+    if "/resource" in schema["paths"]:
+        for method in ["get", "post", "put", "patch", "delete"]:
+            if method in schema["paths"]["/resource"]:
+                method_spec = schema["paths"]["/resource"][method]
+                if "responses" in method_spec:
+                    assert "401" in method_spec["responses"]
+
+
+def test_bearer_jwt_auth_scheme_config():
+    """Test that bearer_jwt_auth is configured correctly."""
+    assert bearer_jwt_auth.scheme_name == "HTTPBearerJWT"
+    assert bearer_jwt_auth.auto_error is False
+
+
+def test_add_auth_responses_with_no_routes():
+    """Test OpenAPI generation with app that has no routes."""
+    app = FastAPI(title="Empty App")
+
+    # Apply customization to empty app
+    add_auth_responses_to_openapi(app)
+
+    schema = app.openapi()
+
+    # Should still have basic structure
+    assert schema["info"]["title"] == "Empty App"
+    assert "components" in schema
+    assert "responses" in schema["components"]
+    assert "HTTP401NotAuthenticatedError" in schema["components"]["responses"]
+
+
+def test_custom_openapi_function_replacement():
+    """Test that the custom openapi function properly replaces the default."""
+    app = FastAPI()
+
+    # Store original function
+    original_openapi = app.openapi
+
+    # Apply customization
+    add_auth_responses_to_openapi(app)
+
+    # Function should be replaced
+    assert app.openapi != original_openapi
+    assert callable(app.openapi)
+
+
+def test_endpoint_without_responses_section():
+    """Test endpoint that has security but no responses section initially."""
+    app = FastAPI()
+
+    from fastapi import Security
+    from fastapi.openapi.utils import get_openapi as original_get_openapi
+
+    from autogpt_libs.auth.jwt_utils import get_jwt_payload
+
+    # Create endpoint
+    @app.get("/no-responses")
+    def endpoint_without_responses(jwt: dict = Security(get_jwt_payload)):
+        return {"data": "test"}
+
+    # Mock get_openapi to remove responses from the endpoint
+    def mock_get_openapi(*args, **kwargs):
+        schema = original_get_openapi(*args, **kwargs)
+        # Remove responses from our endpoint to trigger line 40
+        if "/no-responses" in schema.get("paths", {}):
+            if "get" in schema["paths"]["/no-responses"]:
+                # Delete responses to force the code to create it
+                if "responses" in schema["paths"]["/no-responses"]["get"]:
+                    del schema["paths"]["/no-responses"]["get"]["responses"]
+        return schema
+
+    with mock.patch("autogpt_libs.auth.helpers.get_openapi", mock_get_openapi):
+        # Apply customization
+        add_auth_responses_to_openapi(app)
+
+        # Get schema and verify 401 was added
+        schema = app.openapi()
+
+        # The endpoint should now have 401 response
+        if "/no-responses" in schema["paths"]:
+            if "get" in schema["paths"]["/no-responses"]:
+                responses = schema["paths"]["/no-responses"]["get"].get("responses", {})
+                assert "401" in responses
+                assert (
+                    responses["401"]["$ref"]
+                    == "#/components/responses/HTTP401NotAuthenticatedError"
+                )
+
+
+def test_components_with_existing_responses():
+    """Test when components already has a responses section."""
+    app = FastAPI()
+
+    # Mock get_openapi to return schema with existing components/responses
+    from fastapi.openapi.utils import get_openapi as original_get_openapi
+
+    def mock_get_openapi(*args, **kwargs):
+        schema = original_get_openapi(*args, **kwargs)
+        # Add existing components/responses
+        if "components" not in schema:
+            schema["components"] = {}
+        schema["components"]["responses"] = {
+            "ExistingResponse": {"description": "An existing response"}
+        }
+        return schema
+
+    with mock.patch("autogpt_libs.auth.helpers.get_openapi", mock_get_openapi):
+        # Apply customization
+        add_auth_responses_to_openapi(app)
+
+        schema = app.openapi()
+
+        # Both responses should exist
+        assert "ExistingResponse" in schema["components"]["responses"]
+        assert "HTTP401NotAuthenticatedError" in schema["components"]["responses"]
+
+        # Verify our 401 response structure
+        error_response = schema["components"]["responses"][
+            "HTTP401NotAuthenticatedError"
+        ]
+        assert error_response["description"] == "Authentication required"
+
+
+def test_openapi_schema_persistence():
+    """Test that modifications to OpenAPI schema persist correctly."""
+    app = FastAPI()
+
+    from fastapi import Security
+
+    from autogpt_libs.auth.jwt_utils import get_jwt_payload
+
+    @app.get("/test")
+    def test_endpoint(jwt: dict = Security(get_jwt_payload)):
+        return {"test": True}
+
+    # Apply customization
+    add_auth_responses_to_openapi(app)
+
+    # Get schema multiple times
+    schema1 = app.openapi()
+
+    # Modify the cached schema (shouldn't affect future calls)
+    schema1["info"]["title"] = "Modified Title"
+
+    # Clear cache and get again
+    app.openapi_schema = None
+    schema2 = app.openapi()
+
+    # Should regenerate with original title
+    assert schema2["info"]["title"] == app.title
+    assert schema2["info"]["title"] != "Modified Title"

autogpt_platform/autogpt_libs/autogpt_libs/auth/jwt_utils.py

@@ -1,11 +1,48 @@
-from typing import Any, Dict
+import logging
+from typing import Any
 
 import jwt
+from fastapi import HTTPException, Security
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
 
-from .config import settings
+from .config import get_settings
+from .models import User
+
+logger = logging.getLogger(__name__)
+
+# Bearer token authentication scheme
+bearer_jwt_auth = HTTPBearer(
+    bearerFormat="jwt", scheme_name="HTTPBearerJWT", auto_error=False
+)
 
 
-def parse_jwt_token(token: str) -> Dict[str, Any]:
+def get_jwt_payload(
+    credentials: HTTPAuthorizationCredentials | None = Security(bearer_jwt_auth),
+) -> dict[str, Any]:
+    """
+    Extract and validate JWT payload from HTTP Authorization header.
+
+    This is the core authentication function that handles:
+    - Reading the `Authorization` header to obtain the JWT token
+    - Verifying the JWT token's signature
+    - Decoding the JWT token's payload
+
+    :param credentials: HTTP Authorization credentials from bearer token
+    :return: JWT payload dictionary
+    :raises HTTPException: 401 if authentication fails
+    """
+    if not credentials:
+        raise HTTPException(status_code=401, detail="Authorization header is missing")
+
+    try:
+        payload = parse_jwt_token(credentials.credentials)
+        logger.debug("Token decoded successfully")
+        return payload
+    except ValueError as e:
+        raise HTTPException(status_code=401, detail=str(e))
+
+
+def parse_jwt_token(token: str) -> dict[str, Any]:
     """
     Parse and validate a JWT token.
 
@@ -13,10 +50,11 @@ def parse_jwt_token(token: str) -> Dict[str, Any]:
     :return: The decoded payload
     :raises ValueError: If the token is invalid or expired
     """
+    settings = get_settings()
     try:
         payload = jwt.decode(
             token,
-            settings.JWT_SECRET_KEY,
+            settings.JWT_VERIFY_KEY,
             algorithms=[settings.JWT_ALGORITHM],
             audience="authenticated",
         )
@@ -25,3 +63,18 @@ def parse_jwt_token(token: str) -> Dict[str, Any]:
         raise ValueError("Token has expired")
     except jwt.InvalidTokenError as e:
         raise ValueError(f"Invalid token: {str(e)}")
+
+
+def verify_user(jwt_payload: dict | None, admin_only: bool) -> User:
+    if jwt_payload is None:
+        raise HTTPException(status_code=401, detail="Authorization header is missing")
+
+    user_id = jwt_payload.get("sub")
+
+    if not user_id:
+        raise HTTPException(status_code=401, detail="User ID not found in token")
+
+    if admin_only and jwt_payload["role"] != "admin":
+        raise HTTPException(status_code=403, detail="Admin access required")
+
+    return User.from_payload(jwt_payload)

autogpt_platform/autogpt_libs/autogpt_libs/auth/jwt_utils_test.py

@@ -0,0 +1,308 @@
+"""
+Comprehensive tests for JWT token parsing and validation.
+Ensures 100% line and branch coverage for JWT security functions.
+"""
+
+import os
+from datetime import datetime, timedelta, timezone
+
+import jwt
+import pytest
+from fastapi import HTTPException
+from fastapi.security import HTTPAuthorizationCredentials
+from pytest_mock import MockerFixture
+
+from autogpt_libs.auth import config, jwt_utils
+from autogpt_libs.auth.config import Settings
+from autogpt_libs.auth.models import User
+
+MOCK_JWT_SECRET = "test-secret-key-with-at-least-32-characters"
+TEST_USER_PAYLOAD = {
+    "sub": "test-user-id",
+    "role": "user",
+    "aud": "authenticated",
+    "email": "test@example.com",
+}
+TEST_ADMIN_PAYLOAD = {
+    "sub": "admin-user-id",
+    "role": "admin",
+    "aud": "authenticated",
+    "email": "admin@example.com",
+}
+
+
+@pytest.fixture(autouse=True)
+def mock_config(mocker: MockerFixture):
+    mocker.patch.dict(os.environ, {"JWT_VERIFY_KEY": MOCK_JWT_SECRET}, clear=True)
+    mocker.patch.object(config, "_settings", Settings())
+    yield
+
+
+def create_token(payload, secret=None, algorithm="HS256"):
+    """Helper to create JWT tokens."""
+    if secret is None:
+        secret = MOCK_JWT_SECRET
+    return jwt.encode(payload, secret, algorithm=algorithm)
+
+
+def test_parse_jwt_token_valid():
+    """Test parsing a valid JWT token."""
+    token = create_token(TEST_USER_PAYLOAD)
+    result = jwt_utils.parse_jwt_token(token)
+
+    assert result["sub"] == "test-user-id"
+    assert result["role"] == "user"
+    assert result["aud"] == "authenticated"
+
+
+def test_parse_jwt_token_expired():
+    """Test parsing an expired JWT token."""
+    expired_payload = {
+        **TEST_USER_PAYLOAD,
+        "exp": datetime.now(timezone.utc) - timedelta(hours=1),
+    }
+    token = create_token(expired_payload)
+
+    with pytest.raises(ValueError) as exc_info:
+        jwt_utils.parse_jwt_token(token)
+    assert "Token has expired" in str(exc_info.value)
+
+
+def test_parse_jwt_token_invalid_signature():
+    """Test parsing a token with invalid signature."""
+    # Create token with different secret
+    token = create_token(TEST_USER_PAYLOAD, secret="wrong-secret")
+
+    with pytest.raises(ValueError) as exc_info:
+        jwt_utils.parse_jwt_token(token)
+    assert "Invalid token" in str(exc_info.value)
+
+
+def test_parse_jwt_token_malformed():
+    """Test parsing a malformed token."""
+    malformed_tokens = [
+        "not.a.token",
+        "invalid",
+        "",
+        # Header only
+        "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9",
+        # No signature
+        "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ0ZXN0In0",
+    ]
+
+    for token in malformed_tokens:
+        with pytest.raises(ValueError) as exc_info:
+            jwt_utils.parse_jwt_token(token)
+        assert "Invalid token" in str(exc_info.value)
+
+
+def test_parse_jwt_token_wrong_audience():
+    """Test parsing a token with wrong audience."""
+    wrong_aud_payload = {**TEST_USER_PAYLOAD, "aud": "wrong-audience"}
+    token = create_token(wrong_aud_payload)
+
+    with pytest.raises(ValueError) as exc_info:
+        jwt_utils.parse_jwt_token(token)
+    assert "Invalid token" in str(exc_info.value)
+
+
+def test_parse_jwt_token_missing_audience():
+    """Test parsing a token without audience claim."""
+    no_aud_payload = {k: v for k, v in TEST_USER_PAYLOAD.items() if k != "aud"}
+    token = create_token(no_aud_payload)
+
+    with pytest.raises(ValueError) as exc_info:
+        jwt_utils.parse_jwt_token(token)
+    assert "Invalid token" in str(exc_info.value)
+
+
+def test_get_jwt_payload_with_valid_token():
+    """Test extracting JWT payload with valid bearer token."""
+    token = create_token(TEST_USER_PAYLOAD)
+    credentials = HTTPAuthorizationCredentials(scheme="Bearer", credentials=token)
+
+    result = jwt_utils.get_jwt_payload(credentials)
+    assert result["sub"] == "test-user-id"
+    assert result["role"] == "user"
+
+
+def test_get_jwt_payload_no_credentials():
+    """Test JWT payload when no credentials provided."""
+    with pytest.raises(HTTPException) as exc_info:
+        jwt_utils.get_jwt_payload(None)
+    assert exc_info.value.status_code == 401
+    assert "Authorization header is missing" in exc_info.value.detail
+
+
+def test_get_jwt_payload_invalid_token():
+    """Test JWT payload extraction with invalid token."""
+    credentials = HTTPAuthorizationCredentials(
+        scheme="Bearer", credentials="invalid.token.here"
+    )
+
+    with pytest.raises(HTTPException) as exc_info:
+        jwt_utils.get_jwt_payload(credentials)
+    assert exc_info.value.status_code == 401
+    assert "Invalid token" in exc_info.value.detail
+
+
+def test_verify_user_with_valid_user():
+    """Test verifying a valid user."""
+    user = jwt_utils.verify_user(TEST_USER_PAYLOAD, admin_only=False)
+    assert isinstance(user, User)
+    assert user.user_id == "test-user-id"
+    assert user.role == "user"
+    assert user.email == "test@example.com"
+
+
+def test_verify_user_with_admin():
+    """Test verifying an admin user."""
+    user = jwt_utils.verify_user(TEST_ADMIN_PAYLOAD, admin_only=True)
+    assert isinstance(user, User)
+    assert user.user_id == "admin-user-id"
+    assert user.role == "admin"
+
+
+def test_verify_user_admin_only_with_regular_user():
+    """Test verifying regular user when admin is required."""
+    with pytest.raises(HTTPException) as exc_info:
+        jwt_utils.verify_user(TEST_USER_PAYLOAD, admin_only=True)
+    assert exc_info.value.status_code == 403
+    assert "Admin access required" in exc_info.value.detail
+
+
+def test_verify_user_no_payload():
+    """Test verifying user with no payload."""
+    with pytest.raises(HTTPException) as exc_info:
+        jwt_utils.verify_user(None, admin_only=False)
+    assert exc_info.value.status_code == 401
+    assert "Authorization header is missing" in exc_info.value.detail
+
+
+def test_verify_user_missing_sub():
+    """Test verifying user with payload missing 'sub' field."""
+    invalid_payload = {"role": "user", "email": "test@example.com"}
+    with pytest.raises(HTTPException) as exc_info:
+        jwt_utils.verify_user(invalid_payload, admin_only=False)
+    assert exc_info.value.status_code == 401
+    assert "User ID not found in token" in exc_info.value.detail
+
+
+def test_verify_user_empty_sub():
+    """Test verifying user with empty 'sub' field."""
+    invalid_payload = {"sub": "", "role": "user"}
+    with pytest.raises(HTTPException) as exc_info:
+        jwt_utils.verify_user(invalid_payload, admin_only=False)
+    assert exc_info.value.status_code == 401
+    assert "User ID not found in token" in exc_info.value.detail
+
+
+def test_verify_user_none_sub():
+    """Test verifying user with None 'sub' field."""
+    invalid_payload = {"sub": None, "role": "user"}
+    with pytest.raises(HTTPException) as exc_info:
+        jwt_utils.verify_user(invalid_payload, admin_only=False)
+    assert exc_info.value.status_code == 401
+    assert "User ID not found in token" in exc_info.value.detail
+
+
+def test_verify_user_missing_role_admin_check():
+    """Test verifying admin when role field is missing."""
+    no_role_payload = {"sub": "user-id"}
+    with pytest.raises(KeyError):
+        # This will raise KeyError when checking payload["role"]
+        jwt_utils.verify_user(no_role_payload, admin_only=True)
+
+
+# ======================== EDGE CASES ======================== #
+
+
+def test_jwt_with_additional_claims():
+    """Test JWT token with additional custom claims."""
+    extra_claims_payload = {
+        "sub": "user-id",
+        "role": "user",
+        "aud": "authenticated",
+        "custom_claim": "custom_value",
+        "permissions": ["read", "write"],
+        "metadata": {"key": "value"},
+    }
+    token = create_token(extra_claims_payload)
+
+    result = jwt_utils.parse_jwt_token(token)
+    assert result["sub"] == "user-id"
+    assert result["custom_claim"] == "custom_value"
+    assert result["permissions"] == ["read", "write"]
+
+
+def test_jwt_with_numeric_sub():
+    """Test JWT token with numeric user ID."""
+    payload = {
+        "sub": 12345,  # Numeric ID
+        "role": "user",
+        "aud": "authenticated",
+    }
+    # Should convert to string internally
+    user = jwt_utils.verify_user(payload, admin_only=False)
+    assert user.user_id == 12345
+
+
+def test_jwt_with_very_long_sub():
+    """Test JWT token with very long user ID."""
+    long_id = "a" * 1000
+    payload = {
+        "sub": long_id,
+        "role": "user",
+        "aud": "authenticated",
+    }
+    user = jwt_utils.verify_user(payload, admin_only=False)
+    assert user.user_id == long_id
+
+
+def test_jwt_with_special_characters_in_claims():
+    """Test JWT token with special characters in claims."""
+    payload = {
+        "sub": "user@example.com/special-chars!@#$%",
+        "role": "admin",
+        "aud": "authenticated",
+        "email": "test+special@example.com",
+    }
+    user = jwt_utils.verify_user(payload, admin_only=True)
+    assert "special-chars!@#$%" in user.user_id
+
+
+def test_jwt_with_future_iat():
+    """Test JWT token with issued-at time in future."""
+    future_payload = {
+        "sub": "user-id",
+        "role": "user",
+        "aud": "authenticated",
+        "iat": datetime.now(timezone.utc) + timedelta(hours=1),
+    }
+    token = create_token(future_payload)
+
+    # PyJWT validates iat claim and should reject future tokens
+    with pytest.raises(ValueError, match="not yet valid"):
+        jwt_utils.parse_jwt_token(token)
+
+
+def test_jwt_with_different_algorithms():
+    """Test that only HS256 algorithm is accepted."""
+    payload = {
+        "sub": "user-id",
+        "role": "user",
+        "aud": "authenticated",
+    }
+
+    # Try different algorithms
+    algorithms = ["HS384", "HS512", "none"]
+    for algo in algorithms:
+        if algo == "none":
+            # Special case for 'none' algorithm (security vulnerability if accepted)
+            token = create_token(payload, "", algorithm="none")
+        else:
+            token = create_token(payload, algorithm=algo)
+
+        with pytest.raises(ValueError) as exc_info:
+            jwt_utils.parse_jwt_token(token)
+        assert "Invalid token" in str(exc_info.value)

autogpt_platform/autogpt_libs/autogpt_libs/auth/middleware.py

@@ -1,139 +0,0 @@
-import inspect
-import logging
-import secrets
-from typing import Any, Callable, Optional
-
-from fastapi import HTTPException, Request, Security
-from fastapi.security import APIKeyHeader, HTTPBearer
-from starlette.status import HTTP_401_UNAUTHORIZED
-
-from .config import settings
-from .jwt_utils import parse_jwt_token
-
-logger = logging.getLogger(__name__)
-bearer_auth = HTTPBearer(auto_error=False)
-
-
-async def auth_middleware(request: Request):
-    if not settings.ENABLE_AUTH:
-        # If authentication is disabled, allow the request to proceed
-        logger.warning("Auth disabled")
-        return {}
-
-    credentials = await bearer_auth(request)
-
-    if not credentials:
-        raise HTTPException(status_code=401, detail="Not authenticated")
-
-    try:
-        payload = parse_jwt_token(credentials.credentials)
-        request.state.user = payload
-        logger.debug("Token decoded successfully")
-    except ValueError as e:
-        raise HTTPException(status_code=401, detail=str(e))
-    return payload
-
-
-class APIKeyValidator:
-    """
-    Configurable API key validator that supports custom validation functions
-    for FastAPI applications.
-
-    This class provides a flexible way to implement API key authentication with optional
-    custom validation logic. It can be used for simple token matching
-    or more complex validation scenarios like database lookups.
-
-    Examples:
-        Simple token validation:
-        ```python
-        validator = APIKeyValidator(
-            header_name="X-API-Key",
-            expected_token="your-secret-token"
-        )
-
-        @app.get("/protected", dependencies=[Depends(validator.get_dependency())])
-        def protected_endpoint():
-            return {"message": "Access granted"}
-        ```
-
-        Custom validation with database lookup:
-        ```python
-        async def validate_with_db(api_key: str):
-            api_key_obj = await db.get_api_key(api_key)
-            return api_key_obj if api_key_obj and api_key_obj.is_active else None
-
-        validator = APIKeyValidator(
-            header_name="X-API-Key",
-            validate_fn=validate_with_db
-        )
-        ```
-
-    Args:
-        header_name (str): The name of the header containing the API key
-        expected_token (Optional[str]): The expected API key value for simple token matching
-        validate_fn (Optional[Callable]): Custom validation function that takes an API key
-            string and returns a boolean or object. Can be async.
-        error_status (int): HTTP status code to use for validation errors
-        error_message (str): Error message to return when validation fails
-    """
-
-    def __init__(
-        self,
-        header_name: str,
-        expected_token: Optional[str] = None,
-        validate_fn: Optional[Callable[[str], bool]] = None,
-        error_status: int = HTTP_401_UNAUTHORIZED,
-        error_message: str = "Invalid API key",
-    ):
-        # Create the APIKeyHeader as a class property
-        self.security_scheme = APIKeyHeader(name=header_name)
-        self.expected_token = expected_token
-        self.custom_validate_fn = validate_fn
-        self.error_status = error_status
-        self.error_message = error_message
-
-    async def default_validator(self, api_key: str) -> bool:
-        if not self.expected_token:
-            raise ValueError(
-                "Expected Token Required to be set when uisng API Key Validator default validation"
-            )
-        return secrets.compare_digest(api_key, self.expected_token)
-
-    async def __call__(
-        self, request: Request, api_key: str = Security(APIKeyHeader)
-    ) -> Any:
-        if api_key is None:
-            raise HTTPException(status_code=self.error_status, detail="Missing API key")
-
-        # Use custom validation if provided, otherwise use default equality check
-        validator = self.custom_validate_fn or self.default_validator
-        result = (
-            await validator(api_key)
-            if inspect.iscoroutinefunction(validator)
-            else validator(api_key)
-        )
-
-        if not result:
-            raise HTTPException(
-                status_code=self.error_status, detail=self.error_message
-            )
-
-        # Store validation result in request state if it's not just a boolean
-        if result is not True:
-            request.state.api_key = result
-
-        return result
-
-    def get_dependency(self):
-        """
-        Returns a callable dependency that FastAPI will recognize as a security scheme
-        """
-
-        async def validate_api_key(
-            request: Request, api_key: str = Security(self.security_scheme)
-        ) -> Any:
-            return await self(request, api_key)
-
-        # This helps FastAPI recognize it as a security dependency
-        validate_api_key.__name__ = f"validate_{self.security_scheme.model.name}"
-        return validate_api_key

autogpt_platform/autogpt_libs/poetry.lock

@@ -54,7 +54,7 @@ version = "1.2.0"
 description = "Backport of asyncio.Runner, a context manager that controls event loop life cycle."
 optional = false
 python-versions = "<3.11,>=3.8"
-groups = ["main"]
+groups = ["dev"]
 markers = "python_version < \"3.11\""
 files = [
     {file = "backports_asyncio_runner-1.2.0-py3-none-any.whl", hash = "sha256:0da0a936a8aeb554eccb426dc55af3ba63bcdc69fa1a600b5bb305413a4477b5"},
@@ -85,6 +85,87 @@ files = [
     {file = "certifi-2025.7.14.tar.gz", hash = "sha256:8ea99dbdfaaf2ba2f9bac77b9249ef62ec5218e7c2b2e903378ed5fccf765995"},
 ]
 
+[[package]]
+name = "cffi"
+version = "1.17.1"
+description = "Foreign Function Interface for Python calling C code."
+optional = false
+python-versions = ">=3.8"
+groups = ["main"]
+markers = "platform_python_implementation != \"PyPy\""
+files = [
+    {file = "cffi-1.17.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:df8b1c11f177bc2313ec4b2d46baec87a5f3e71fc8b45dab2ee7cae86d9aba14"},
+    {file = "cffi-1.17.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:8f2cdc858323644ab277e9bb925ad72ae0e67f69e804f4898c070998d50b1a67"},
+    {file = "cffi-1.17.1-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:edae79245293e15384b51f88b00613ba9f7198016a5948b5dddf4917d4d26382"},
+    {file = "cffi-1.17.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:45398b671ac6d70e67da8e4224a065cec6a93541bb7aebe1b198a61b58c7b702"},
+    {file = "cffi-1.17.1-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:ad9413ccdeda48c5afdae7e4fa2192157e991ff761e7ab8fdd8926f40b160cc3"},
+    {file = "cffi-1.17.1-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:5da5719280082ac6bd9aa7becb3938dc9f9cbd57fac7d2871717b1feb0902ab6"},
+    {file = "cffi-1.17.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:2bb1a08b8008b281856e5971307cc386a8e9c5b625ac297e853d36da6efe9c17"},
+    {file = "cffi-1.17.1-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:045d61c734659cc045141be4bae381a41d89b741f795af1dd018bfb532fd0df8"},
+    {file = "cffi-1.17.1-cp310-cp310-musllinux_1_1_i686.whl", hash = "sha256:6883e737d7d9e4899a8a695e00ec36bd4e5e4f18fabe0aca0efe0a4b44cdb13e"},
+    {file = "cffi-1.17.1-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:6b8b4a92e1c65048ff98cfe1f735ef8f1ceb72e3d5f0c25fdb12087a23da22be"},
+    {file = "cffi-1.17.1-cp310-cp310-win32.whl", hash = "sha256:c9c3d058ebabb74db66e431095118094d06abf53284d9c81f27300d0e0d8bc7c"},
+    {file = "cffi-1.17.1-cp310-cp310-win_amd64.whl", hash = "sha256:0f048dcf80db46f0098ccac01132761580d28e28bc0f78ae0d58048063317e15"},
+    {file = "cffi-1.17.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:a45e3c6913c5b87b3ff120dcdc03f6131fa0065027d0ed7ee6190736a74cd401"},
+    {file = "cffi-1.17.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:30c5e0cb5ae493c04c8b42916e52ca38079f1b235c2f8ae5f4527b963c401caf"},
+    {file = "cffi-1.17.1-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f75c7ab1f9e4aca5414ed4d8e5c0e303a34f4421f8a0d47a4d019ceff0ab6af4"},
+    {file = "cffi-1.17.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a1ed2dd2972641495a3ec98445e09766f077aee98a1c896dcb4ad0d303628e41"},
+    {file = "cffi-1.17.1-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:46bf43160c1a35f7ec506d254e5c890f3c03648a4dbac12d624e4490a7046cd1"},
+    {file = "cffi-1.17.1-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:a24ed04c8ffd54b0729c07cee15a81d964e6fee0e3d4d342a27b020d22959dc6"},
+    {file = "cffi-1.17.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:610faea79c43e44c71e1ec53a554553fa22321b65fae24889706c0a84d4ad86d"},
+    {file = "cffi-1.17.1-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:a9b15d491f3ad5d692e11f6b71f7857e7835eb677955c00cc0aefcd0669adaf6"},
+    {file = "cffi-1.17.1-cp311-cp311-musllinux_1_1_i686.whl", hash = "sha256:de2ea4b5833625383e464549fec1bc395c1bdeeb5f25c4a3a82b5a8c756ec22f"},
+    {file = "cffi-1.17.1-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:fc48c783f9c87e60831201f2cce7f3b2e4846bf4d8728eabe54d60700b318a0b"},
+    {file = "cffi-1.17.1-cp311-cp311-win32.whl", hash = "sha256:85a950a4ac9c359340d5963966e3e0a94a676bd6245a4b55bc43949eee26a655"},
+    {file = "cffi-1.17.1-cp311-cp311-win_amd64.whl", hash = "sha256:caaf0640ef5f5517f49bc275eca1406b0ffa6aa184892812030f04c2abf589a0"},
+    {file = "cffi-1.17.1-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:805b4371bf7197c329fcb3ead37e710d1bca9da5d583f5073b799d5c5bd1eee4"},
+    {file = "cffi-1.17.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:733e99bc2df47476e3848417c5a4540522f234dfd4ef3ab7fafdf555b082ec0c"},
+    {file = "cffi-1.17.1-cp312-cp312-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1257bdabf294dceb59f5e70c64a3e2f462c30c7ad68092d01bbbfb1c16b1ba36"},
+    {file = "cffi-1.17.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:da95af8214998d77a98cc14e3a3bd00aa191526343078b530ceb0bd710fb48a5"},
+    {file = "cffi-1.17.1-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:d63afe322132c194cf832bfec0dc69a99fb9bb6bbd550f161a49e9e855cc78ff"},
+    {file = "cffi-1.17.1-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f79fc4fc25f1c8698ff97788206bb3c2598949bfe0fef03d299eb1b5356ada99"},
+    {file = "cffi-1.17.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b62ce867176a75d03a665bad002af8e6d54644fad99a3c70905c543130e39d93"},
+    {file = "cffi-1.17.1-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:386c8bf53c502fff58903061338ce4f4950cbdcb23e2902d86c0f722b786bbe3"},
+    {file = "cffi-1.17.1-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:4ceb10419a9adf4460ea14cfd6bc43d08701f0835e979bf821052f1805850fe8"},
+    {file = "cffi-1.17.1-cp312-cp312-win32.whl", hash = "sha256:a08d7e755f8ed21095a310a693525137cfe756ce62d066e53f502a83dc550f65"},
+    {file = "cffi-1.17.1-cp312-cp312-win_amd64.whl", hash = "sha256:51392eae71afec0d0c8fb1a53b204dbb3bcabcb3c9b807eedf3e1e6ccf2de903"},
+    {file = "cffi-1.17.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:f3a2b4222ce6b60e2e8b337bb9596923045681d71e5a082783484d845390938e"},
+    {file = "cffi-1.17.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:0984a4925a435b1da406122d4d7968dd861c1385afe3b45ba82b750f229811e2"},
+    {file = "cffi-1.17.1-cp313-cp313-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:d01b12eeeb4427d3110de311e1774046ad344f5b1a7403101878976ecd7a10f3"},
+    {file = "cffi-1.17.1-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:706510fe141c86a69c8ddc029c7910003a17353970cff3b904ff0686a5927683"},
+    {file = "cffi-1.17.1-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:de55b766c7aa2e2a3092c51e0483d700341182f08e67c63630d5b6f200bb28e5"},
+    {file = "cffi-1.17.1-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:c59d6e989d07460165cc5ad3c61f9fd8f1b4796eacbd81cee78957842b834af4"},
+    {file = "cffi-1.17.1-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:dd398dbc6773384a17fe0d3e7eeb8d1a21c2200473ee6806bb5e6a8e62bb73dd"},
+    {file = "cffi-1.17.1-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:3edc8d958eb099c634dace3c7e16560ae474aa3803a5df240542b305d14e14ed"},
+    {file = "cffi-1.17.1-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:72e72408cad3d5419375fc87d289076ee319835bdfa2caad331e377589aebba9"},
+    {file = "cffi-1.17.1-cp313-cp313-win32.whl", hash = "sha256:e03eab0a8677fa80d646b5ddece1cbeaf556c313dcfac435ba11f107ba117b5d"},
+    {file = "cffi-1.17.1-cp313-cp313-win_amd64.whl", hash = "sha256:f6a16c31041f09ead72d69f583767292f750d24913dadacf5756b966aacb3f1a"},
+    {file = "cffi-1.17.1-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:636062ea65bd0195bc012fea9321aca499c0504409f413dc88af450b57ffd03b"},
+    {file = "cffi-1.17.1-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:c7eac2ef9b63c79431bc4b25f1cd649d7f061a28808cbc6c47b534bd789ef964"},
+    {file = "cffi-1.17.1-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e221cf152cff04059d011ee126477f0d9588303eb57e88923578ace7baad17f9"},
+    {file = "cffi-1.17.1-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:31000ec67d4221a71bd3f67df918b1f88f676f1c3b535a7eb473255fdc0b83fc"},
+    {file = "cffi-1.17.1-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:6f17be4345073b0a7b8ea599688f692ac3ef23ce28e5df79c04de519dbc4912c"},
+    {file = "cffi-1.17.1-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0e2b1fac190ae3ebfe37b979cc1ce69c81f4e4fe5746bb401dca63a9062cdaf1"},
+    {file = "cffi-1.17.1-cp38-cp38-win32.whl", hash = "sha256:7596d6620d3fa590f677e9ee430df2958d2d6d6de2feeae5b20e82c00b76fbf8"},
+    {file = "cffi-1.17.1-cp38-cp38-win_amd64.whl", hash = "sha256:78122be759c3f8a014ce010908ae03364d00a1f81ab5c7f4a7a5120607ea56e1"},
+    {file = "cffi-1.17.1-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:b2ab587605f4ba0bf81dc0cb08a41bd1c0a5906bd59243d56bad7668a6fc6c16"},
+    {file = "cffi-1.17.1-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:28b16024becceed8c6dfbc75629e27788d8a3f9030691a1dbf9821a128b22c36"},
+    {file = "cffi-1.17.1-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1d599671f396c4723d016dbddb72fe8e0397082b0a77a4fab8028923bec050e8"},
+    {file = "cffi-1.17.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ca74b8dbe6e8e8263c0ffd60277de77dcee6c837a3d0881d8c1ead7268c9e576"},
+    {file = "cffi-1.17.1-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:f7f5baafcc48261359e14bcd6d9bff6d4b28d9103847c9e136694cb0501aef87"},
+    {file = "cffi-1.17.1-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:98e3969bcff97cae1b2def8ba499ea3d6f31ddfdb7635374834cf89a1a08ecf0"},
+    {file = "cffi-1.17.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:cdf5ce3acdfd1661132f2a9c19cac174758dc2352bfe37d98aa7512c6b7178b3"},
+    {file = "cffi-1.17.1-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:9755e4345d1ec879e3849e62222a18c7174d65a6a92d5b346b1863912168b595"},
+    {file = "cffi-1.17.1-cp39-cp39-musllinux_1_1_i686.whl", hash = "sha256:f1e22e8c4419538cb197e4dd60acc919d7696e5ef98ee4da4e01d3f8cfa4cc5a"},
+    {file = "cffi-1.17.1-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:c03e868a0b3bc35839ba98e74211ed2b05d2119be4e8a0f224fba9384f1fe02e"},
+    {file = "cffi-1.17.1-cp39-cp39-win32.whl", hash = "sha256:e31ae45bc2e29f6b2abd0de1cc3b9d5205aa847cafaecb8af1476a609a2f6eb7"},
+    {file = "cffi-1.17.1-cp39-cp39-win_amd64.whl", hash = "sha256:d016c76bdd850f3c626af19b0542c9677ba156e4ee4fccfdd7848803533ef662"},
+    {file = "cffi-1.17.1.tar.gz", hash = "sha256:1c39c6016c32bc48dd54561950ebd6836e1670f2ae46128f67cf49e789c52824"},
+]
+
+[package.dependencies]
+pycparser = "*"
+
 [[package]]
 name = "charset-normalizer"
 version = "3.4.2"
@@ -208,12 +289,176 @@ version = "0.4.6"
 description = "Cross-platform colored terminal text."
 optional = false
 python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,!=3.6.*,>=2.7"
-groups = ["main"]
+groups = ["main", "dev"]
 files = [
     {file = "colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"},
     {file = "colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"},
 ]
 
+[[package]]
+name = "coverage"
+version = "7.10.5"
+description = "Code coverage measurement for Python"
+optional = false
+python-versions = ">=3.9"
+groups = ["dev"]
+files = [
+    {file = "coverage-7.10.5-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:c6a5c3414bfc7451b879141ce772c546985163cf553f08e0f135f0699a911801"},
+    {file = "coverage-7.10.5-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:bc8e4d99ce82f1710cc3c125adc30fd1487d3cf6c2cd4994d78d68a47b16989a"},
+    {file = "coverage-7.10.5-cp310-cp310-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:02252dc1216e512a9311f596b3169fad54abcb13827a8d76d5630c798a50a754"},
+    {file = "coverage-7.10.5-cp310-cp310-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:73269df37883e02d460bee0cc16be90509faea1e3bd105d77360b512d5bb9c33"},
+    {file = "coverage-7.10.5-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1f8a81b0614642f91c9effd53eec284f965577591f51f547a1cbeb32035b4c2f"},
+    {file = "coverage-7.10.5-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:6a29f8e0adb7f8c2b95fa2d4566a1d6e6722e0a637634c6563cb1ab844427dd9"},
+    {file = "coverage-7.10.5-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:fcf6ab569436b4a647d4e91accba12509ad9f2554bc93d3aee23cc596e7f99c3"},
+    {file = "coverage-7.10.5-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:90dc3d6fb222b194a5de60af8d190bedeeddcbc7add317e4a3cd333ee6b7c879"},
+    {file = "coverage-7.10.5-cp310-cp310-win32.whl", hash = "sha256:414a568cd545f9dc75f0686a0049393de8098414b58ea071e03395505b73d7a8"},
+    {file = "coverage-7.10.5-cp310-cp310-win_amd64.whl", hash = "sha256:e551f9d03347196271935fd3c0c165f0e8c049220280c1120de0084d65e9c7ff"},
+    {file = "coverage-7.10.5-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:c177e6ffe2ebc7c410785307758ee21258aa8e8092b44d09a2da767834f075f2"},
+    {file = "coverage-7.10.5-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:14d6071c51ad0f703d6440827eaa46386169b5fdced42631d5a5ac419616046f"},
+    {file = "coverage-7.10.5-cp311-cp311-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:61f78c7c3bc272a410c5ae3fde7792b4ffb4acc03d35a7df73ca8978826bb7ab"},
+    {file = "coverage-7.10.5-cp311-cp311-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:f39071caa126f69d63f99b324fb08c7b1da2ec28cbb1fe7b5b1799926492f65c"},
+    {file = "coverage-7.10.5-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:343a023193f04d46edc46b2616cdbee68c94dd10208ecd3adc56fcc54ef2baa1"},
+    {file = "coverage-7.10.5-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:585ffe93ae5894d1ebdee69fc0b0d4b7c75d8007983692fb300ac98eed146f78"},
+    {file = "coverage-7.10.5-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:b0ef4e66f006ed181df29b59921bd8fc7ed7cd6a9289295cd8b2824b49b570df"},
+    {file = "coverage-7.10.5-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:eb7b0bbf7cc1d0453b843eca7b5fa017874735bef9bfdfa4121373d2cc885ed6"},
+    {file = "coverage-7.10.5-cp311-cp311-win32.whl", hash = "sha256:1d043a8a06987cc0c98516e57c4d3fc2c1591364831e9deb59c9e1b4937e8caf"},
+    {file = "coverage-7.10.5-cp311-cp311-win_amd64.whl", hash = "sha256:fefafcca09c3ac56372ef64a40f5fe17c5592fab906e0fdffd09543f3012ba50"},
+    {file = "coverage-7.10.5-cp311-cp311-win_arm64.whl", hash = "sha256:7e78b767da8b5fc5b2faa69bb001edafcd6f3995b42a331c53ef9572c55ceb82"},
+    {file = "coverage-7.10.5-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:c2d05c7e73c60a4cecc7d9b60dbfd603b4ebc0adafaef371445b47d0f805c8a9"},
+    {file = "coverage-7.10.5-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:32ddaa3b2c509778ed5373b177eb2bf5662405493baeff52278a0b4f9415188b"},
+    {file = "coverage-7.10.5-cp312-cp312-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:dd382410039fe062097aa0292ab6335a3f1e7af7bba2ef8d27dcda484918f20c"},
+    {file = "coverage-7.10.5-cp312-cp312-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:7fa22800f3908df31cea6fb230f20ac49e343515d968cc3a42b30d5c3ebf9b5a"},
+    {file = "coverage-7.10.5-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f366a57ac81f5e12797136552f5b7502fa053c861a009b91b80ed51f2ce651c6"},
+    {file = "coverage-7.10.5-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:5f1dc8f1980a272ad4a6c84cba7981792344dad33bf5869361576b7aef42733a"},
+    {file = "coverage-7.10.5-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:2285c04ee8676f7938b02b4936d9b9b672064daab3187c20f73a55f3d70e6b4a"},
+    {file = "coverage-7.10.5-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:c2492e4dd9daab63f5f56286f8a04c51323d237631eb98505d87e4c4ff19ec34"},
+    {file = "coverage-7.10.5-cp312-cp312-win32.whl", hash = "sha256:38a9109c4ee8135d5df5505384fc2f20287a47ccbe0b3f04c53c9a1989c2bbaf"},
+    {file = "coverage-7.10.5-cp312-cp312-win_amd64.whl", hash = "sha256:6b87f1ad60b30bc3c43c66afa7db6b22a3109902e28c5094957626a0143a001f"},
+    {file = "coverage-7.10.5-cp312-cp312-win_arm64.whl", hash = "sha256:672a6c1da5aea6c629819a0e1461e89d244f78d7b60c424ecf4f1f2556c041d8"},
+    {file = "coverage-7.10.5-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:ef3b83594d933020f54cf65ea1f4405d1f4e41a009c46df629dd964fcb6e907c"},
+    {file = "coverage-7.10.5-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:2b96bfdf7c0ea9faebce088a3ecb2382819da4fbc05c7b80040dbc428df6af44"},
+    {file = "coverage-7.10.5-cp313-cp313-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:63df1fdaffa42d914d5c4d293e838937638bf75c794cf20bee12978fc8c4e3bc"},
+    {file = "coverage-7.10.5-cp313-cp313-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:8002dc6a049aac0e81ecec97abfb08c01ef0c1fbf962d0c98da3950ace89b869"},
+    {file = "coverage-7.10.5-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:63d4bb2966d6f5f705a6b0c6784c8969c468dbc4bcf9d9ded8bff1c7e092451f"},
+    {file = "coverage-7.10.5-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:1f672efc0731a6846b157389b6e6d5d5e9e59d1d1a23a5c66a99fd58339914d5"},
+    {file = "coverage-7.10.5-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:3f39cef43d08049e8afc1fde4a5da8510fc6be843f8dea350ee46e2a26b2f54c"},
+    {file = "coverage-7.10.5-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:2968647e3ed5a6c019a419264386b013979ff1fb67dd11f5c9886c43d6a31fc2"},
+    {file = "coverage-7.10.5-cp313-cp313-win32.whl", hash = "sha256:0d511dda38595b2b6934c2b730a1fd57a3635c6aa2a04cb74714cdfdd53846f4"},
+    {file = "coverage-7.10.5-cp313-cp313-win_amd64.whl", hash = "sha256:9a86281794a393513cf117177fd39c796b3f8e3759bb2764259a2abba5cce54b"},
+    {file = "coverage-7.10.5-cp313-cp313-win_arm64.whl", hash = "sha256:cebd8e906eb98bb09c10d1feed16096700b1198d482267f8bf0474e63a7b8d84"},
+    {file = "coverage-7.10.5-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:0520dff502da5e09d0d20781df74d8189ab334a1e40d5bafe2efaa4158e2d9e7"},
+    {file = "coverage-7.10.5-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:d9cd64aca68f503ed3f1f18c7c9174cbb797baba02ca8ab5112f9d1c0328cd4b"},
+    {file = "coverage-7.10.5-cp313-cp313t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:0913dd1613a33b13c4f84aa6e3f4198c1a21ee28ccb4f674985c1f22109f0aae"},
+    {file = "coverage-7.10.5-cp313-cp313t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:1b7181c0feeb06ed8a02da02792f42f829a7b29990fef52eff257fef0885d760"},
+    {file = "coverage-7.10.5-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:36d42b7396b605f774d4372dd9c49bed71cbabce4ae1ccd074d155709dd8f235"},
+    {file = "coverage-7.10.5-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:b4fdc777e05c4940b297bf47bf7eedd56a39a61dc23ba798e4b830d585486ca5"},
+    {file = "coverage-7.10.5-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:42144e8e346de44a6f1dbd0a56575dd8ab8dfa7e9007da02ea5b1c30ab33a7db"},
+    {file = "coverage-7.10.5-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:66c644cbd7aed8fe266d5917e2c9f65458a51cfe5eeff9c05f15b335f697066e"},
+    {file = "coverage-7.10.5-cp313-cp313t-win32.whl", hash = "sha256:2d1b73023854068c44b0c554578a4e1ef1b050ed07cf8b431549e624a29a66ee"},
+    {file = "coverage-7.10.5-cp313-cp313t-win_amd64.whl", hash = "sha256:54a1532c8a642d8cc0bd5a9a51f5a9dcc440294fd06e9dda55e743c5ec1a8f14"},
+    {file = "coverage-7.10.5-cp313-cp313t-win_arm64.whl", hash = "sha256:74d5b63fe3f5f5d372253a4ef92492c11a4305f3550631beaa432fc9df16fcff"},
+    {file = "coverage-7.10.5-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:68c5e0bc5f44f68053369fa0d94459c84548a77660a5f2561c5e5f1e3bed7031"},
+    {file = "coverage-7.10.5-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:cf33134ffae93865e32e1e37df043bef15a5e857d8caebc0099d225c579b0fa3"},
+    {file = "coverage-7.10.5-cp314-cp314-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:ad8fa9d5193bafcf668231294241302b5e683a0518bf1e33a9a0dfb142ec3031"},
+    {file = "coverage-7.10.5-cp314-cp314-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:146fa1531973d38ab4b689bc764592fe6c2f913e7e80a39e7eeafd11f0ef6db2"},
+    {file = "coverage-7.10.5-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6013a37b8a4854c478d3219ee8bc2392dea51602dd0803a12d6f6182a0061762"},
+    {file = "coverage-7.10.5-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:eb90fe20db9c3d930fa2ad7a308207ab5b86bf6a76f54ab6a40be4012d88fcae"},
+    {file = "coverage-7.10.5-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:384b34482272e960c438703cafe63316dfbea124ac62006a455c8410bf2a2262"},
+    {file = "coverage-7.10.5-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:467dc74bd0a1a7de2bedf8deaf6811f43602cb532bd34d81ffd6038d6d8abe99"},
+    {file = "coverage-7.10.5-cp314-cp314-win32.whl", hash = "sha256:556d23d4e6393ca898b2e63a5bca91e9ac2d5fb13299ec286cd69a09a7187fde"},
+    {file = "coverage-7.10.5-cp314-cp314-win_amd64.whl", hash = "sha256:f4446a9547681533c8fa3e3c6cf62121eeee616e6a92bd9201c6edd91beffe13"},
+    {file = "coverage-7.10.5-cp314-cp314-win_arm64.whl", hash = "sha256:5e78bd9cf65da4c303bf663de0d73bf69f81e878bf72a94e9af67137c69b9fe9"},
+    {file = "coverage-7.10.5-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:5661bf987d91ec756a47c7e5df4fbcb949f39e32f9334ccd3f43233bbb65e508"},
+    {file = "coverage-7.10.5-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:a46473129244db42a720439a26984f8c6f834762fc4573616c1f37f13994b357"},
+    {file = "coverage-7.10.5-cp314-cp314t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:1f64b8d3415d60f24b058b58d859e9512624bdfa57a2d1f8aff93c1ec45c429b"},
+    {file = "coverage-7.10.5-cp314-cp314t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:44d43de99a9d90b20e0163f9770542357f58860a26e24dc1d924643bd6aa7cb4"},
+    {file = "coverage-7.10.5-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a931a87e5ddb6b6404e65443b742cb1c14959622777f2a4efd81fba84f5d91ba"},
+    {file = "coverage-7.10.5-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:f9559b906a100029274448f4c8b8b0a127daa4dade5661dfd821b8c188058842"},
+    {file = "coverage-7.10.5-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:b08801e25e3b4526ef9ced1aa29344131a8f5213c60c03c18fe4c6170ffa2874"},
+    {file = "coverage-7.10.5-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:ed9749bb8eda35f8b636fb7632f1c62f735a236a5d4edadd8bbcc5ea0542e732"},
+    {file = "coverage-7.10.5-cp314-cp314t-win32.whl", hash = "sha256:609b60d123fc2cc63ccee6d17e4676699075db72d14ac3c107cc4976d516f2df"},
+    {file = "coverage-7.10.5-cp314-cp314t-win_amd64.whl", hash = "sha256:0666cf3d2c1626b5a3463fd5b05f5e21f99e6aec40a3192eee4d07a15970b07f"},
+    {file = "coverage-7.10.5-cp314-cp314t-win_arm64.whl", hash = "sha256:bc85eb2d35e760120540afddd3044a5bf69118a91a296a8b3940dfc4fdcfe1e2"},
+    {file = "coverage-7.10.5-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:62835c1b00c4a4ace24c1a88561a5a59b612fbb83a525d1c70ff5720c97c0610"},
+    {file = "coverage-7.10.5-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:5255b3bbcc1d32a4069d6403820ac8e6dbcc1d68cb28a60a1ebf17e47028e898"},
+    {file = "coverage-7.10.5-cp39-cp39-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:3876385722e335d6e991c430302c24251ef9c2a9701b2b390f5473199b1b8ebf"},
+    {file = "coverage-7.10.5-cp39-cp39-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:8048ce4b149c93447a55d279078c8ae98b08a6951a3c4d2d7e87f4efc7bfe100"},
+    {file = "coverage-7.10.5-cp39-cp39-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4028e7558e268dd8bcf4d9484aad393cafa654c24b4885f6f9474bf53183a82a"},
+    {file = "coverage-7.10.5-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:03f47dc870eec0367fcdd603ca6a01517d2504e83dc18dbfafae37faec66129a"},
+    {file = "coverage-7.10.5-cp39-cp39-musllinux_1_2_i686.whl", hash = "sha256:2d488d7d42b6ded7ea0704884f89dcabd2619505457de8fc9a6011c62106f6e5"},
+    {file = "coverage-7.10.5-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:b3dcf2ead47fa8be14224ee817dfc1df98043af568fe120a22f81c0eb3c34ad2"},
+    {file = "coverage-7.10.5-cp39-cp39-win32.whl", hash = "sha256:02650a11324b80057b8c9c29487020073d5e98a498f1857f37e3f9b6ea1b2426"},
+    {file = "coverage-7.10.5-cp39-cp39-win_amd64.whl", hash = "sha256:b45264dd450a10f9e03237b41a9a24e85cbb1e278e5a32adb1a303f58f0017f3"},
+    {file = "coverage-7.10.5-py3-none-any.whl", hash = "sha256:0be24d35e4db1d23d0db5c0f6a74a962e2ec83c426b5cac09f4234aadef38e4a"},
+    {file = "coverage-7.10.5.tar.gz", hash = "sha256:f2e57716a78bc3ae80b2207be0709a3b2b63b9f2dcf9740ee6ac03588a2015b6"},
+]
+
+[package.dependencies]
+tomli = {version = "*", optional = true, markers = "python_full_version <= \"3.11.0a6\" and extra == \"toml\""}
+
+[package.extras]
+toml = ["tomli ; python_full_version <= \"3.11.0a6\""]
+
+[[package]]
+name = "cryptography"
+version = "45.0.6"
+description = "cryptography is a package which provides cryptographic recipes and primitives to Python developers."
+optional = false
+python-versions = "!=3.9.0,!=3.9.1,>=3.7"
+groups = ["main"]
+files = [
+    {file = "cryptography-45.0.6-cp311-abi3-macosx_10_9_universal2.whl", hash = "sha256:048e7ad9e08cf4c0ab07ff7f36cc3115924e22e2266e034450a890d9e312dd74"},
+    {file = "cryptography-45.0.6-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:44647c5d796f5fc042bbc6d61307d04bf29bccb74d188f18051b635f20a9c75f"},
+    {file = "cryptography-45.0.6-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:e40b80ecf35ec265c452eea0ba94c9587ca763e739b8e559c128d23bff7ebbbf"},
+    {file = "cryptography-45.0.6-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:00e8724bdad672d75e6f069b27970883179bd472cd24a63f6e620ca7e41cc0c5"},
+    {file = "cryptography-45.0.6-cp311-abi3-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:7a3085d1b319d35296176af31c90338eeb2ddac8104661df79f80e1d9787b8b2"},
+    {file = "cryptography-45.0.6-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:1b7fa6a1c1188c7ee32e47590d16a5a0646270921f8020efc9a511648e1b2e08"},
+    {file = "cryptography-45.0.6-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:275ba5cc0d9e320cd70f8e7b96d9e59903c815ca579ab96c1e37278d231fc402"},
+    {file = "cryptography-45.0.6-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:f4028f29a9f38a2025abedb2e409973709c660d44319c61762202206ed577c42"},
+    {file = "cryptography-45.0.6-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:ee411a1b977f40bd075392c80c10b58025ee5c6b47a822a33c1198598a7a5f05"},
+    {file = "cryptography-45.0.6-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:e2a21a8eda2d86bb604934b6b37691585bd095c1f788530c1fcefc53a82b3453"},
+    {file = "cryptography-45.0.6-cp311-abi3-win32.whl", hash = "sha256:d063341378d7ee9c91f9d23b431a3502fc8bfacd54ef0a27baa72a0843b29159"},
+    {file = "cryptography-45.0.6-cp311-abi3-win_amd64.whl", hash = "sha256:833dc32dfc1e39b7376a87b9a6a4288a10aae234631268486558920029b086ec"},
+    {file = "cryptography-45.0.6-cp37-abi3-macosx_10_9_universal2.whl", hash = "sha256:3436128a60a5e5490603ab2adbabc8763613f638513ffa7d311c900a8349a2a0"},
+    {file = "cryptography-45.0.6-cp37-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:0d9ef57b6768d9fa58e92f4947cea96ade1233c0e236db22ba44748ffedca394"},
+    {file = "cryptography-45.0.6-cp37-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:ea3c42f2016a5bbf71825537c2ad753f2870191134933196bee408aac397b3d9"},
+    {file = "cryptography-45.0.6-cp37-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:20ae4906a13716139d6d762ceb3e0e7e110f7955f3bc3876e3a07f5daadec5f3"},
+    {file = "cryptography-45.0.6-cp37-abi3-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:2dac5ec199038b8e131365e2324c03d20e97fe214af051d20c49db129844e8b3"},
+    {file = "cryptography-45.0.6-cp37-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:18f878a34b90d688982e43f4b700408b478102dd58b3e39de21b5ebf6509c301"},
+    {file = "cryptography-45.0.6-cp37-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:5bd6020c80c5b2b2242d6c48487d7b85700f5e0038e67b29d706f98440d66eb5"},
+    {file = "cryptography-45.0.6-cp37-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:eccddbd986e43014263eda489abbddfbc287af5cddfd690477993dbb31e31016"},
+    {file = "cryptography-45.0.6-cp37-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:550ae02148206beb722cfe4ef0933f9352bab26b087af00e48fdfb9ade35c5b3"},
+    {file = "cryptography-45.0.6-cp37-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:5b64e668fc3528e77efa51ca70fadcd6610e8ab231e3e06ae2bab3b31c2b8ed9"},
+    {file = "cryptography-45.0.6-cp37-abi3-win32.whl", hash = "sha256:780c40fb751c7d2b0c6786ceee6b6f871e86e8718a8ff4bc35073ac353c7cd02"},
+    {file = "cryptography-45.0.6-cp37-abi3-win_amd64.whl", hash = "sha256:20d15aed3ee522faac1a39fbfdfee25d17b1284bafd808e1640a74846d7c4d1b"},
+    {file = "cryptography-45.0.6-pp310-pypy310_pp73-macosx_10_9_x86_64.whl", hash = "sha256:705bb7c7ecc3d79a50f236adda12ca331c8e7ecfbea51edd931ce5a7a7c4f012"},
+    {file = "cryptography-45.0.6-pp310-pypy310_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:826b46dae41a1155a0c0e66fafba43d0ede1dc16570b95e40c4d83bfcf0a451d"},
+    {file = "cryptography-45.0.6-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:cc4d66f5dc4dc37b89cfef1bd5044387f7a1f6f0abb490815628501909332d5d"},
+    {file = "cryptography-45.0.6-pp310-pypy310_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:f68f833a9d445cc49f01097d95c83a850795921b3f7cc6488731e69bde3288da"},
+    {file = "cryptography-45.0.6-pp310-pypy310_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:3b5bf5267e98661b9b888a9250d05b063220dfa917a8203744454573c7eb79db"},
+    {file = "cryptography-45.0.6-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:2384f2ab18d9be88a6e4f8972923405e2dbb8d3e16c6b43f15ca491d7831bd18"},
+    {file = "cryptography-45.0.6-pp311-pypy311_pp73-macosx_10_9_x86_64.whl", hash = "sha256:fc022c1fa5acff6def2fc6d7819bbbd31ccddfe67d075331a65d9cfb28a20983"},
+    {file = "cryptography-45.0.6-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:3de77e4df42ac8d4e4d6cdb342d989803ad37707cf8f3fbf7b088c9cbdd46427"},
+    {file = "cryptography-45.0.6-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:599c8d7df950aa68baa7e98f7b73f4f414c9f02d0e8104a30c0182a07732638b"},
+    {file = "cryptography-45.0.6-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:31a2b9a10530a1cb04ffd6aa1cd4d3be9ed49f7d77a4dafe198f3b382f41545c"},
+    {file = "cryptography-45.0.6-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:e5b3dda1b00fb41da3af4c5ef3f922a200e33ee5ba0f0bc9ecf0b0c173958385"},
+    {file = "cryptography-45.0.6-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:629127cfdcdc6806dfe234734d7cb8ac54edaf572148274fa377a7d3405b0043"},
+    {file = "cryptography-45.0.6.tar.gz", hash = "sha256:5c966c732cf6e4a276ce83b6e4c729edda2df6929083a952cc7da973c539c719"},
+]
+
+[package.dependencies]
+cffi = {version = ">=1.14", markers = "platform_python_implementation != \"PyPy\""}
+
+[package.extras]
+docs = ["sphinx (>=5.3.0)", "sphinx-inline-tabs ; python_full_version >= \"3.8.0\"", "sphinx-rtd-theme (>=3.0.0) ; python_full_version >= \"3.8.0\""]
+docstest = ["pyenchant (>=3)", "readme-renderer (>=30.0)", "sphinxcontrib-spelling (>=7.3.1)"]
+nox = ["nox (>=2024.4.15)", "nox[uv] (>=2024.3.2) ; python_full_version >= \"3.8.0\""]
+pep8test = ["check-sdist ; python_full_version >= \"3.8.0\"", "click (>=8.0.1)", "mypy (>=1.4)", "ruff (>=0.3.6)"]
+sdist = ["build (>=1.0.0)"]
+ssh = ["bcrypt (>=3.1.5)"]
+test = ["certifi (>=2024)", "cryptography-vectors (==45.0.6)", "pretend (>=0.7)", "pytest (>=7.4.0)", "pytest-benchmark (>=4.0)", "pytest-cov (>=2.10.1)", "pytest-xdist (>=3.5.0)"]
+test-randomorder = ["pytest-randomly"]
+
 [[package]]
 name = "deprecation"
 version = "2.1.0"
@@ -235,7 +480,7 @@ version = "1.3.0"
 description = "Backport of PEP 654 (exception groups)"
 optional = false
 python-versions = ">=3.7"
-groups = ["main"]
+groups = ["main", "dev"]
 markers = "python_version < \"3.11\""
 files = [
     {file = "exceptiongroup-1.3.0-py3-none-any.whl", hash = "sha256:4d111e6e0c13d0644cad6ddaa7ed0261a0b36971f6d23e7ec9b4b9097da78a10"},
@@ -710,7 +955,7 @@ version = "2.1.0"
 description = "brain-dead simple config-ini parsing"
 optional = false
 python-versions = ">=3.8"
-groups = ["main"]
+groups = ["dev"]
 files = [
     {file = "iniconfig-2.1.0-py3-none-any.whl", hash = "sha256:9deba5723312380e77435581c6bf4935c94cbfab9b1ed33ef8d238ea168eb760"},
     {file = "iniconfig-2.1.0.tar.gz", hash = "sha256:3abbd2e30b36733fee78f9c7f7308f2d0050e88f0087fd25c2645f63c773e1c7"},
@@ -779,7 +1024,7 @@ version = "25.0"
 description = "Core utilities for Python packages"
 optional = false
 python-versions = ">=3.8"
-groups = ["main"]
+groups = ["main", "dev"]
 files = [
     {file = "packaging-25.0-py3-none-any.whl", hash = "sha256:29572ef2b1f17581046b3a2227d5c611fb25ec70ca1ba8554b24b0e69331a484"},
     {file = "packaging-25.0.tar.gz", hash = "sha256:d443872c98d677bf60f6a1f2f8c1cb748e8fe762d2bf9d3148b5599295b0fc4f"},
@@ -791,7 +1036,7 @@ version = "1.6.0"
 description = "plugin and hook calling mechanisms for python"
 optional = false
 python-versions = ">=3.9"
-groups = ["main"]
+groups = ["dev"]
 files = [
     {file = "pluggy-1.6.0-py3-none-any.whl", hash = "sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746"},
     {file = "pluggy-1.6.0.tar.gz", hash = "sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3"},
@@ -883,6 +1128,19 @@ files = [
 [package.dependencies]
 pyasn1 = ">=0.6.1,<0.7.0"
 
+[[package]]
+name = "pycparser"
+version = "2.22"
+description = "C parser in Python"
+optional = false
+python-versions = ">=3.8"
+groups = ["main"]
+markers = "platform_python_implementation != \"PyPy\""
+files = [
+    {file = "pycparser-2.22-py3-none-any.whl", hash = "sha256:c3702b6d3dd8c7abc1afa565d7e63d53a1d0bd86cdc24edd75470f4de499cfcc"},
+    {file = "pycparser-2.22.tar.gz", hash = "sha256:491c8be9c040f5390f5bf44a5b07752bd07f56edf992381b05c701439eec10f6"},
+]
+
 [[package]]
 name = "pydantic"
 version = "2.11.7"
@@ -1047,7 +1305,7 @@ version = "2.19.2"
 description = "Pygments is a syntax highlighting package written in Python."
 optional = false
 python-versions = ">=3.8"
-groups = ["main"]
+groups = ["dev"]
 files = [
     {file = "pygments-2.19.2-py3-none-any.whl", hash = "sha256:86540386c03d588bb81d44bc3928634ff26449851e99741617ecb9037ee5ec0b"},
     {file = "pygments-2.19.2.tar.gz", hash = "sha256:636cb2477cec7f8952536970bc533bc43743542f70392ae026374600add5b887"},
@@ -1068,6 +1326,9 @@ files = [
     {file = "pyjwt-2.10.1.tar.gz", hash = "sha256:3cc5772eb20009233caf06e9d8a0577824723b44e6648ee0a2aedb6cf9381953"},
 ]
 
+[package.dependencies]
+cryptography = {version = ">=3.4.0", optional = true, markers = "extra == \"crypto\""}
+
 [package.extras]
 crypto = ["cryptography (>=3.4.0)"]
 dev = ["coverage[toml] (==5.0.4)", "cryptography (>=3.4.0)", "pre-commit", "pytest (>=6.0.0,<7.0.0)", "sphinx", "sphinx-rtd-theme", "zope.interface"]
@@ -1092,7 +1353,7 @@ version = "8.4.1"
 description = "pytest: simple powerful testing with Python"
 optional = false
 python-versions = ">=3.9"
-groups = ["main"]
+groups = ["dev"]
 files = [
     {file = "pytest-8.4.1-py3-none-any.whl", hash = "sha256:539c70ba6fcead8e78eebbf1115e8b589e7565830d7d006a8723f19ac8a0afb7"},
     {file = "pytest-8.4.1.tar.gz", hash = "sha256:7c67fd69174877359ed9371ec3af8a3d2b04741818c51e5e99cc1742251fa93c"},
@@ -1116,7 +1377,7 @@ version = "1.1.0"
 description = "Pytest support for asyncio"
 optional = false
 python-versions = ">=3.9"
-groups = ["main"]
+groups = ["dev"]
 files = [
     {file = "pytest_asyncio-1.1.0-py3-none-any.whl", hash = "sha256:5fe2d69607b0bd75c656d1211f969cadba035030156745ee09e7d71740e58ecf"},
     {file = "pytest_asyncio-1.1.0.tar.gz", hash = "sha256:796aa822981e01b68c12e4827b8697108f7205020f24b5793b3c41555dab68ea"},
@@ -1130,13 +1391,33 @@ pytest = ">=8.2,<9"
 docs = ["sphinx (>=5.3)", "sphinx-rtd-theme (>=1)"]
 testing = ["coverage (>=6.2)", "hypothesis (>=5.7.1)"]
 
+[[package]]
+name = "pytest-cov"
+version = "6.2.1"
+description = "Pytest plugin for measuring coverage."
+optional = false
+python-versions = ">=3.9"
+groups = ["dev"]
+files = [
+    {file = "pytest_cov-6.2.1-py3-none-any.whl", hash = "sha256:f5bc4c23f42f1cdd23c70b1dab1bbaef4fc505ba950d53e0081d0730dd7e86d5"},
+    {file = "pytest_cov-6.2.1.tar.gz", hash = "sha256:25cc6cc0a5358204b8108ecedc51a9b57b34cc6b8c967cc2c01a4e00d8a67da2"},
+]
+
+[package.dependencies]
+coverage = {version = ">=7.5", extras = ["toml"]}
+pluggy = ">=1.2"
+pytest = ">=6.2.5"
+
+[package.extras]
+testing = ["fields", "hunter", "process-tests", "pytest-xdist", "virtualenv"]
+
 [[package]]
 name = "pytest-mock"
 version = "3.14.1"
 description = "Thin-wrapper around the mock package for easier use with pytest"
 optional = false
 python-versions = ">=3.8"
-groups = ["main"]
+groups = ["dev"]
 files = [
     {file = "pytest_mock-3.14.1-py3-none-any.whl", hash = "sha256:178aefcd11307d874b4cd3100344e7e2d888d9791a6a1d9bfe90fbc1b74fd1d0"},
     {file = "pytest_mock-3.14.1.tar.gz", hash = "sha256:159e9edac4c451ce77a5cdb9fc5d1100708d2dd4ba3c3df572f14097351af80e"},
@@ -1411,7 +1692,7 @@ version = "2.2.1"
 description = "A lil' TOML parser"
 optional = false
 python-versions = ">=3.8"
-groups = ["main"]
+groups = ["dev"]
 markers = "python_version < \"3.11\""
 files = [
     {file = "tomli-2.2.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:678e4fa69e4575eb77d103de3df8a895e1591b48e740211bd1067378c69e8249"},
@@ -1454,11 +1735,12 @@ version = "4.14.1"
 description = "Backported and Experimental Type Hints for Python 3.9+"
 optional = false
 python-versions = ">=3.9"
-groups = ["main"]
+groups = ["main", "dev"]
 files = [
     {file = "typing_extensions-4.14.1-py3-none-any.whl", hash = "sha256:d1e1e3b58374dc93031d6eda2420a48ea44a36c2b4766a4fdeb3710755731d76"},
     {file = "typing_extensions-4.14.1.tar.gz", hash = "sha256:38b39f4aeeab64884ce9f74c94263ef78f3c22467c8724005483154c26648d36"},
 ]
+markers = {dev = "python_version < \"3.11\""}
 
 [[package]]
 name = "typing-inspection"
@@ -1615,4 +1897,4 @@ type = ["pytest-mypy"]
 [metadata]
 lock-version = "2.1"
 python-versions = ">=3.10,<4.0"
-content-hash = "4cc687aabe5865665fb8c4ccc0ea7e0af80b41e401ca37919f57efa6e0b5be00"
+content-hash = "ef7818fba061cea2841c6d7ca4852acde83e4f73b32fca1315e58660002bb0d0"

autogpt_platform/autogpt_libs/pyproject.toml

@@ -15,15 +15,17 @@ google-cloud-logging = "^3.12.1"
 launchdarkly-server-sdk = "^9.12.0"
 pydantic = "^2.11.7"
 pydantic-settings = "^2.10.1"
-pyjwt = "^2.10.1"
-pytest-asyncio = "^1.1.0"
-pytest-mock = "^3.14.1"
+pyjwt = { version = "^2.10.1", extras = ["crypto"] }
 redis = "^6.2.0"
 supabase = "^2.16.0"
 uvicorn = "^0.35.0"
 
 [tool.poetry.group.dev.dependencies]
 ruff = "^0.12.9"
+pytest = "^8.4.1"
+pytest-asyncio = "^1.1.0"
+pytest-mock = "^3.14.1"
+pytest-cov = "^6.2.1"
 
 [build-system]
 requires = ["poetry-core"]

autogpt_platform/backend/.env.default

@@ -16,7 +16,6 @@ DB_SCHEMA=platform
 DATABASE_URL="postgresql://${DB_USER}:${DB_PASS}@${DB_HOST}:${DB_PORT}/${DB_NAME}?schema=${DB_SCHEMA}&connect_timeout=${DB_CONNECT_TIMEOUT}"
 DIRECT_URL="postgresql://${DB_USER}:${DB_PASS}@${DB_HOST}:${DB_PORT}/${DB_NAME}?schema=${DB_SCHEMA}&connect_timeout=${DB_CONNECT_TIMEOUT}"
 PRISMA_SCHEMA="postgres/schema.prisma"
-ENABLE_AUTH=true
 
 ## ===== REQUIRED SERVICE CREDENTIALS ===== ##
 # Redis Configuration
@@ -31,7 +30,7 @@ RABBITMQ_DEFAULT_PASS=k0VMxyIJF9S35f3x2uaw5IWAl6Y536O7
 # Supabase Authentication
 SUPABASE_URL=http://localhost:8000
 SUPABASE_SERVICE_ROLE_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyAgCiAgICAicm9sZSI6ICJzZXJ2aWNlX3JvbGUiLAogICAgImlzcyI6ICJzdXBhYmFzZS1kZW1vIiwKICAgICJpYXQiOiAxNjQxNzY5MjAwLAogICAgImV4cCI6IDE3OTk1MzU2MDAKfQ.DaYlNEoUrrEn2Ig7tqibS-PHK5vgusbcbo7X36XVt4Q
-SUPABASE_JWT_SECRET=your-super-secret-jwt-token-with-at-least-32-characters-long
+JWT_VERIFY_KEY=your-super-secret-jwt-token-with-at-least-32-characters-long
 
 ## ===== REQUIRED SECURITY KEYS ===== ##
 # Generate using: from cryptography.fernet import Fernet;Fernet.generate_key().decode()
@@ -175,4 +174,4 @@ SMARTLEAD_API_KEY=
 ZEROBOUNCE_API_KEY=
 
 # Other Services
-AUTOMOD_API_KEY=
+AUTOMOD_API_KEY=

autogpt_platform/backend/TESTING.md

@@ -132,17 +132,58 @@ def test_endpoint_success(snapshot: Snapshot):
 
 ### Testing with Authentication
 
+For the main API routes that use JWT authentication, auth is provided by the `autogpt_libs.auth` module. If the test actually uses the `user_id`, the recommended approach for testing is to mock the `get_jwt_payload` function, which underpins all higher-level auth functions used in the API (`requires_user`, `requires_admin_user`, `get_user_id`).
+
+If the test doesn't need the `user_id` specifically, mocking is not necessary as during tests auth is disabled anyway (see `conftest.py`).
+
+#### Using Global Auth Fixtures
+
+Two global auth fixtures are provided by `backend/server/conftest.py`:
+
+- `mock_jwt_user` - Regular user with `test_user_id` ("test-user-id")
+- `mock_jwt_admin` - Admin user with `admin_user_id` ("admin-user-id")
+
+These provide the easiest way to set up authentication mocking in test modules:
+
 ```python
-def override_auth_middleware():
-    return {"sub": "test-user-id"}
+import fastapi
+import fastapi.testclient
+import pytest
+from backend.server.v2.myroute import router
 
-def override_get_user_id():
-    return "test-user-id"
+app = fastapi.FastAPI()
+app.include_router(router)
+client = fastapi.testclient.TestClient(app)
 
-app.dependency_overrides[auth_middleware] = override_auth_middleware
-app.dependency_overrides[get_user_id] = override_get_user_id
+@pytest.fixture(autouse=True)
+def setup_app_auth(mock_jwt_user):
+    """Setup auth overrides for all tests in this module"""
+    from autogpt_libs.auth.jwt_utils import get_jwt_payload
+
+    app.dependency_overrides[get_jwt_payload] = mock_jwt_user['get_jwt_payload']
+    yield
+    app.dependency_overrides.clear()
 ```
 
+For admin-only endpoints, use `mock_jwt_admin` instead:
+
+```python
+@pytest.fixture(autouse=True)
+def setup_app_auth(mock_jwt_admin):
+    """Setup auth overrides for admin tests"""
+    from autogpt_libs.auth.jwt_utils import get_jwt_payload
+
+    app.dependency_overrides[get_jwt_payload] = mock_jwt_admin['get_jwt_payload']
+    yield
+    app.dependency_overrides.clear()
+```
+
+The IDs are also available separately as fixtures:
+
+- `test_user_id`
+- `admin_user_id`
+- `target_user_id` (for admin <-> user operations)
+
 ### Mocking External Services
 
 ```python
@@ -153,10 +194,10 @@ def test_external_api_call(mocker, snapshot):
         "backend.services.external_api.call",
         return_value=mock_response
     )
-    
+
     response = client.post("/api/process")
     assert response.status_code == 200
-    
+
     snapshot.snapshot_dir = "snapshots"
     snapshot.assert_match(
         json.dumps(response.json(), indent=2, sort_keys=True),
@@ -187,6 +228,17 @@ def test_external_api_call(mocker, snapshot):
 - Use `async def` with `@pytest.mark.asyncio` for testing async functions directly
 
 ### 5. Fixtures
+
+#### Global Fixtures (conftest.py)
+
+Authentication fixtures are available globally from `conftest.py`:
+
+- `mock_jwt_user` - Standard user authentication
+- `mock_jwt_admin` - Admin user authentication
+- `configured_snapshot` - Pre-configured snapshot fixture
+
+#### Custom Fixtures
+
 Create reusable fixtures for common test data:
 
 ```python
@@ -202,9 +254,18 @@ def test_create_user(sample_user, snapshot):
     # ... test implementation
 ```
 
+#### Test Isolation
+
+All tests must use fixtures that ensure proper isolation:
+
+- Authentication overrides are automatically cleaned up after each test
+- Database connections are properly managed with cleanup
+- Mock objects are reset between tests
+
 ## CI/CD Integration
 
 The GitHub Actions workflow automatically runs tests on:
+
 - Pull requests
 - Pushes to main branch
 
@@ -216,16 +277,19 @@ Snapshot tests work in CI by:
 ## Troubleshooting
 
 ### Snapshot Mismatches
+
 - Review the diff carefully
 - If changes are expected: `poetry run pytest --snapshot-update`
 - If changes are unexpected: Fix the code causing the difference
 
 ### Async Test Issues
+
 - Ensure async functions use `@pytest.mark.asyncio`
 - Use `AsyncMock` for mocking async functions
 - FastAPI TestClient handles async automatically
 
 ### Import Errors
+
 - Check that all dependencies are in `pyproject.toml`
 - Run `poetry install` to ensure dependencies are installed
 - Verify import paths are correct
@@ -234,4 +298,4 @@ Snapshot tests work in CI by:
 
 Snapshot testing provides a powerful way to ensure API responses remain consistent. Combined with traditional assertions, it creates a robust test suite that catches regressions while remaining maintainable.
 
-Remember: Good tests are as important as good code!
+Remember: Good tests are as important as good code!

autogpt_platform/backend/backend/conftest.py

@@ -6,8 +6,6 @@ from dotenv import load_dotenv
 
 from backend.util.logging import configure_logging
 
-os.environ["ENABLE_AUTH"] = "false"
-
 load_dotenv()
 
 #  NOTE: You can run tests like with the --log-cli-level=INFO to see the logs

autogpt_platform/backend/backend/data/graph_test.py

@@ -2,7 +2,6 @@ import json
 from typing import Any
 from uuid import UUID
 
-import autogpt_libs.auth.models
 import fastapi.exceptions
 import pytest
 from pytest_snapshot.plugin import Snapshot
@@ -317,12 +316,7 @@ async def test_access_store_listing_graph(server: SpinTestServer):
             is_approved=True,
             comments="Test comments",
         ),
-        autogpt_libs.auth.models.User(
-            user_id=admin_user.id,
-            role="admin",
-            email=admin_user.email,
-            phone_number="1234567890",
-        ),
+        user_id=admin_user.id,
     )
 
     # Now we check the graph can be accessed by a user that does not own the graph

autogpt_platform/backend/backend/executor/manager_test.py

@@ -1,6 +1,5 @@
 import logging
 
-import autogpt_libs.auth.models
 import fastapi.responses
 import pytest
 
@@ -521,12 +520,7 @@ async def test_store_listing_graph(server: SpinTestServer):
             is_approved=True,
             comments="Test comments",
         ),
-        autogpt_libs.auth.models.User(
-            user_id=admin_user.id,
-            role="admin",
-            email=admin_user.email,
-            phone_number="1234567890",
-        ),
+        user_id=admin_user.id,
     )
     alt_test_user = admin_user
 

autogpt_platform/backend/backend/server/conftest.py

@@ -11,7 +11,45 @@ def configured_snapshot(snapshot: Snapshot) -> Snapshot:
     return snapshot
 
 
-# Test ID constants
-TEST_USER_ID = "test-user-id"
-ADMIN_USER_ID = "admin-user-id"
-TARGET_USER_ID = "target-user-id"
+@pytest.fixture
+def test_user_id() -> str:
+    """Test user ID fixture."""
+    return "test-user-id"
+
+
+@pytest.fixture
+def admin_user_id() -> str:
+    """Admin user ID fixture."""
+    return "admin-user-id"
+
+
+@pytest.fixture
+def target_user_id() -> str:
+    """Target user ID fixture."""
+    return "target-user-id"
+
+
+@pytest.fixture
+def mock_jwt_user(test_user_id):
+    """Provide mock JWT payload for regular user testing."""
+    import fastapi
+
+    def override_get_jwt_payload(request: fastapi.Request) -> dict[str, str]:
+        return {"sub": test_user_id, "role": "user", "email": "test@example.com"}
+
+    return {"get_jwt_payload": override_get_jwt_payload, "user_id": test_user_id}
+
+
+@pytest.fixture
+def mock_jwt_admin(admin_user_id):
+    """Provide mock JWT payload for admin user testing."""
+    import fastapi
+
+    def override_get_jwt_payload(request: fastapi.Request) -> dict[str, str]:
+        return {
+            "sub": admin_user_id,
+            "role": "admin",
+            "email": "test-admin@example.com",
+        }
+
+    return {"get_jwt_payload": override_get_jwt_payload, "user_id": admin_user_id}

autogpt_platform/backend/backend/server/integrations/router.py

@@ -3,14 +3,15 @@ import logging
 from datetime import datetime, timedelta, timezone
 from typing import TYPE_CHECKING, Annotated, Awaitable, List, Literal
 
+from autogpt_libs.auth import get_user_id
 from fastapi import (
     APIRouter,
     Body,
-    Depends,
     HTTPException,
     Path,
     Query,
     Request,
+    Security,
     status,
 )
 from pydantic import BaseModel, Field, SecretStr
@@ -50,8 +51,6 @@ from backend.util.settings import Settings
 if TYPE_CHECKING:
     from backend.integrations.oauth import BaseOAuthHandler
 
-from ..utils import get_user_id
-
 logger = logging.getLogger(__name__)
 settings = Settings()
 router = APIRouter()
@@ -69,7 +68,7 @@ async def login(
     provider: Annotated[
         ProviderName, Path(title="The provider to initiate an OAuth flow for")
     ],
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
     request: Request,
     scopes: Annotated[
         str, Query(title="Comma-separated list of authorization scopes")
@@ -109,7 +108,7 @@ async def callback(
     ],
     code: Annotated[str, Body(title="Authorization code acquired by user login")],
     state_token: Annotated[str, Body(title="Anti-CSRF nonce")],
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
     request: Request,
 ) -> CredentialsMetaResponse:
     logger.debug(f"Received OAuth callback for provider: {provider}")
@@ -182,7 +181,7 @@ async def callback(
 
 @router.get("/credentials")
 async def list_credentials(
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
 ) -> list[CredentialsMetaResponse]:
     credentials = await creds_manager.store.get_all_creds(user_id)
     return [
@@ -204,7 +203,7 @@ async def list_credentials_by_provider(
     provider: Annotated[
         ProviderName, Path(title="The provider to list credentials for")
     ],
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
 ) -> list[CredentialsMetaResponse]:
     credentials = await creds_manager.store.get_creds_by_provider(user_id, provider)
     return [
@@ -227,7 +226,7 @@ async def get_credential(
         ProviderName, Path(title="The provider to retrieve credentials for")
     ],
     cred_id: Annotated[str, Path(title="The ID of the credentials to retrieve")],
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
 ) -> Credentials:
     credential = await creds_manager.get(user_id, cred_id)
     if not credential:
@@ -244,7 +243,7 @@ async def get_credential(
 
 @router.post("/{provider}/credentials", status_code=201)
 async def create_credentials(
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
     provider: Annotated[
         ProviderName, Path(title="The provider to create credentials for")
     ],
@@ -288,7 +287,7 @@ async def delete_credentials(
         ProviderName, Path(title="The provider to delete credentials for")
     ],
     cred_id: Annotated[str, Path(title="The ID of the credentials to delete")],
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
     force: Annotated[
         bool, Query(title="Whether to proceed if any linked webhooks are still in use")
     ] = False,
@@ -429,7 +428,7 @@ async def webhook_ingress_generic(
 @router.post("/webhooks/{webhook_id}/ping")
 async def webhook_ping(
     webhook_id: Annotated[str, Path(title="Our ID for the webhook")],
-    user_id: Annotated[str, Depends(get_user_id)],  # require auth
+    user_id: Annotated[str, Security(get_user_id)],  # require auth
 ):
     webhook = await get_webhook(webhook_id)
     webhook_manager = get_webhook_manager(webhook.provider)
@@ -568,7 +567,7 @@ def _get_provider_oauth_handler(
 
 @router.get("/ayrshare/sso_url")
 async def get_ayrshare_sso_url(
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
 ) -> AyrshareSSOResponse:
     """
     Generate an SSO URL for Ayrshare social media integration.

autogpt_platform/backend/backend/server/rest_api.py

@@ -3,12 +3,13 @@ import logging
 from enum import Enum
 from typing import Any, Optional
 
-import autogpt_libs.auth.models
 import fastapi
 import fastapi.responses
 import pydantic
 import starlette.middleware.cors
 import uvicorn
+from autogpt_libs.auth import add_auth_responses_to_openapi
+from autogpt_libs.auth import verify_settings as verify_auth_settings
 from fastapi.exceptions import RequestValidationError
 from fastapi.routing import APIRoute
 
@@ -61,6 +62,8 @@ def launch_darkly_context():
 
 @contextlib.asynccontextmanager
 async def lifespan_context(app: fastapi.FastAPI):
+    verify_auth_settings()
+
     await backend.data.db.connect()
 
     # Ensure SDK auto-registration is patched before initializing blocks
@@ -131,6 +134,9 @@ app = fastapi.FastAPI(
 
 app.add_middleware(SecurityHeadersMiddleware)
 
+# Add 401 responses to authenticated endpoints in OpenAPI spec
+add_auth_responses_to_openapi(app)
+
 
 def handle_internal_http_error(status_code: int = 500, log_error: bool = True):
     def handler(request: fastapi.Request, exc: Exception):
@@ -370,10 +376,10 @@ class AgentServer(backend.util.service.AppProcess):
     @staticmethod
     async def test_review_store_listing(
         request: backend.server.v2.store.model.ReviewSubmissionRequest,
-        user: autogpt_libs.auth.models.User,
+        user_id: str,
     ):
         return await backend.server.v2.admin.store_admin_routes.review_submission(
-            request.store_listing_version_id, request, user
+            request.store_listing_version_id, request, user_id
         )
 
     @staticmethod

autogpt_platform/backend/backend/server/routers/analytics.py

@@ -5,9 +5,9 @@ from typing import Annotated
 
 import fastapi
 import pydantic
+from autogpt_libs.auth import get_user_id
 
 import backend.data.analytics
-from backend.server.utils import get_user_id
 
 router = fastapi.APIRouter()
 logger = logging.getLogger(__name__)
@@ -21,7 +21,7 @@ class LogRawMetricRequest(pydantic.BaseModel):
 
 @router.post(path="/log_raw_metric")
 async def log_raw_metric(
-    user_id: Annotated[str, fastapi.Depends(get_user_id)],
+    user_id: Annotated[str, fastapi.Security(get_user_id)],
     request: LogRawMetricRequest,
 ):
     try:
@@ -47,7 +47,7 @@ async def log_raw_metric(
 
 @router.post("/log_raw_analytics")
 async def log_raw_analytics(
-    user_id: Annotated[str, fastapi.Depends(get_user_id)],
+    user_id: Annotated[str, fastapi.Security(get_user_id)],
     type: Annotated[str, fastapi.Body(..., embed=True)],
     data: Annotated[
         dict,

autogpt_platform/backend/backend/server/routers/analytics_improved_test.py

@@ -5,18 +5,17 @@ from unittest.mock import AsyncMock, Mock
 
 import fastapi
 import fastapi.testclient
+import pytest
 import pytest_mock
 from pytest_snapshot.plugin import Snapshot
 
 import backend.server.routers.analytics as analytics_routes
-from backend.server.conftest import TEST_USER_ID
 from backend.server.test_helpers import (
     assert_error_response_structure,
     assert_mock_called_with_partial,
     assert_response_status,
     safe_parse_json,
 )
-from backend.server.utils import get_user_id
 
 app = fastapi.FastAPI()
 app.include_router(analytics_routes.router)
@@ -24,17 +23,20 @@ app.include_router(analytics_routes.router)
 client = fastapi.testclient.TestClient(app)
 
 
-def override_get_user_id() -> str:
-    """Override get_user_id for testing"""
-    return TEST_USER_ID
+@pytest.fixture(autouse=True)
+def setup_app_auth(mock_jwt_user):
+    """Setup auth overrides for all tests in this module"""
+    from autogpt_libs.auth.jwt_utils import get_jwt_payload
 
-
-app.dependency_overrides[get_user_id] = override_get_user_id
+    app.dependency_overrides[get_jwt_payload] = mock_jwt_user["get_jwt_payload"]
+    yield
+    app.dependency_overrides.clear()
 
 
 def test_log_raw_metric_success_improved(
     mocker: pytest_mock.MockFixture,
     configured_snapshot: Snapshot,
+    test_user_id: str,
 ) -> None:
     """Test successful raw metric logging with improved assertions."""
     # Mock the analytics function
@@ -63,7 +65,7 @@ def test_log_raw_metric_success_improved(
     # Verify the function was called with correct parameters
     assert_mock_called_with_partial(
         mock_log_metric,
-        user_id=TEST_USER_ID,
+        user_id=test_user_id,
         metric_name="page_load_time",
         metric_value=2.5,
         data_string="/dashboard",

autogpt_platform/backend/backend/server/routers/analytics_parametrized_test.py

@@ -10,8 +10,6 @@ import pytest_mock
 from pytest_snapshot.plugin import Snapshot
 
 import backend.server.routers.analytics as analytics_routes
-from backend.server.conftest import TEST_USER_ID
-from backend.server.utils import get_user_id
 
 app = fastapi.FastAPI()
 app.include_router(analytics_routes.router)
@@ -19,12 +17,14 @@ app.include_router(analytics_routes.router)
 client = fastapi.testclient.TestClient(app)
 
 
-def override_get_user_id() -> str:
-    """Override get_user_id for testing"""
-    return TEST_USER_ID
+@pytest.fixture(autouse=True)
+def setup_app_auth(mock_jwt_user):
+    """Setup auth overrides for all tests in this module"""
+    from autogpt_libs.auth.jwt_utils import get_jwt_payload
 
-
-app.dependency_overrides[get_user_id] = override_get_user_id
+    app.dependency_overrides[get_jwt_payload] = mock_jwt_user["get_jwt_payload"]
+    yield
+    app.dependency_overrides.clear()
 
 
 @pytest.mark.parametrize(

autogpt_platform/backend/backend/server/routers/analytics_test.py

@@ -3,12 +3,11 @@ from unittest.mock import AsyncMock, Mock
 
 import fastapi
 import fastapi.testclient
+import pytest
 import pytest_mock
 from pytest_snapshot.plugin import Snapshot
 
 import backend.server.routers.analytics as analytics_routes
-from backend.server.conftest import TEST_USER_ID
-from backend.server.utils import get_user_id
 
 app = fastapi.FastAPI()
 app.include_router(analytics_routes.router)
@@ -16,17 +15,20 @@ app.include_router(analytics_routes.router)
 client = fastapi.testclient.TestClient(app)
 
 
-def override_get_user_id() -> str:
-    """Override get_user_id for testing"""
-    return TEST_USER_ID
+@pytest.fixture(autouse=True)
+def setup_app_auth(mock_jwt_user):
+    """Setup auth overrides for all tests in this module"""
+    from autogpt_libs.auth.jwt_utils import get_jwt_payload
 
-
-app.dependency_overrides[get_user_id] = override_get_user_id
+    app.dependency_overrides[get_jwt_payload] = mock_jwt_user["get_jwt_payload"]
+    yield
+    app.dependency_overrides.clear()
 
 
 def test_log_raw_metric_success(
     mocker: pytest_mock.MockFixture,
     configured_snapshot: Snapshot,
+    test_user_id: str,
 ) -> None:
     """Test successful raw metric logging"""
 
@@ -53,7 +55,7 @@ def test_log_raw_metric_success(
 
     # Verify the function was called with correct parameters
     mock_log_metric.assert_called_once_with(
-        user_id=TEST_USER_ID,
+        user_id=test_user_id,
         metric_name="page_load_time",
         metric_value=2.5,
         data_string="/dashboard",
@@ -121,6 +123,7 @@ def test_log_raw_metric_various_values(
 def test_log_raw_analytics_success(
     mocker: pytest_mock.MockFixture,
     configured_snapshot: Snapshot,
+    test_user_id: str,
 ) -> None:
     """Test successful raw analytics logging"""
 
@@ -155,7 +158,7 @@ def test_log_raw_analytics_success(
 
     # Verify the function was called with correct parameters
     mock_log_analytics.assert_called_once_with(
-        TEST_USER_ID,
+        test_user_id,
         "user_action",
         request_data["data"],
         "button_click_submit_form",

autogpt_platform/backend/backend/server/routers/postmark/postmark.py

@@ -1,8 +1,7 @@
 import logging
 from typing import Annotated
 
-from autogpt_libs.auth.middleware import APIKeyValidator
-from fastapi import APIRouter, Body, Depends, HTTPException, Query
+from fastapi import APIRouter, Body, HTTPException, Query, Security
 from fastapi.responses import JSONResponse
 
 from backend.data.user import (
@@ -20,18 +19,18 @@ from backend.server.routers.postmark.models import (
     PostmarkSubscriptionChangeWebhook,
     PostmarkWebhook,
 )
+from backend.server.utils.api_key_auth import APIKeyAuthenticator
 from backend.util.settings import Settings
 
+logger = logging.getLogger(__name__)
 settings = Settings()
-postmark_validator = APIKeyValidator(
-    "X-Postmark-Webhook-Token",
-    settings.secrets.postmark_webhook_token,
-)
 
 router = APIRouter()
 
-
-logger = logging.getLogger(__name__)
+postmark_api_key_auth = APIKeyAuthenticator(
+    "X-Postmark-Webhook-Token",
+    settings.secrets.postmark_webhook_token,
+)
 
 
 @router.post("/unsubscribe", summary="One Click Email Unsubscribe")
@@ -50,7 +49,7 @@ async def unsubscribe_via_one_click(token: Annotated[str, Query()]):
 
 @router.post(
     "/",
-    dependencies=[Depends(postmark_validator.get_dependency())],
+    dependencies=[Security(postmark_api_key_auth)],
     summary="Handle Postmark Email Webhooks",
 )
 async def postmark_webhook_handler(

autogpt_platform/backend/backend/server/routers/v1.py

@@ -7,17 +7,18 @@ from typing import Annotated, Any, Sequence
 
 import pydantic
 import stripe
-from autogpt_libs.auth.middleware import auth_middleware
+from autogpt_libs.auth import get_user_id, requires_user
+from autogpt_libs.auth.jwt_utils import get_jwt_payload
 from fastapi import (
     APIRouter,
     Body,
-    Depends,
     File,
     HTTPException,
     Path,
     Query,
     Request,
     Response,
+    Security,
     UploadFile,
 )
 from starlette.status import HTTP_204_NO_CONTENT, HTTP_404_NOT_FOUND
@@ -85,7 +86,6 @@ from backend.server.model import (
     UpdateTimezoneRequest,
     UploadFileResponse,
 )
-from backend.server.utils import get_user_id
 from backend.util.clients import get_scheduler_client
 from backend.util.cloud_storage import get_cloud_storage_handler
 from backend.util.exceptions import GraphValidationError, NotFoundError
@@ -124,7 +124,7 @@ v1_router.include_router(
     backend.server.routers.analytics.router,
     prefix="/analytics",
     tags=["analytics"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 
 
@@ -137,9 +137,9 @@ v1_router.include_router(
     "/auth/user",
     summary="Get or create user",
     tags=["auth"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
-async def get_or_create_user_route(user_data: dict = Depends(auth_middleware)):
+async def get_or_create_user_route(user_data: dict = Security(get_jwt_payload)):
     user = await get_or_create_user(user_data)
     return user.model_dump()
 
@@ -148,10 +148,10 @@ async def get_or_create_user_route(user_data: dict = Depends(auth_middleware)):
     "/auth/user/email",
     summary="Update user email",
     tags=["auth"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def update_user_email_route(
-    user_id: Annotated[str, Depends(get_user_id)], email: str = Body(...)
+    user_id: Annotated[str, Security(get_user_id)], email: str = Body(...)
 ) -> dict[str, str]:
     await update_user_email(user_id, email)
 
@@ -162,10 +162,10 @@ async def update_user_email_route(
     "/auth/user/timezone",
     summary="Get user timezone",
     tags=["auth"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def get_user_timezone_route(
-    user_data: dict = Depends(auth_middleware),
+    user_data: dict = Security(get_jwt_payload),
 ) -> TimezoneResponse:
     """Get user timezone setting."""
     user = await get_or_create_user(user_data)
@@ -176,11 +176,11 @@ async def get_user_timezone_route(
     "/auth/user/timezone",
     summary="Update user timezone",
     tags=["auth"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
     response_model=TimezoneResponse,
 )
 async def update_user_timezone_route(
-    user_id: Annotated[str, Depends(get_user_id)], request: UpdateTimezoneRequest
+    user_id: Annotated[str, Security(get_user_id)], request: UpdateTimezoneRequest
 ) -> TimezoneResponse:
     """Update user timezone. The timezone should be a valid IANA timezone identifier."""
     user = await update_user_timezone(user_id, str(request.timezone))
@@ -191,10 +191,10 @@ async def update_user_timezone_route(
     "/auth/user/preferences",
     summary="Get notification preferences",
     tags=["auth"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def get_preferences(
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
 ) -> NotificationPreference:
     preferences = await get_user_notification_preference(user_id)
     return preferences
@@ -204,10 +204,10 @@ async def get_preferences(
     "/auth/user/preferences",
     summary="Update notification preferences",
     tags=["auth"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def update_preferences(
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
     preferences: NotificationPreferenceDTO = Body(...),
 ) -> NotificationPreference:
     output = await update_user_notification_preference(user_id, preferences)
@@ -223,9 +223,9 @@ async def update_preferences(
     "/onboarding",
     summary="Get onboarding status",
     tags=["onboarding"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
-async def get_onboarding(user_id: Annotated[str, Depends(get_user_id)]):
+async def get_onboarding(user_id: Annotated[str, Security(get_user_id)]):
     return await get_user_onboarding(user_id)
 
 
@@ -233,10 +233,10 @@ async def get_onboarding(user_id: Annotated[str, Depends(get_user_id)]):
     "/onboarding",
     summary="Update onboarding progress",
     tags=["onboarding"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def update_onboarding(
-    user_id: Annotated[str, Depends(get_user_id)], data: UserOnboardingUpdate
+    user_id: Annotated[str, Security(get_user_id)], data: UserOnboardingUpdate
 ):
     return await update_user_onboarding(user_id, data)
 
@@ -245,10 +245,10 @@ async def update_onboarding(
     "/onboarding/agents",
     summary="Get recommended agents",
     tags=["onboarding"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def get_onboarding_agents(
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
 ):
     return await get_recommended_agents(user_id)
 
@@ -257,7 +257,7 @@ async def get_onboarding_agents(
     "/onboarding/enabled",
     summary="Check onboarding enabled",
     tags=["onboarding", "public"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def is_onboarding_enabled():
     return await onboarding_enabled()
@@ -272,7 +272,7 @@ async def is_onboarding_enabled():
     path="/blocks",
     summary="List available blocks",
     tags=["blocks"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 def get_graph_blocks() -> Sequence[dict[Any, Any]]:
     blocks = [block() for block in get_blocks().values()]
@@ -286,7 +286,7 @@ def get_graph_blocks() -> Sequence[dict[Any, Any]]:
     path="/blocks/{block_id}/execute",
     summary="Execute graph block",
     tags=["blocks"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def execute_graph_block(block_id: str, data: BlockInput) -> CompletedBlockOutput:
     obj = get_block(block_id)
@@ -303,10 +303,10 @@ async def execute_graph_block(block_id: str, data: BlockInput) -> CompletedBlock
     path="/files/upload",
     summary="Upload file to cloud storage",
     tags=["files"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def upload_file(
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
     file: UploadFile = File(...),
     provider: str = "gcs",
     expiration_hours: int = 24,
@@ -394,10 +394,10 @@ async def upload_file(
     path="/credits",
     tags=["credits"],
     summary="Get user credits",
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def get_user_credits(
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
 ) -> dict[str, int]:
     return {"credits": await _user_credit_model.get_credits(user_id)}
 
@@ -406,10 +406,10 @@ async def get_user_credits(
     path="/credits",
     summary="Request credit top up",
     tags=["credits"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def request_top_up(
-    request: RequestTopUp, user_id: Annotated[str, Depends(get_user_id)]
+    request: RequestTopUp, user_id: Annotated[str, Security(get_user_id)]
 ):
     checkout_url = await _user_credit_model.top_up_intent(
         user_id, request.credit_amount
@@ -421,10 +421,10 @@ async def request_top_up(
     path="/credits/{transaction_key}/refund",
     summary="Refund credit transaction",
     tags=["credits"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def refund_top_up(
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
     transaction_key: str,
     metadata: dict[str, str],
 ) -> int:
@@ -435,9 +435,9 @@ async def refund_top_up(
     path="/credits",
     summary="Fulfill checkout session",
     tags=["credits"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
-async def fulfill_checkout(user_id: Annotated[str, Depends(get_user_id)]):
+async def fulfill_checkout(user_id: Annotated[str, Security(get_user_id)]):
     await _user_credit_model.fulfill_checkout(user_id=user_id)
     return Response(status_code=200)
 
@@ -446,10 +446,10 @@ async def fulfill_checkout(user_id: Annotated[str, Depends(get_user_id)]):
     path="/credits/auto-top-up",
     summary="Configure auto top up",
     tags=["credits"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def configure_user_auto_top_up(
-    request: AutoTopUpConfig, user_id: Annotated[str, Depends(get_user_id)]
+    request: AutoTopUpConfig, user_id: Annotated[str, Security(get_user_id)]
 ) -> str:
     if request.threshold < 0:
         raise ValueError("Threshold must be greater than 0")
@@ -475,10 +475,10 @@ async def configure_user_auto_top_up(
     path="/credits/auto-top-up",
     summary="Get auto top up",
     tags=["credits"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def get_user_auto_top_up(
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
 ) -> AutoTopUpConfig:
     return await get_auto_top_up(user_id)
 
@@ -528,10 +528,10 @@ async def stripe_webhook(request: Request):
     path="/credits/manage",
     tags=["credits"],
     summary="Manage payment methods",
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def manage_payment_method(
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
 ) -> dict[str, str]:
     return {"url": await _user_credit_model.create_billing_portal_session(user_id)}
 
@@ -540,10 +540,10 @@ async def manage_payment_method(
     path="/credits/transactions",
     tags=["credits"],
     summary="Get credit history",
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def get_credit_history(
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
     transaction_time: datetime | None = None,
     transaction_type: str | None = None,
     transaction_count_limit: int = 100,
@@ -563,10 +563,10 @@ async def get_credit_history(
     path="/credits/refunds",
     tags=["credits"],
     summary="Get refund requests",
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def get_refund_requests(
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
 ) -> list[RefundRequest]:
     return await _user_credit_model.get_refund_requests(user_id)
 
@@ -584,10 +584,10 @@ class DeleteGraphResponse(TypedDict):
     path="/graphs",
     summary="List user graphs",
     tags=["graphs"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def list_graphs(
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
 ) -> Sequence[graph_db.GraphMeta]:
     return await graph_db.list_graphs(filter_by="active", user_id=user_id)
 
@@ -596,17 +596,17 @@ async def list_graphs(
     path="/graphs/{graph_id}",
     summary="Get specific graph",
     tags=["graphs"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 @v1_router.get(
     path="/graphs/{graph_id}/versions/{version}",
     summary="Get graph version",
     tags=["graphs"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def get_graph(
     graph_id: str,
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
     version: int | None = None,
     for_export: bool = False,
 ) -> graph_db.GraphModel:
@@ -626,10 +626,10 @@ async def get_graph(
     path="/graphs/{graph_id}/versions",
     summary="Get all graph versions",
     tags=["graphs"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def get_graph_all_versions(
-    graph_id: str, user_id: Annotated[str, Depends(get_user_id)]
+    graph_id: str, user_id: Annotated[str, Security(get_user_id)]
 ) -> Sequence[graph_db.GraphModel]:
     graphs = await graph_db.get_graph_all_versions(graph_id, user_id=user_id)
     if not graphs:
@@ -641,11 +641,11 @@ async def get_graph_all_versions(
     path="/graphs",
     summary="Create new graph",
     tags=["graphs"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def create_new_graph(
     create_graph: CreateGraph,
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
 ) -> graph_db.GraphModel:
     graph = graph_db.make_graph_model(create_graph.graph, user_id)
     graph.reassign_ids(user_id=user_id, reassign_graph_id=True)
@@ -662,10 +662,10 @@ async def create_new_graph(
     path="/graphs/{graph_id}",
     summary="Delete graph permanently",
     tags=["graphs"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def delete_graph(
-    graph_id: str, user_id: Annotated[str, Depends(get_user_id)]
+    graph_id: str, user_id: Annotated[str, Security(get_user_id)]
 ) -> DeleteGraphResponse:
     if active_version := await graph_db.get_graph(graph_id, user_id=user_id):
         await on_graph_deactivate(active_version, user_id=user_id)
@@ -677,12 +677,12 @@ async def delete_graph(
     path="/graphs/{graph_id}",
     summary="Update graph version",
     tags=["graphs"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def update_graph(
     graph_id: str,
     graph: graph_db.Graph,
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
 ) -> graph_db.GraphModel:
     # Sanity check
     if graph.id and graph.id != graph_id:
@@ -733,12 +733,12 @@ async def update_graph(
     path="/graphs/{graph_id}/versions/active",
     summary="Set active graph version",
     tags=["graphs"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def set_graph_active_version(
     graph_id: str,
     request_body: SetGraphActiveVersion,
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
 ):
     new_active_version = request_body.active_graph_version
     new_active_graph = await graph_db.get_graph(
@@ -772,11 +772,11 @@ async def set_graph_active_version(
     path="/graphs/{graph_id}/execute/{graph_version}",
     summary="Execute graph agent",
     tags=["graphs"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def execute_graph(
     graph_id: str,
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
     inputs: Annotated[dict[str, Any], Body(..., embed=True, default_factory=dict)],
     credentials_inputs: Annotated[
         dict[str, CredentialsMetaInput], Body(..., embed=True, default_factory=dict)
@@ -818,10 +818,10 @@ async def execute_graph(
     path="/graphs/{graph_id}/executions/{graph_exec_id}/stop",
     summary="Stop graph execution",
     tags=["graphs"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def stop_graph_run(
-    graph_id: str, graph_exec_id: str, user_id: Annotated[str, Depends(get_user_id)]
+    graph_id: str, graph_exec_id: str, user_id: Annotated[str, Security(get_user_id)]
 ) -> execution_db.GraphExecutionMeta | None:
     res = await _stop_graph_run(
         user_id=user_id,
@@ -860,10 +860,10 @@ async def _stop_graph_run(
     path="/executions",
     summary="List all executions",
     tags=["graphs"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def list_graphs_executions(
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
 ) -> list[execution_db.GraphExecutionMeta]:
     return await execution_db.get_graph_executions(user_id=user_id)
 
@@ -872,11 +872,11 @@ async def list_graphs_executions(
     path="/graphs/{graph_id}/executions",
     summary="List graph executions",
     tags=["graphs"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def list_graph_executions(
     graph_id: str,
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
     page: int = Query(1, ge=1, description="Page number (1-indexed)"),
     page_size: int = Query(
         25, ge=1, le=100, description="Number of executions per page"
@@ -894,12 +894,12 @@ async def list_graph_executions(
     path="/graphs/{graph_id}/executions/{graph_exec_id}",
     summary="Get execution details",
     tags=["graphs"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def get_graph_execution(
     graph_id: str,
     graph_exec_id: str,
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
 ) -> execution_db.GraphExecution | execution_db.GraphExecutionWithNodes:
     graph = await graph_db.get_graph(graph_id=graph_id, user_id=user_id)
     if not graph:
@@ -924,12 +924,12 @@ async def get_graph_execution(
     path="/executions/{graph_exec_id}",
     summary="Delete graph execution",
     tags=["graphs"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
     status_code=HTTP_204_NO_CONTENT,
 )
 async def delete_graph_execution(
     graph_exec_id: str,
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
 ) -> None:
     await execution_db.delete_graph_execution(
         graph_exec_id=graph_exec_id, user_id=user_id
@@ -953,10 +953,10 @@ class ScheduleCreationRequest(pydantic.BaseModel):
     path="/graphs/{graph_id}/schedules",
     summary="Create execution schedule",
     tags=["schedules"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def create_graph_execution_schedule(
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
     graph_id: str = Path(..., description="ID of the graph to schedule"),
     schedule_params: ScheduleCreationRequest = Body(),
 ) -> scheduler.GraphExecutionJobInfo:
@@ -1006,10 +1006,10 @@ async def create_graph_execution_schedule(
     path="/graphs/{graph_id}/schedules",
     summary="List execution schedules for a graph",
     tags=["schedules"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def list_graph_execution_schedules(
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
     graph_id: str = Path(),
 ) -> list[scheduler.GraphExecutionJobInfo]:
     schedules = await get_scheduler_client().get_execution_schedules(
@@ -1035,10 +1035,10 @@ async def list_graph_execution_schedules(
     path="/schedules",
     summary="List execution schedules for a user",
     tags=["schedules"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def list_all_graphs_execution_schedules(
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
 ) -> list[scheduler.GraphExecutionJobInfo]:
     schedules = await get_scheduler_client().get_execution_schedules(user_id=user_id)
 
@@ -1060,10 +1060,10 @@ async def list_all_graphs_execution_schedules(
     path="/schedules/{schedule_id}",
     summary="Delete execution schedule",
     tags=["schedules"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def delete_graph_execution_schedule(
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
     schedule_id: str = Path(..., description="ID of the schedule to delete"),
 ) -> dict[str, Any]:
     try:
@@ -1086,10 +1086,10 @@ async def delete_graph_execution_schedule(
     summary="Create new API key",
     response_model=CreateAPIKeyResponse,
     tags=["api-keys"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def create_api_key(
-    request: CreateAPIKeyRequest, user_id: Annotated[str, Depends(get_user_id)]
+    request: CreateAPIKeyRequest, user_id: Annotated[str, Security(get_user_id)]
 ) -> CreateAPIKeyResponse:
     """Create a new API key"""
     try:
@@ -1117,10 +1117,10 @@ async def create_api_key(
     summary="List user API keys",
     response_model=list[APIKeyWithoutHash] | dict[str, str],
     tags=["api-keys"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def get_api_keys(
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
 ) -> list[APIKeyWithoutHash]:
     """List all API keys for the user"""
     try:
@@ -1138,10 +1138,10 @@ async def get_api_keys(
     summary="Get specific API key",
     response_model=APIKeyWithoutHash,
     tags=["api-keys"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def get_api_key(
-    key_id: str, user_id: Annotated[str, Depends(get_user_id)]
+    key_id: str, user_id: Annotated[str, Security(get_user_id)]
 ) -> APIKeyWithoutHash:
     """Get a specific API key"""
     try:
@@ -1162,10 +1162,10 @@ async def get_api_key(
     summary="Revoke API key",
     response_model=APIKeyWithoutHash,
     tags=["api-keys"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def delete_api_key(
-    key_id: str, user_id: Annotated[str, Depends(get_user_id)]
+    key_id: str, user_id: Annotated[str, Security(get_user_id)]
 ) -> Optional[APIKeyWithoutHash]:
     """Revoke an API key"""
     try:
@@ -1190,10 +1190,10 @@ async def delete_api_key(
     summary="Suspend API key",
     response_model=APIKeyWithoutHash,
     tags=["api-keys"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def suspend_key(
-    key_id: str, user_id: Annotated[str, Depends(get_user_id)]
+    key_id: str, user_id: Annotated[str, Security(get_user_id)]
 ) -> Optional[APIKeyWithoutHash]:
     """Suspend an API key"""
     try:
@@ -1215,12 +1215,12 @@ async def suspend_key(
     summary="Update key permissions",
     response_model=APIKeyWithoutHash,
     tags=["api-keys"],
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
 )
 async def update_permissions(
     key_id: str,
     request: UpdatePermissionsRequest,
-    user_id: Annotated[str, Depends(get_user_id)],
+    user_id: Annotated[str, Security(get_user_id)],
 ) -> Optional[APIKeyWithoutHash]:
     """Update API key permissions"""
     try:

autogpt_platform/backend/backend/server/routers/v1_test.py

@@ -2,7 +2,6 @@ import json
 from io import BytesIO
 from unittest.mock import AsyncMock, Mock, patch
 
-import autogpt_libs.auth.depends
 import fastapi
 import fastapi.testclient
 import pytest
@@ -14,9 +13,7 @@ from pytest_snapshot.plugin import Snapshot
 import backend.server.routers.v1 as v1_routes
 from backend.data.credit import AutoTopUpConfig
 from backend.data.graph import GraphModel
-from backend.server.conftest import TEST_USER_ID
 from backend.server.routers.v1 import upload_file
-from backend.server.utils import get_user_id
 
 app = fastapi.FastAPI()
 app.include_router(v1_routes.v1_router)
@@ -24,31 +21,26 @@ app.include_router(v1_routes.v1_router)
 client = fastapi.testclient.TestClient(app)
 
 
-def override_auth_middleware(request: fastapi.Request) -> dict[str, str]:
-    """Override auth middleware for testing"""
-    return {"sub": TEST_USER_ID, "role": "user", "email": "test@example.com"}
+@pytest.fixture(autouse=True)
+def setup_app_auth(mock_jwt_user):
+    """Setup auth overrides for all tests in this module"""
+    from autogpt_libs.auth.jwt_utils import get_jwt_payload
 
-
-def override_get_user_id() -> str:
-    """Override get_user_id for testing"""
-    return TEST_USER_ID
-
-
-app.dependency_overrides[autogpt_libs.auth.middleware.auth_middleware] = (
-    override_auth_middleware
-)
-app.dependency_overrides[get_user_id] = override_get_user_id
+    app.dependency_overrides[get_jwt_payload] = mock_jwt_user["get_jwt_payload"]
+    yield
+    app.dependency_overrides.clear()
 
 
 # Auth endpoints tests
 def test_get_or_create_user_route(
     mocker: pytest_mock.MockFixture,
     configured_snapshot: Snapshot,
+    test_user_id: str,
 ) -> None:
     """Test get or create user endpoint"""
     mock_user = Mock()
     mock_user.model_dump.return_value = {
-        "id": TEST_USER_ID,
+        "id": test_user_id,
         "email": "test@example.com",
         "name": "Test User",
     }
@@ -263,6 +255,7 @@ def test_get_auto_top_up(
 def test_get_graphs(
     mocker: pytest_mock.MockFixture,
     snapshot: Snapshot,
+    test_user_id: str,
 ) -> None:
     """Test get graphs endpoint"""
     mock_graph = GraphModel(
@@ -271,7 +264,7 @@ def test_get_graphs(
         is_active=True,
         name="Test Graph",
         description="A test graph",
-        user_id="test-user-id",
+        user_id=test_user_id,
     )
 
     mocker.patch(
@@ -296,6 +289,7 @@ def test_get_graphs(
 def test_get_graph(
     mocker: pytest_mock.MockFixture,
     snapshot: Snapshot,
+    test_user_id: str,
 ) -> None:
     """Test get single graph endpoint"""
     mock_graph = GraphModel(
@@ -304,7 +298,7 @@ def test_get_graph(
         is_active=True,
         name="Test Graph",
         description="A test graph",
-        user_id="test-user-id",
+        user_id=test_user_id,
     )
 
     mocker.patch(
@@ -343,6 +337,7 @@ def test_get_graph_not_found(
 def test_delete_graph(
     mocker: pytest_mock.MockFixture,
     snapshot: Snapshot,
+    test_user_id: str,
 ) -> None:
     """Test delete graph endpoint"""
     # Mock active graph for deactivation
@@ -352,7 +347,7 @@ def test_delete_graph(
         is_active=True,
         name="Test Graph",
         description="A test graph",
-        user_id="test-user-id",
+        user_id=test_user_id,
     )
 
     mocker.patch(
@@ -399,7 +394,7 @@ def test_missing_required_field() -> None:
 
 
 @pytest.mark.asyncio
-async def test_upload_file_success():
+async def test_upload_file_success(test_user_id: str):
     """Test successful file upload."""
     # Create mock upload file
     file_content = b"test file content"
@@ -425,7 +420,7 @@ async def test_upload_file_success():
 
         result = await upload_file(
             file=upload_file_mock,
-            user_id="test-user-123",
+            user_id=test_user_id,
             provider="gcs",
             expiration_hours=24,
         )
@@ -446,12 +441,12 @@ async def test_upload_file_success():
             filename="test.txt",
             provider="gcs",
             expiration_hours=24,
-            user_id="test-user-123",
+            user_id=test_user_id,
         )
 
 
 @pytest.mark.asyncio
-async def test_upload_file_no_filename():
+async def test_upload_file_no_filename(test_user_id: str):
     """Test file upload without filename."""
     file_content = b"test content"
     file_obj = BytesIO(file_content)
@@ -476,7 +471,7 @@ async def test_upload_file_no_filename():
 
         upload_file_mock.read = AsyncMock(return_value=file_content)
 
-        result = await upload_file(file=upload_file_mock, user_id="test-user-123")
+        result = await upload_file(file=upload_file_mock, user_id=test_user_id)
 
         assert result.file_name == "uploaded_file"
         assert result.content_type == "application/octet-stream"
@@ -486,7 +481,7 @@ async def test_upload_file_no_filename():
 
 
 @pytest.mark.asyncio
-async def test_upload_file_invalid_expiration():
+async def test_upload_file_invalid_expiration(test_user_id: str):
     """Test file upload with invalid expiration hours."""
     file_obj = BytesIO(b"content")
     upload_file_mock = UploadFile(
@@ -498,7 +493,7 @@ async def test_upload_file_invalid_expiration():
     # Test expiration too short
     with pytest.raises(HTTPException) as exc_info:
         await upload_file(
-            file=upload_file_mock, user_id="test-user-123", expiration_hours=0
+            file=upload_file_mock, user_id=test_user_id, expiration_hours=0
         )
     assert exc_info.value.status_code == 400
     assert "between 1 and 48" in exc_info.value.detail
@@ -506,14 +501,14 @@ async def test_upload_file_invalid_expiration():
     # Test expiration too long
     with pytest.raises(HTTPException) as exc_info:
         await upload_file(
-            file=upload_file_mock, user_id="test-user-123", expiration_hours=49
+            file=upload_file_mock, user_id=test_user_id, expiration_hours=49
         )
     assert exc_info.value.status_code == 400
     assert "between 1 and 48" in exc_info.value.detail
 
 
 @pytest.mark.asyncio
-async def test_upload_file_virus_scan_failure():
+async def test_upload_file_virus_scan_failure(test_user_id: str):
     """Test file upload when virus scan fails."""
     file_content = b"malicious content"
     file_obj = BytesIO(file_content)
@@ -530,11 +525,11 @@ async def test_upload_file_virus_scan_failure():
         upload_file_mock.read = AsyncMock(return_value=file_content)
 
         with pytest.raises(RuntimeError, match="Virus detected!"):
-            await upload_file(file=upload_file_mock, user_id="test-user-123")
+            await upload_file(file=upload_file_mock, user_id=test_user_id)
 
 
 @pytest.mark.asyncio
-async def test_upload_file_cloud_storage_failure():
+async def test_upload_file_cloud_storage_failure(test_user_id: str):
     """Test file upload when cloud storage fails."""
     file_content = b"test content"
     file_obj = BytesIO(file_content)
@@ -556,11 +551,11 @@ async def test_upload_file_cloud_storage_failure():
         upload_file_mock.read = AsyncMock(return_value=file_content)
 
         with pytest.raises(RuntimeError, match="Storage error!"):
-            await upload_file(file=upload_file_mock, user_id="test-user-123")
+            await upload_file(file=upload_file_mock, user_id=test_user_id)
 
 
 @pytest.mark.asyncio
-async def test_upload_file_size_limit_exceeded():
+async def test_upload_file_size_limit_exceeded(test_user_id: str):
     """Test file upload when file size exceeds the limit."""
     # Create a file that exceeds the default 256MB limit
     large_file_content = b"x" * (257 * 1024 * 1024)  # 257MB
@@ -574,14 +569,14 @@ async def test_upload_file_size_limit_exceeded():
     upload_file_mock.read = AsyncMock(return_value=large_file_content)
 
     with pytest.raises(HTTPException) as exc_info:
-        await upload_file(file=upload_file_mock, user_id="test-user-123")
+        await upload_file(file=upload_file_mock, user_id=test_user_id)
 
     assert exc_info.value.status_code == 400
     assert "exceeds the maximum allowed size of 256MB" in exc_info.value.detail
 
 
 @pytest.mark.asyncio
-async def test_upload_file_gcs_not_configured_fallback():
+async def test_upload_file_gcs_not_configured_fallback(test_user_id: str):
     """Test file upload fallback to base64 when GCS is not configured."""
     file_content = b"test file content"
     file_obj = BytesIO(file_content)
@@ -602,7 +597,7 @@ async def test_upload_file_gcs_not_configured_fallback():
 
         upload_file_mock.read = AsyncMock(return_value=file_content)
 
-        result = await upload_file(file=upload_file_mock, user_id="test-user-123")
+        result = await upload_file(file=upload_file_mock, user_id=test_user_id)
 
         # Verify fallback behavior
         assert result.file_name == "test.txt"

autogpt_platform/backend/backend/server/test_fixtures.py

@@ -1,144 +0,0 @@
-"""Common test fixtures with proper setup and teardown."""
-
-from contextlib import asynccontextmanager
-from typing import AsyncGenerator
-from unittest.mock import Mock, patch
-
-import pytest
-from prisma import Prisma
-
-
-@pytest.fixture
-async def test_db_connection() -> AsyncGenerator[Prisma, None]:
-    """Provide a test database connection with proper cleanup.
-
-    This fixture ensures the database connection is properly
-    closed after the test, even if the test fails.
-    """
-    db = Prisma()
-    try:
-        await db.connect()
-        yield db
-    finally:
-        await db.disconnect()
-
-
-@pytest.fixture
-def mock_transaction():
-    """Mock database transaction with proper async context manager."""
-
-    @asynccontextmanager
-    async def mock_context(*args, **kwargs):
-        yield None
-
-    with patch("backend.data.db.locked_transaction", side_effect=mock_context) as mock:
-        yield mock
-
-
-@pytest.fixture
-def isolated_app_state():
-    """Fixture that ensures app state is isolated between tests."""
-    # Example: Save original state
-    # from backend.server.app import app
-    # original_overrides = app.dependency_overrides.copy()
-
-    # try:
-    #     yield app
-    # finally:
-    #     # Restore original state
-    #     app.dependency_overrides = original_overrides
-
-    # For now, just yield None as this is an example
-    yield None
-
-
-@pytest.fixture
-def cleanup_files():
-    """Fixture to track and cleanup files created during tests."""
-    created_files = []
-
-    def track_file(filepath: str):
-        created_files.append(filepath)
-
-    yield track_file
-
-    # Cleanup
-    import os
-
-    for filepath in created_files:
-        try:
-            if os.path.exists(filepath):
-                os.remove(filepath)
-        except Exception as e:
-            print(f"Warning: Failed to cleanup {filepath}: {e}")
-
-
-@pytest.fixture
-async def async_mock_with_cleanup():
-    """Create async mocks that are properly cleaned up."""
-    mocks = []
-
-    def create_mock(**kwargs):
-        mock = Mock(**kwargs)
-        mocks.append(mock)
-        return mock
-
-    yield create_mock
-
-    # Reset all mocks
-    for mock in mocks:
-        mock.reset_mock()
-
-
-class TestDatabaseIsolation:
-    """Example of proper test isolation with database operations."""
-
-    @pytest.fixture(autouse=True)
-    async def setup_and_teardown(self, test_db_connection):
-        """Setup and teardown for each test method."""
-        # Setup: Clear test data
-        await test_db_connection.user.delete_many(
-            where={"email": {"contains": "@test.example"}}
-        )
-
-        yield
-
-        # Teardown: Clear test data again
-        await test_db_connection.user.delete_many(
-            where={"email": {"contains": "@test.example"}}
-        )
-
-    @pytest.fixture(scope="session")
-    async def test_create_user(self, test_db_connection):
-        """Test that demonstrates proper isolation."""
-        # This test has access to a clean database
-        user = await test_db_connection.user.create(
-            data={
-                "id": "test-user-id",
-                "email": "test@test.example",
-                "name": "Test User",
-            }
-        )
-        assert user.email == "test@test.example"
-        # User will be cleaned up automatically
-
-
-@pytest.fixture(scope="function")  # Explicitly use function scope
-def reset_singleton_state():
-    """Reset singleton state between tests."""
-    # Example: Reset a singleton instance
-    # from backend.data.some_singleton import SingletonClass
-
-    # # Save original state
-    # original_instance = getattr(SingletonClass, "_instance", None)
-
-    # try:
-    #     # Clear singleton
-    #     SingletonClass._instance = None
-    #     yield
-    # finally:
-    #     # Restore original state
-    #     SingletonClass._instance = original_instance
-
-    # For now, just yield None as this is an example
-    yield None

autogpt_platform/backend/backend/server/test_utils.py

@@ -1,74 +0,0 @@
-"""Common test utilities and constants for server tests."""
-
-from typing import Any, Dict
-from unittest.mock import Mock
-
-import pytest
-
-# Test ID constants
-TEST_USER_ID = "test-user-id"
-ADMIN_USER_ID = "admin-user-id"
-TARGET_USER_ID = "target-user-id"
-
-# Common test data constants
-FIXED_TIMESTAMP = "2024-01-01T00:00:00Z"
-TRANSACTION_UUID = "transaction-123-uuid"
-METRIC_UUID = "metric-123-uuid"
-ANALYTICS_UUID = "analytics-123-uuid"
-
-
-def create_mock_with_id(mock_id: str) -> Mock:
-    """Create a mock object with an id attribute.
-
-    Args:
-        mock_id: The ID value to set on the mock
-
-    Returns:
-        Mock object with id attribute set
-    """
-    return Mock(id=mock_id)
-
-
-def assert_status_and_parse_json(
-    response: Any, expected_status: int = 200
-) -> Dict[str, Any]:
-    """Assert response status and return parsed JSON.
-
-    Args:
-        response: The HTTP response object
-        expected_status: Expected status code (default: 200)
-
-    Returns:
-        Parsed JSON response data
-
-    Raises:
-        AssertionError: If status code doesn't match expected
-    """
-    assert (
-        response.status_code == expected_status
-    ), f"Expected status {expected_status}, got {response.status_code}: {response.text}"
-    return response.json()
-
-
-@pytest.mark.parametrize(
-    "metric_value,metric_name,data_string",
-    [
-        (100, "api_calls_count", "external_api"),
-        (0, "error_count", "no_errors"),
-        (-5.2, "temperature_delta", "cooling"),
-        (1.23456789, "precision_test", "float_precision"),
-        (999999999, "large_number", "max_value"),
-    ],
-)
-def parametrized_metric_values_decorator(func):
-    """Decorator for parametrized metric value tests."""
-    return pytest.mark.parametrize(
-        "metric_value,metric_name,data_string",
-        [
-            (100, "api_calls_count", "external_api"),
-            (0, "error_count", "no_errors"),
-            (-5.2, "temperature_delta", "cooling"),
-            (1.23456789, "precision_test", "float_precision"),
-            (999999999, "large_number", "max_value"),
-        ],
-    )(func)

autogpt_platform/backend/backend/server/utils.py

@@ -1,11 +0,0 @@
-from autogpt_libs.auth.depends import requires_user
-from autogpt_libs.auth.models import User
-from fastapi import Depends
-
-from backend.util.settings import Settings
-
-settings = Settings()
-
-
-def get_user_id(user: User = Depends(requires_user)) -> str:
-    return user.user_id

autogpt_platform/backend/backend/server/utils/api_key_auth.py

@@ -0,0 +1,109 @@
+"""
+API Key authentication utilities for FastAPI applications.
+"""
+
+import inspect
+import secrets
+from typing import Any, Callable, Optional
+
+from fastapi import HTTPException, Request
+from fastapi.security import APIKeyHeader
+from starlette.status import HTTP_401_UNAUTHORIZED
+
+from backend.util.exceptions import MissingConfigError
+
+
+class APIKeyAuthenticator(APIKeyHeader):
+    """
+    Configurable API key authenticator for FastAPI applications,
+    with support for custom validation functions.
+
+    This class provides a flexible way to implement API key authentication with optional
+    custom validation logic. It can be used for simple token matching
+    or more complex validation scenarios like database lookups.
+
+    Examples:
+        Simple token validation:
+        ```python
+        api_key_auth = APIKeyAuthenticator(
+            header_name="X-API-Key",
+            expected_token="your-secret-token"
+        )
+
+        @app.get("/protected", dependencies=[Security(api_key_auth)])
+        def protected_endpoint():
+            return {"message": "Access granted"}
+        ```
+
+        Custom validation with database lookup:
+        ```python
+        async def validate_with_db(api_key: str):
+            api_key_obj = await db.get_api_key(api_key)
+            return api_key_obj if api_key_obj and api_key_obj.is_active else None
+
+        api_key_auth = APIKeyAuthenticator(
+            header_name="X-API-Key",
+            validator=validate_with_db
+        )
+        ```
+
+    Args:
+        header_name (str): The name of the header containing the API key
+        expected_token (Optional[str]): The expected API key value for simple token matching
+        validator (Optional[Callable]): Custom validation function that takes an API key
+            string and returns a boolean or object. Can be async.
+        status_if_missing (int): HTTP status code to use for validation errors
+        message_if_invalid (str): Error message to return when validation fails
+    """
+
+    def __init__(
+        self,
+        header_name: str,
+        expected_token: Optional[str] = None,
+        validator: Optional[Callable[[str], bool]] = None,
+        status_if_missing: int = HTTP_401_UNAUTHORIZED,
+        message_if_invalid: str = "Invalid API key",
+    ):
+        super().__init__(
+            name=header_name,
+            scheme_name=f"{__class__.__name__}-{header_name}",
+            auto_error=False,
+        )
+        self.expected_token = expected_token
+        self.custom_validator = validator
+        self.status_if_missing = status_if_missing
+        self.message_if_invalid = message_if_invalid
+
+    async def __call__(self, request: Request) -> Any:
+        api_key = await super()(request)
+        if api_key is None:
+            raise HTTPException(
+                status_code=self.status_if_missing, detail="No API key in request"
+            )
+
+        # Use custom validation if provided, otherwise use default equality check
+        validator = self.custom_validator or self.default_validator
+        result = (
+            await validator(api_key)
+            if inspect.iscoroutinefunction(validator)
+            else validator(api_key)
+        )
+
+        if not result:
+            raise HTTPException(
+                status_code=self.status_if_missing, detail=self.message_if_invalid
+            )
+
+        # Store validation result in request state if it's not just a boolean
+        if result is not True:
+            request.state.api_key = result
+
+        return result
+
+    async def default_validator(self, api_key: str) -> bool:
+        if not self.expected_token:
+            raise MissingConfigError(
+                f"{self.__class__.__name__}.expected_token is not set; "
+                "either specify it or provide a custom validator"
+            )
+        return secrets.compare_digest(api_key, self.expected_token)

autogpt_platform/backend/backend/server/v2/admin/credit_admin_routes.py

@@ -1,9 +1,8 @@
 import logging
 import typing
 
-from autogpt_libs.auth import requires_admin_user
-from autogpt_libs.auth.depends import get_user_id
-from fastapi import APIRouter, Body, Depends
+from autogpt_libs.auth import get_user_id, requires_admin_user
+from fastapi import APIRouter, Body, Security
 from prisma.enums import CreditTransactionType
 
 from backend.data.credit import admin_get_user_history, get_user_credit_model
@@ -18,7 +17,7 @@ _user_credit_model = get_user_credit_model()
 router = APIRouter(
     prefix="/admin",
     tags=["credits", "admin"],
-    dependencies=[Depends(requires_admin_user)],
+    dependencies=[Security(requires_admin_user)],
 )
 
 
@@ -29,18 +28,16 @@ async def add_user_credits(
     user_id: typing.Annotated[str, Body()],
     amount: typing.Annotated[int, Body()],
     comments: typing.Annotated[str, Body()],
-    admin_user: typing.Annotated[
-        str,
-        Depends(get_user_id),
-    ],
+    admin_user_id: str = Security(get_user_id),
 ):
-    """ """
-    logger.info(f"Admin user {admin_user} is adding {amount} credits to user {user_id}")
+    logger.info(
+        f"Admin user {admin_user_id} is adding {amount} credits to user {user_id}"
+    )
     new_balance, transaction_key = await _user_credit_model._add_transaction(
         user_id,
         amount,
         transaction_type=CreditTransactionType.GRANT,
-        metadata=SafeJson({"admin_id": admin_user, "reason": comments}),
+        metadata=SafeJson({"admin_id": admin_user_id, "reason": comments}),
     )
     return {
         "new_balance": new_balance,
@@ -54,17 +51,14 @@ async def add_user_credits(
     summary="Get All Users History",
 )
 async def admin_get_all_user_history(
-    admin_user: typing.Annotated[
-        str,
-        Depends(get_user_id),
-    ],
+    admin_user_id: str = Security(get_user_id),
     search: typing.Optional[str] = None,
     page: int = 1,
     page_size: int = 20,
     transaction_filter: typing.Optional[CreditTransactionType] = None,
 ):
     """ """
-    logger.info(f"Admin user {admin_user} is getting grant history")
+    logger.info(f"Admin user {admin_user_id} is getting grant history")
 
     try:
         resp = await admin_get_user_history(
@@ -73,7 +67,7 @@ async def admin_get_all_user_history(
             search=search,
             transaction_filter=transaction_filter,
         )
-        logger.info(f"Admin user {admin_user} got {len(resp.history)} grant history")
+        logger.info(f"Admin user {admin_user_id} got {len(resp.history)} grant history")
         return resp
     except Exception as e:
         logger.exception(f"Error getting grant history: {e}")

autogpt_platform/backend/backend/server/v2/admin/credit_admin_routes_test.py

@@ -1,19 +1,18 @@
 import json
 from unittest.mock import AsyncMock
 
-import autogpt_libs.auth
-import autogpt_libs.auth.depends
 import fastapi
 import fastapi.testclient
 import prisma.enums
+import pytest
 import pytest_mock
+from autogpt_libs.auth.jwt_utils import get_jwt_payload
 from prisma import Json
 from pytest_snapshot.plugin import Snapshot
 
 import backend.server.v2.admin.credit_admin_routes as credit_admin_routes
 import backend.server.v2.admin.model as admin_model
 from backend.data.model import UserTransaction
-from backend.server.conftest import ADMIN_USER_ID, TARGET_USER_ID
 from backend.util.models import Pagination
 
 app = fastapi.FastAPI()
@@ -22,25 +21,19 @@ app.include_router(credit_admin_routes.router)
 client = fastapi.testclient.TestClient(app)
 
 
-def override_requires_admin_user() -> dict[str, str]:
-    """Override admin user check for testing"""
-    return {"sub": ADMIN_USER_ID, "role": "admin"}
-
-
-def override_get_user_id() -> str:
-    """Override get_user_id for testing"""
-    return ADMIN_USER_ID
-
-
-app.dependency_overrides[autogpt_libs.auth.requires_admin_user] = (
-    override_requires_admin_user
-)
-app.dependency_overrides[autogpt_libs.auth.depends.get_user_id] = override_get_user_id
+@pytest.fixture(autouse=True)
+def setup_app_admin_auth(mock_jwt_admin):
+    """Setup admin auth overrides for all tests in this module"""
+    app.dependency_overrides[get_jwt_payload] = mock_jwt_admin["get_jwt_payload"]
+    yield
+    app.dependency_overrides.clear()
 
 
 def test_add_user_credits_success(
     mocker: pytest_mock.MockFixture,
     configured_snapshot: Snapshot,
+    admin_user_id: str,
+    target_user_id: str,
 ) -> None:
     """Test successful credit addition by admin"""
     # Mock the credit model
@@ -52,7 +45,7 @@ def test_add_user_credits_success(
     )
 
     request_data = {
-        "user_id": TARGET_USER_ID,
+        "user_id": target_user_id,
         "amount": 500,
         "comments": "Test credit grant for debugging",
     }
@@ -67,12 +60,12 @@ def test_add_user_credits_success(
     # Verify the function was called with correct parameters
     mock_credit_model._add_transaction.assert_called_once()
     call_args = mock_credit_model._add_transaction.call_args
-    assert call_args[0] == (TARGET_USER_ID, 500)
+    assert call_args[0] == (target_user_id, 500)
     assert call_args[1]["transaction_type"] == prisma.enums.CreditTransactionType.GRANT
     # Check that metadata is a Json object with the expected content
     assert isinstance(call_args[1]["metadata"], Json)
     assert call_args[1]["metadata"] == Json(
-        {"admin_id": ADMIN_USER_ID, "reason": "Test credit grant for debugging"}
+        {"admin_id": admin_user_id, "reason": "Test credit grant for debugging"}
     )
 
     # Snapshot test the response
@@ -290,18 +283,10 @@ def test_add_credits_invalid_request() -> None:
     assert response.status_code == 422
 
 
-def test_admin_endpoints_require_admin_role(mocker: pytest_mock.MockFixture) -> None:
+def test_admin_endpoints_require_admin_role(mock_jwt_user) -> None:
     """Test that admin endpoints require admin role"""
-    # Clear the admin override to test authorization
-    app.dependency_overrides.clear()
-
-    # Mock requires_admin_user to raise an exception
-    mocker.patch(
-        "autogpt_libs.auth.requires_admin_user",
-        side_effect=fastapi.HTTPException(
-            status_code=403, detail="Admin access required"
-        ),
-    )
+    # Simulate regular non-admin user
+    app.dependency_overrides[get_jwt_payload] = mock_jwt_user["get_jwt_payload"]
 
     # Test add_credits endpoint
     response = client.post(
@@ -312,20 +297,8 @@ def test_admin_endpoints_require_admin_role(mocker: pytest_mock.MockFixture) ->
             "comments": "test",
         },
     )
-    assert (
-        response.status_code == 401
-    )  # Auth middleware returns 401 when auth is disabled
+    assert response.status_code == 403
 
     # Test users_history endpoint
     response = client.get("/admin/users_history")
-    assert (
-        response.status_code == 401
-    )  # Auth middleware returns 401 when auth is disabled
-
-    # Restore the override
-    app.dependency_overrides[autogpt_libs.auth.requires_admin_user] = (
-        override_requires_admin_user
-    )
-    app.dependency_overrides[autogpt_libs.auth.depends.get_user_id] = (
-        override_get_user_id
-    )
+    assert response.status_code == 403

autogpt_platform/backend/backend/server/v2/admin/store_admin_routes.py

@@ -2,26 +2,28 @@ import logging
 import tempfile
 import typing
 
-import autogpt_libs.auth.depends
+import autogpt_libs.auth
 import fastapi
 import fastapi.responses
 import prisma.enums
 
 import backend.server.v2.store.db
-import backend.server.v2.store.exceptions
 import backend.server.v2.store.model
 import backend.util.json
 
 logger = logging.getLogger(__name__)
 
-router = fastapi.APIRouter(prefix="/admin", tags=["store", "admin"])
+router = fastapi.APIRouter(
+    prefix="/admin",
+    tags=["store", "admin"],
+    dependencies=[fastapi.Security(autogpt_libs.auth.requires_admin_user)],
+)
 
 
 @router.get(
     "/listings",
     summary="Get Admin Listings History",
     response_model=backend.server.v2.store.model.StoreListingsWithVersionsResponse,
-    dependencies=[fastapi.Depends(autogpt_libs.auth.depends.requires_admin_user)],
 )
 async def get_admin_listings_with_versions(
     status: typing.Optional[prisma.enums.SubmissionStatus] = None,
@@ -66,15 +68,11 @@ async def get_admin_listings_with_versions(
     "/submissions/{store_listing_version_id}/review",
     summary="Review Store Submission",
     response_model=backend.server.v2.store.model.StoreSubmission,
-    dependencies=[fastapi.Depends(autogpt_libs.auth.depends.requires_admin_user)],
 )
 async def review_submission(
     store_listing_version_id: str,
     request: backend.server.v2.store.model.ReviewSubmissionRequest,
-    user: typing.Annotated[
-        autogpt_libs.auth.models.User,
-        fastapi.Depends(autogpt_libs.auth.depends.requires_admin_user),
-    ],
+    user_id: str = fastapi.Security(autogpt_libs.auth.get_user_id),
 ):
     """
     Review a store listing submission.
@@ -82,7 +80,7 @@ async def review_submission(
     Args:
         store_listing_version_id: ID of the submission to review
         request: Review details including approval status and comments
-        user: Authenticated admin user performing the review
+        user_id: Authenticated admin user performing the review
 
     Returns:
         StoreSubmission with updated review information
@@ -93,7 +91,7 @@ async def review_submission(
             is_approved=request.is_approved,
             external_comments=request.comments,
             internal_comments=request.internal_comments or "",
-            reviewer_id=user.user_id,
+            reviewer_id=user_id,
         )
         return submission
     except Exception as e:
@@ -108,13 +106,9 @@ async def review_submission(
     "/submissions/download/{store_listing_version_id}",
     summary="Admin Download Agent File",
     tags=["store", "admin"],
-    dependencies=[fastapi.Depends(autogpt_libs.auth.depends.requires_admin_user)],
 )
 async def admin_download_agent_file(
-    user: typing.Annotated[
-        autogpt_libs.auth.models.User,
-        fastapi.Depends(autogpt_libs.auth.depends.requires_admin_user),
-    ],
+    user_id: str = fastapi.Security(autogpt_libs.auth.get_user_id),
     store_listing_version_id: str = fastapi.Path(
         ..., description="The ID of the agent to download"
     ),
@@ -132,7 +126,7 @@ async def admin_download_agent_file(
         HTTPException: If the agent is not found or an unexpected error occurs.
     """
     graph_data = await backend.server.v2.store.db.get_agent_as_admin(
-        user_id=user.user_id,
+        user_id=user_id,
         store_listing_version_id=store_listing_version_id,
     )
     file_name = f"agent_{graph_data.id}_v{graph_data.version or 'latest'}.json"

autogpt_platform/backend/backend/server/v2/builder/routes.py

@@ -2,7 +2,7 @@ import logging
 from typing import Annotated, Sequence
 
 import fastapi
-from autogpt_libs.auth.depends import auth_middleware, get_user_id
+from autogpt_libs.auth.dependencies import get_user_id, requires_user
 
 import backend.server.v2.builder.db as builder_db
 import backend.server.v2.builder.model as builder_model
@@ -15,7 +15,9 @@ from backend.util.models import Pagination
 
 logger = logging.getLogger(__name__)
 
-router = fastapi.APIRouter()
+router = fastapi.APIRouter(
+    dependencies=[fastapi.Security(requires_user)],
+)
 
 
 # Taken from backend/server/v2/store/db.py
@@ -41,12 +43,9 @@ def sanitize_query(query: str | None) -> str | None:
 @router.get(
     "/suggestions",
     summary="Get Builder suggestions",
-    dependencies=[fastapi.Depends(auth_middleware)],
     response_model=builder_model.SuggestionsResponse,
 )
-async def get_suggestions(
-    user_id: Annotated[str, fastapi.Depends(get_user_id)],
-) -> builder_model.SuggestionsResponse:
+async def get_suggestions() -> builder_model.SuggestionsResponse:
     """
     Get all suggestions for the Blocks Menu.
     """
@@ -76,7 +75,6 @@ async def get_suggestions(
 @router.get(
     "/categories",
     summary="Get Builder block categories",
-    dependencies=[fastapi.Depends(auth_middleware)],
     response_model=Sequence[builder_model.BlockCategoryResponse],
 )
 async def get_block_categories(
@@ -91,7 +89,6 @@ async def get_block_categories(
 @router.get(
     "/blocks",
     summary="Get Builder blocks",
-    dependencies=[fastapi.Depends(auth_middleware)],
     response_model=builder_model.BlockResponse,
 )
 async def get_blocks(
@@ -116,7 +113,6 @@ async def get_blocks(
 @router.get(
     "/providers",
     summary="Get Builder integration providers",
-    dependencies=[fastapi.Depends(auth_middleware)],
     response_model=builder_model.ProviderResponse,
 )
 async def get_providers(
@@ -136,12 +132,11 @@ async def get_providers(
     "/search",
     summary="Builder search",
     tags=["store", "private"],
-    dependencies=[fastapi.Depends(auth_middleware)],
     response_model=builder_model.SearchResponse,
 )
 async def search(
     options: builder_model.SearchRequest,
-    user_id: Annotated[str, fastapi.Depends(get_user_id)],
+    user_id: Annotated[str, fastapi.Security(get_user_id)],
 ) -> builder_model.SearchResponse:
     """
     Search for blocks (including integrations), marketplace agents, and user library agents.
@@ -227,11 +222,10 @@ async def search(
 @router.get(
     "/counts",
     summary="Get Builder item counts",
-    dependencies=[fastapi.Depends(auth_middleware)],
     response_model=builder_model.CountResponse,
 )
 async def get_counts(
-    user_id: Annotated[str, fastapi.Depends(get_user_id)],
+    user_id: Annotated[str, fastapi.Security(get_user_id)],
 ) -> builder_model.CountResponse:
     """
     Get item counts for the menu categories in the Blocks Menu.

autogpt_platform/backend/backend/server/v2/library/model_test.py

@@ -1,6 +1,5 @@
 import datetime
 
-import prisma.fields
 import prisma.models
 import pytest
 
@@ -8,7 +7,7 @@ import backend.server.v2.library.model as library_model
 
 
 @pytest.mark.asyncio
-async def test_agent_preset_from_db():
+async def test_agent_preset_from_db(test_user_id: str):
     # Create mock DB agent
     db_agent = prisma.models.AgentPreset(
         id="test-agent-123",
@@ -19,7 +18,7 @@ async def test_agent_preset_from_db():
         name="Test Agent",
         description="Test agent description",
         isActive=True,
-        userId="test-user-123",
+        userId=test_user_id,
         isDeleted=False,
         InputPresets=[
             prisma.models.AgentNodeExecutionInputOutput.model_validate(

autogpt_platform/backend/backend/server/v2/library/routes/agents.py

@@ -2,7 +2,7 @@ import logging
 from typing import Optional
 
 import autogpt_libs.auth as autogpt_auth_lib
-from fastapi import APIRouter, Body, Depends, HTTPException, Query, status
+from fastapi import APIRouter, Body, HTTPException, Query, Security, status
 from fastapi.responses import Response
 
 import backend.server.v2.library.db as library_db
@@ -15,7 +15,7 @@ logger = logging.getLogger(__name__)
 router = APIRouter(
     prefix="/agents",
     tags=["library", "private"],
-    dependencies=[Depends(autogpt_auth_lib.auth_middleware)],
+    dependencies=[Security(autogpt_auth_lib.requires_user)],
 )
 
 
@@ -27,7 +27,7 @@ router = APIRouter(
     },
 )
 async def list_library_agents(
-    user_id: str = Depends(autogpt_auth_lib.depends.get_user_id),
+    user_id: str = Security(autogpt_auth_lib.get_user_id),
     search_term: Optional[str] = Query(
         None, description="Search term to filter agents"
     ),
@@ -82,7 +82,7 @@ async def list_library_agents(
 @router.get("/{library_agent_id}", summary="Get Library Agent")
 async def get_library_agent(
     library_agent_id: str,
-    user_id: str = Depends(autogpt_auth_lib.depends.get_user_id),
+    user_id: str = Security(autogpt_auth_lib.get_user_id),
 ) -> library_model.LibraryAgent:
     return await library_db.get_library_agent(id=library_agent_id, user_id=user_id)
 
@@ -91,7 +91,7 @@ async def get_library_agent(
 async def get_library_agent_by_graph_id(
     graph_id: str,
     version: Optional[int] = Query(default=None),
-    user_id: str = Depends(autogpt_auth_lib.depends.get_user_id),
+    user_id: str = Security(autogpt_auth_lib.get_user_id),
 ) -> library_model.LibraryAgent:
     library_agent = await library_db.get_library_agent_by_graph_id(
         user_id, graph_id, version
@@ -111,7 +111,7 @@ async def get_library_agent_by_graph_id(
 )
 async def get_library_agent_by_store_listing_version_id(
     store_listing_version_id: str,
-    user_id: str = Depends(autogpt_auth_lib.depends.get_user_id),
+    user_id: str = Security(autogpt_auth_lib.get_user_id),
 ) -> library_model.LibraryAgent | None:
     """
     Get Library Agent from Store Listing Version ID.
@@ -145,7 +145,7 @@ async def get_library_agent_by_store_listing_version_id(
 )
 async def add_marketplace_agent_to_library(
     store_listing_version_id: str = Body(embed=True),
-    user_id: str = Depends(autogpt_auth_lib.depends.get_user_id),
+    user_id: str = Security(autogpt_auth_lib.get_user_id),
 ) -> library_model.LibraryAgent:
     """
     Add an agent from the marketplace to the user's library.
@@ -201,7 +201,7 @@ async def add_marketplace_agent_to_library(
 async def update_library_agent(
     library_agent_id: str,
     payload: library_model.LibraryAgentUpdateRequest,
-    user_id: str = Depends(autogpt_auth_lib.depends.get_user_id),
+    user_id: str = Security(autogpt_auth_lib.get_user_id),
 ) -> library_model.LibraryAgent:
     """
     Update the library agent with the given fields.
@@ -252,7 +252,7 @@ async def update_library_agent(
 )
 async def delete_library_agent(
     library_agent_id: str,
-    user_id: str = Depends(autogpt_auth_lib.depends.get_user_id),
+    user_id: str = Security(autogpt_auth_lib.get_user_id),
 ) -> Response:
     """
     Soft-delete the specified library agent.
@@ -283,7 +283,7 @@ async def delete_library_agent(
 @router.post("/{library_agent_id}/fork", summary="Fork Library Agent")
 async def fork_library_agent(
     library_agent_id: str,
-    user_id: str = Depends(autogpt_auth_lib.depends.get_user_id),
+    user_id: str = Security(autogpt_auth_lib.get_user_id),
 ) -> library_model.LibraryAgent:
     return await library_db.fork_library_agent(
         library_agent_id=library_agent_id,

autogpt_platform/backend/backend/server/v2/library/routes/presets.py

@@ -2,7 +2,7 @@ import logging
 from typing import Any, Optional
 
 import autogpt_libs.auth as autogpt_auth_lib
-from fastapi import APIRouter, Body, Depends, HTTPException, Query, status
+from fastapi import APIRouter, Body, HTTPException, Query, Security, status
 
 import backend.server.v2.library.db as db
 import backend.server.v2.library.model as models
@@ -17,7 +17,10 @@ from backend.util.exceptions import NotFoundError
 logger = logging.getLogger(__name__)
 
 credentials_manager = IntegrationCredentialsManager()
-router = APIRouter(tags=["presets"])
+router = APIRouter(
+    tags=["presets"],
+    dependencies=[Security(autogpt_auth_lib.requires_user)],
+)
 
 
 @router.get(
@@ -26,7 +29,7 @@ router = APIRouter(tags=["presets"])
     description="Retrieve a paginated list of presets for the current user.",
 )
 async def list_presets(
-    user_id: str = Depends(autogpt_auth_lib.depends.get_user_id),
+    user_id: str = Security(autogpt_auth_lib.get_user_id),
     page: int = Query(default=1, ge=1),
     page_size: int = Query(default=10, ge=1),
     graph_id: Optional[str] = Query(
@@ -66,7 +69,7 @@ async def list_presets(
 )
 async def get_preset(
     preset_id: str,
-    user_id: str = Depends(autogpt_auth_lib.depends.get_user_id),
+    user_id: str = Security(autogpt_auth_lib.get_user_id),
 ) -> models.LibraryAgentPreset:
     """
     Retrieve details for a specific preset by its ID.
@@ -109,7 +112,7 @@ async def create_preset(
         models.LibraryAgentPresetCreatable
         | models.LibraryAgentPresetCreatableFromGraphExecution
     ),
-    user_id: str = Depends(autogpt_auth_lib.depends.get_user_id),
+    user_id: str = Security(autogpt_auth_lib.get_user_id),
 ) -> models.LibraryAgentPreset:
     """
     Create a new library agent preset. Automatically corrects node_input format if needed.
@@ -141,7 +144,7 @@ async def create_preset(
 @router.post("/presets/setup-trigger")
 async def setup_trigger(
     params: models.TriggeredPresetSetupRequest = Body(),
-    user_id: str = Depends(autogpt_auth_lib.depends.get_user_id),
+    user_id: str = Security(autogpt_auth_lib.get_user_id),
 ) -> models.LibraryAgentPreset:
     """
     Sets up a webhook-triggered `LibraryAgentPreset` for a `LibraryAgent`.
@@ -206,7 +209,7 @@ async def setup_trigger(
 async def update_preset(
     preset_id: str,
     preset: models.LibraryAgentPresetUpdatable,
-    user_id: str = Depends(autogpt_auth_lib.depends.get_user_id),
+    user_id: str = Security(autogpt_auth_lib.get_user_id),
 ) -> models.LibraryAgentPreset:
     """
     Update an existing library agent preset.
@@ -310,7 +313,7 @@ async def update_preset(
 )
 async def delete_preset(
     preset_id: str,
-    user_id: str = Depends(autogpt_auth_lib.depends.get_user_id),
+    user_id: str = Security(autogpt_auth_lib.get_user_id),
 ) -> None:
     """
     Delete a preset by its ID. Returns 204 No Content on success.
@@ -364,7 +367,7 @@ async def delete_preset(
 )
 async def execute_preset(
     preset_id: str,
-    user_id: str = Depends(autogpt_auth_lib.depends.get_user_id),
+    user_id: str = Security(autogpt_auth_lib.get_user_id),
     inputs: dict[str, Any] = Body(..., embed=True, default_factory=dict),
 ) -> dict[str, Any]:  # FIXME: add proper return type
     """

autogpt_platform/backend/backend/server/v2/library/routes_test.py

@@ -1,7 +1,6 @@
 import datetime
 import json
 
-import autogpt_libs.auth as autogpt_auth_lib
 import fastapi.testclient
 import pytest
 import pytest_mock
@@ -19,24 +18,21 @@ client = fastapi.testclient.TestClient(app)
 FIXED_NOW = datetime.datetime(2023, 1, 1, 0, 0, 0)
 
 
-def override_auth_middleware():
-    """Override auth middleware for testing"""
-    return {"sub": "test-user-id"}
+@pytest.fixture(autouse=True)
+def setup_app_auth(mock_jwt_user):
+    """Setup auth overrides for all tests in this module"""
+    from autogpt_libs.auth.jwt_utils import get_jwt_payload
 
-
-def override_get_user_id():
-    """Override get_user_id for testing"""
-    return "test-user-id"
-
-
-app.dependency_overrides[autogpt_auth_lib.auth_middleware] = override_auth_middleware
-app.dependency_overrides[autogpt_auth_lib.depends.get_user_id] = override_get_user_id
+    app.dependency_overrides[get_jwt_payload] = mock_jwt_user["get_jwt_payload"]
+    yield
+    app.dependency_overrides.clear()
 
 
 @pytest.mark.asyncio
 async def test_get_library_agents_success(
     mocker: pytest_mock.MockFixture,
     snapshot: Snapshot,
+    test_user_id: str,
 ) -> None:
     mocked_value = library_model.LibraryAgentResponse(
         agents=[
@@ -100,7 +96,7 @@ async def test_get_library_agents_success(
     snapshot.assert_match(json.dumps(response.json(), indent=2), "lib_agts_search")
 
     mock_db_call.assert_called_once_with(
-        user_id="test-user-id",
+        user_id=test_user_id,
         search_term="test",
         sort_by=library_model.LibraryAgentSort.UPDATED_AT,
         page=1,
@@ -108,14 +104,14 @@ async def test_get_library_agents_success(
     )
 
 
-def test_get_library_agents_error(mocker: pytest_mock.MockFixture):
+def test_get_library_agents_error(mocker: pytest_mock.MockFixture, test_user_id: str):
     mock_db_call = mocker.patch("backend.server.v2.library.db.list_library_agents")
     mock_db_call.side_effect = Exception("Test error")
 
     response = client.get("/agents?search_term=test")
     assert response.status_code == 500
     mock_db_call.assert_called_once_with(
-        user_id="test-user-id",
+        user_id=test_user_id,
         search_term="test",
         sort_by=library_model.LibraryAgentSort.UPDATED_AT,
         page=1,
@@ -123,7 +119,9 @@ def test_get_library_agents_error(mocker: pytest_mock.MockFixture):
     )
 
 
-def test_add_agent_to_library_success(mocker: pytest_mock.MockFixture):
+def test_add_agent_to_library_success(
+    mocker: pytest_mock.MockFixture, test_user_id: str
+):
     mock_library_agent = library_model.LibraryAgent(
         id="test-library-agent-id",
         graph_id="test-agent-1",
@@ -160,11 +158,11 @@ def test_add_agent_to_library_success(mocker: pytest_mock.MockFixture):
     assert data.graph_id == "test-agent-1"
 
     mock_db_call.assert_called_once_with(
-        store_listing_version_id="test-version-id", user_id="test-user-id"
+        store_listing_version_id="test-version-id", user_id=test_user_id
     )
 
 
-def test_add_agent_to_library_error(mocker: pytest_mock.MockFixture):
+def test_add_agent_to_library_error(mocker: pytest_mock.MockFixture, test_user_id: str):
     mock_db_call = mocker.patch(
         "backend.server.v2.library.db.add_store_agent_to_library"
     )
@@ -176,5 +174,5 @@ def test_add_agent_to_library_error(mocker: pytest_mock.MockFixture):
     assert response.status_code == 500
     assert "detail" in response.json()  # Verify error response structure
     mock_db_call.assert_called_once_with(
-        store_listing_version_id="test-version-id", user_id="test-user-id"
+        store_listing_version_id="test-version-id", user_id=test_user_id
     )

autogpt_platform/backend/backend/server/v2/otto/routes.py

@@ -1,9 +1,7 @@
 import logging
 
-from autogpt_libs.auth.middleware import auth_middleware
-from fastapi import APIRouter, Depends, HTTPException
-
-from backend.server.utils import get_user_id
+from autogpt_libs.auth import get_user_id, requires_user
+from fastapi import APIRouter, HTTPException, Security
 
 from .models import ApiResponse, ChatRequest
 from .service import OttoService
@@ -16,11 +14,11 @@ router = APIRouter()
 @router.post(
     "/ask",
     response_model=ApiResponse,
-    dependencies=[Depends(auth_middleware)],
+    dependencies=[Security(requires_user)],
     summary="Proxy Otto Chat Request",
 )
 async def proxy_otto_request(
-    request: ChatRequest, user_id: str = Depends(get_user_id)
+    request: ChatRequest, user_id: str = Security(get_user_id)
 ) -> ApiResponse:
     """
     Proxy requests to Otto API while adding necessary security headers and logging.

autogpt_platform/backend/backend/server/v2/otto/routes_test.py

@@ -1,15 +1,13 @@
 import json
 
-import autogpt_libs.auth.depends
-import autogpt_libs.auth.middleware
 import fastapi
 import fastapi.testclient
+import pytest
 import pytest_mock
 from pytest_snapshot.plugin import Snapshot
 
 import backend.server.v2.otto.models as otto_models
 import backend.server.v2.otto.routes as otto_routes
-from backend.server.utils import get_user_id
 from backend.server.v2.otto.service import OttoService
 
 app = fastapi.FastAPI()
@@ -18,20 +16,14 @@ app.include_router(otto_routes.router)
 client = fastapi.testclient.TestClient(app)
 
 
-def override_auth_middleware():
-    """Override auth middleware for testing"""
-    return {"sub": "test-user-id"}
+@pytest.fixture(autouse=True)
+def setup_app_auth(mock_jwt_user):
+    """Setup auth overrides for all tests in this module"""
+    from autogpt_libs.auth.jwt_utils import get_jwt_payload
 
-
-def override_get_user_id():
-    """Override get_user_id for testing"""
-    return "test-user-id"
-
-
-app.dependency_overrides[autogpt_libs.auth.middleware.auth_middleware] = (
-    override_auth_middleware
-)
-app.dependency_overrides[get_user_id] = override_get_user_id
+    app.dependency_overrides[get_jwt_payload] = mock_jwt_user["get_jwt_payload"]
+    yield
+    app.dependency_overrides.clear()
 
 
 def test_ask_otto_success(
@@ -241,31 +233,14 @@ def test_ask_otto_invalid_request() -> None:
     assert response.status_code == 422
 
 
-def test_ask_otto_unauthenticated(mocker: pytest_mock.MockFixture) -> None:
-    """Test Otto API request without authentication"""
-    # Remove the auth override to test unauthenticated access
-    app.dependency_overrides.clear()
-
-    # Mock auth_middleware to raise an exception
-    mocker.patch(
-        "autogpt_libs.auth.middleware.auth_middleware",
-        side_effect=fastapi.HTTPException(status_code=401, detail="Unauthorized"),
-    )
-
+def test_ask_otto_unconfigured() -> None:
+    """Test Otto API request without configuration"""
     request_data = {
         "query": "Test",
         "conversation_history": [],
         "message_id": "123",
     }
 
+    # When Otto API URL is not configured, we get 502
     response = client.post("/ask", json=request_data)
-    # When auth is disabled and Otto API URL is not configured, we get 502 (wrapped from 503)
     assert response.status_code == 502
-
-    # Restore the override
-    app.dependency_overrides[autogpt_libs.auth.middleware.auth_middleware] = (
-        override_auth_middleware
-    )
-    app.dependency_overrides[autogpt_libs.auth.depends.get_user_id] = (
-        override_get_user_id
-    )

autogpt_platform/backend/backend/server/v2/store/db.py

@@ -1171,10 +1171,7 @@ async def get_my_agents(
         ) from e
 
 
-async def get_agent(
-    user_id: str | None,
-    store_listing_version_id: str,
-) -> GraphModel:
+async def get_agent(store_listing_version_id: str) -> GraphModel:
     """Get agent using the version ID and store listing version ID."""
     store_listing_version = (
         await prisma.models.StoreListingVersion.prisma().find_unique(
@@ -1186,7 +1183,6 @@ async def get_agent(
         raise ValueError(f"Store listing version {store_listing_version_id} not found")
 
     graph = await get_graph(
-        user_id=user_id,
         graph_id=store_listing_version.agentGraphId,
         version=store_listing_version.agentGraphVersion,
         for_export=True,

autogpt_platform/backend/backend/server/v2/store/routes.py

@@ -3,13 +3,10 @@ import tempfile
 import typing
 import urllib.parse
 
-import autogpt_libs.auth.depends
-import autogpt_libs.auth.middleware
+import autogpt_libs.auth
 import fastapi
 import fastapi.responses
-from autogpt_libs.auth.depends import auth_middleware, get_user_id
 
-import backend.data.block
 import backend.data.graph
 import backend.server.v2.store.db
 import backend.server.v2.store.exceptions
@@ -32,12 +29,11 @@ router = fastapi.APIRouter()
     "/profile",
     summary="Get user profile",
     tags=["store", "private"],
+    dependencies=[fastapi.Security(autogpt_libs.auth.requires_user)],
     response_model=backend.server.v2.store.model.ProfileDetails,
 )
 async def get_profile(
-    user_id: typing.Annotated[
-        str, fastapi.Depends(autogpt_libs.auth.depends.get_user_id)
-    ],
+    user_id: str = fastapi.Security(autogpt_libs.auth.get_user_id),
 ):
     """
     Get the profile details for the authenticated user.
@@ -65,14 +61,12 @@ async def get_profile(
     "/profile",
     summary="Update user profile",
     tags=["store", "private"],
-    dependencies=[fastapi.Depends(autogpt_libs.auth.middleware.auth_middleware)],
+    dependencies=[fastapi.Security(autogpt_libs.auth.requires_user)],
     response_model=backend.server.v2.store.model.CreatorDetails,
 )
 async def update_or_create_profile(
     profile: backend.server.v2.store.model.Profile,
-    user_id: typing.Annotated[
-        str, fastapi.Depends(autogpt_libs.auth.depends.get_user_id)
-    ],
+    user_id: str = fastapi.Security(autogpt_libs.auth.get_user_id),
 ):
     """
     Update the store profile for the authenticated user.
@@ -215,11 +209,9 @@ async def get_agent(username: str, agent_name: str):
     "/graph/{store_listing_version_id}",
     summary="Get agent graph",
     tags=["store"],
+    dependencies=[fastapi.Security(autogpt_libs.auth.requires_user)],
 )
-async def get_graph_meta_by_store_listing_version_id(
-    store_listing_version_id: str,
-    _: typing.Annotated[str, fastapi.Depends(autogpt_libs.auth.depends.get_user_id)],
-):
+async def get_graph_meta_by_store_listing_version_id(store_listing_version_id: str):
     """
     Get Agent Graph from Store Listing Version ID.
     """
@@ -240,12 +232,10 @@ async def get_graph_meta_by_store_listing_version_id(
     "/agents/{store_listing_version_id}",
     summary="Get agent by version",
     tags=["store"],
+    dependencies=[fastapi.Security(autogpt_libs.auth.requires_user)],
     response_model=backend.server.v2.store.model.StoreAgentDetails,
 )
-async def get_store_agent(
-    store_listing_version_id: str,
-    _: typing.Annotated[str, fastapi.Depends(autogpt_libs.auth.depends.get_user_id)],
-):
+async def get_store_agent(store_listing_version_id: str):
     """
     Get Store Agent Details from Store Listing Version ID.
     """
@@ -266,16 +256,14 @@ async def get_store_agent(
     "/agents/{username}/{agent_name}/review",
     summary="Create agent review",
     tags=["store"],
-    dependencies=[fastapi.Depends(autogpt_libs.auth.middleware.auth_middleware)],
+    dependencies=[fastapi.Security(autogpt_libs.auth.requires_user)],
     response_model=backend.server.v2.store.model.StoreReview,
 )
 async def create_review(
     username: str,
     agent_name: str,
     review: backend.server.v2.store.model.StoreReviewCreate,
-    user_id: typing.Annotated[
-        str, fastapi.Depends(autogpt_libs.auth.depends.get_user_id)
-    ],
+    user_id: str = fastapi.Security(autogpt_libs.auth.get_user_id),
 ):
     """
     Create a review for a store agent.
@@ -402,13 +390,11 @@ async def get_creator(
     "/myagents",
     summary="Get my agents",
     tags=["store", "private"],
-    dependencies=[fastapi.Depends(autogpt_libs.auth.middleware.auth_middleware)],
+    dependencies=[fastapi.Security(autogpt_libs.auth.requires_user)],
     response_model=backend.server.v2.store.model.MyAgentsResponse,
 )
 async def get_my_agents(
-    user_id: typing.Annotated[
-        str, fastapi.Depends(autogpt_libs.auth.depends.get_user_id)
-    ],
+    user_id: str = fastapi.Security(autogpt_libs.auth.get_user_id),
     page: typing.Annotated[int, fastapi.Query(ge=1)] = 1,
     page_size: typing.Annotated[int, fastapi.Query(ge=1)] = 20,
 ):
@@ -429,14 +415,12 @@ async def get_my_agents(
     "/submissions/{submission_id}",
     summary="Delete store submission",
     tags=["store", "private"],
-    dependencies=[fastapi.Depends(autogpt_libs.auth.middleware.auth_middleware)],
+    dependencies=[fastapi.Security(autogpt_libs.auth.requires_user)],
     response_model=bool,
 )
 async def delete_submission(
-    user_id: typing.Annotated[
-        str, fastapi.Depends(autogpt_libs.auth.depends.get_user_id)
-    ],
     submission_id: str,
+    user_id: str = fastapi.Security(autogpt_libs.auth.get_user_id),
 ):
     """
     Delete a store listing submission.
@@ -466,13 +450,11 @@ async def delete_submission(
     "/submissions",
     summary="List my submissions",
     tags=["store", "private"],
-    dependencies=[fastapi.Depends(autogpt_libs.auth.middleware.auth_middleware)],
+    dependencies=[fastapi.Security(autogpt_libs.auth.requires_user)],
     response_model=backend.server.v2.store.model.StoreSubmissionsResponse,
 )
 async def get_submissions(
-    user_id: typing.Annotated[
-        str, fastapi.Depends(autogpt_libs.auth.depends.get_user_id)
-    ],
+    user_id: str = fastapi.Security(autogpt_libs.auth.get_user_id),
     page: int = 1,
     page_size: int = 20,
 ):
@@ -520,14 +502,12 @@ async def get_submissions(
     "/submissions",
     summary="Create store submission",
     tags=["store", "private"],
-    dependencies=[fastapi.Depends(autogpt_libs.auth.middleware.auth_middleware)],
+    dependencies=[fastapi.Security(autogpt_libs.auth.requires_user)],
     response_model=backend.server.v2.store.model.StoreSubmission,
 )
 async def create_submission(
     submission_request: backend.server.v2.store.model.StoreSubmissionRequest,
-    user_id: typing.Annotated[
-        str, fastapi.Depends(autogpt_libs.auth.depends.get_user_id)
-    ],
+    user_id: str = fastapi.Security(autogpt_libs.auth.get_user_id),
 ):
     """
     Create a new store listing submission.
@@ -568,15 +548,13 @@ async def create_submission(
     "/submissions/{store_listing_version_id}",
     summary="Edit store submission",
     tags=["store", "private"],
-    dependencies=[fastapi.Depends(autogpt_libs.auth.middleware.auth_middleware)],
+    dependencies=[fastapi.Security(autogpt_libs.auth.requires_user)],
     response_model=backend.server.v2.store.model.StoreSubmission,
 )
 async def edit_submission(
     store_listing_version_id: str,
     submission_request: backend.server.v2.store.model.StoreSubmissionEditRequest,
-    user_id: typing.Annotated[
-        str, fastapi.Depends(autogpt_libs.auth.depends.get_user_id)
-    ],
+    user_id: str = fastapi.Security(autogpt_libs.auth.get_user_id),
 ):
     """
     Edit an existing store listing submission.
@@ -609,13 +587,11 @@ async def edit_submission(
     "/submissions/media",
     summary="Upload submission media",
     tags=["store", "private"],
-    dependencies=[fastapi.Depends(autogpt_libs.auth.middleware.auth_middleware)],
+    dependencies=[fastapi.Security(autogpt_libs.auth.requires_user)],
 )
 async def upload_submission_media(
     file: fastapi.UploadFile,
-    user_id: typing.Annotated[
-        str, fastapi.Depends(autogpt_libs.auth.depends.get_user_id)
-    ],
+    user_id: str = fastapi.Security(autogpt_libs.auth.get_user_id),
 ):
     """
     Upload media (images/videos) for a store listing submission.
@@ -666,13 +642,11 @@ async def upload_submission_media(
     "/submissions/generate_image",
     summary="Generate submission image",
     tags=["store", "private"],
-    dependencies=[fastapi.Depends(autogpt_libs.auth.middleware.auth_middleware)],
+    dependencies=[fastapi.Security(autogpt_libs.auth.requires_user)],
 )
 async def generate_image(
     agent_id: str,
-    user_id: typing.Annotated[
-        str, fastapi.Depends(autogpt_libs.auth.depends.get_user_id)
-    ],
+    user_id: str = fastapi.Security(autogpt_libs.auth.get_user_id),
 ) -> fastapi.responses.Response:
     """
     Generate an image for a store listing submission.
@@ -730,7 +704,6 @@ async def generate_image(
     tags=["store", "public"],
 )
 async def download_agent_file(
-    request: fastapi.Request,
     store_listing_version_id: str = fastapi.Path(
         ..., description="The ID of the agent to download"
     ),
@@ -747,15 +720,7 @@ async def download_agent_file(
     Raises:
         HTTPException: If the agent is not found or an unexpected error occurs.
     """
-    try:
-        user_id = get_user_id(await auth_middleware(request))
-    except fastapi.HTTPException:
-        user_id = None
-
-    graph_data = await backend.server.v2.store.db.get_agent(
-        user_id=user_id,
-        store_listing_version_id=store_listing_version_id,
-    )
+    graph_data = await backend.server.v2.store.db.get_agent(store_listing_version_id)
     file_name = f"agent_{graph_data.id}_v{graph_data.version or 'latest'}.json"
 
     # Sending graph as a stream (similar to marketplace v1)

autogpt_platform/backend/backend/server/v2/store/routes_test.py

@@ -1,11 +1,10 @@
 import datetime
 import json
 
-import autogpt_libs.auth.depends
-import autogpt_libs.auth.middleware
 import fastapi
 import fastapi.testclient
 import prisma.enums
+import pytest
 import pytest_mock
 from pytest_snapshot.plugin import Snapshot
 
@@ -22,20 +21,14 @@ app.include_router(backend.server.v2.store.routes.router)
 client = fastapi.testclient.TestClient(app)
 
 
-def override_auth_middleware() -> dict[str, str]:
-    """Override auth middleware for testing"""
-    return {"sub": "test-user-id"}
+@pytest.fixture(autouse=True)
+def setup_app_auth(mock_jwt_user):
+    """Setup auth overrides for all tests in this module"""
+    from autogpt_libs.auth.jwt_utils import get_jwt_payload
 
-
-def override_get_user_id() -> str:
-    """Override get_user_id for testing"""
-    return "test-user-id"
-
-
-app.dependency_overrides[autogpt_libs.auth.middleware.auth_middleware] = (
-    override_auth_middleware
-)
-app.dependency_overrides[autogpt_libs.auth.depends.get_user_id] = override_get_user_id
+    app.dependency_overrides[get_jwt_payload] = mock_jwt_user["get_jwt_payload"]
+    yield
+    app.dependency_overrides.clear()
 
 
 def test_get_agents_defaults(
@@ -536,6 +529,7 @@ def test_get_creator_details(
 def test_get_submissions_success(
     mocker: pytest_mock.MockFixture,
     snapshot: Snapshot,
+    test_user_id: str,
 ) -> None:
     mocked_value = backend.server.v2.store.model.StoreSubmissionsResponse(
         submissions=[
@@ -576,12 +570,13 @@ def test_get_submissions_success(
     assert data.pagination.current_page == 1
     snapshot.snapshot_dir = "snapshots"
     snapshot.assert_match(json.dumps(response.json(), indent=2), "sub_success")
-    mock_db_call.assert_called_once_with(user_id="test-user-id", page=1, page_size=20)
+    mock_db_call.assert_called_once_with(user_id=test_user_id, page=1, page_size=20)
 
 
 def test_get_submissions_pagination(
     mocker: pytest_mock.MockFixture,
     snapshot: Snapshot,
+    test_user_id: str,
 ) -> None:
     mocked_value = backend.server.v2.store.model.StoreSubmissionsResponse(
         submissions=[],
@@ -605,7 +600,7 @@ def test_get_submissions_pagination(
     assert data.pagination.page_size == 5
     snapshot.snapshot_dir = "snapshots"
     snapshot.assert_match(json.dumps(response.json(), indent=2), "sub_pagination")
-    mock_db_call.assert_called_once_with(user_id="test-user-id", page=2, page_size=5)
+    mock_db_call.assert_called_once_with(user_id=test_user_id, page=2, page_size=5)
 
 
 def test_get_submissions_malformed_request(mocker: pytest_mock.MockFixture):

autogpt_platform/backend/backend/server/ws_api.py

@@ -5,7 +5,7 @@ from typing import Protocol
 
 import pydantic
 import uvicorn
-from autogpt_libs.auth import parse_jwt_token
+from autogpt_libs.auth.jwt_utils import parse_jwt_token
 from fastapi import Depends, FastAPI, WebSocket, WebSocketDisconnect
 from starlette.middleware.cors import CORSMiddleware
 

autogpt_platform/backend/backend/util/test.py

@@ -4,6 +4,8 @@ import time
 import uuid
 from typing import Sequence, cast
 
+from autogpt_libs.auth import get_user_id
+
 from backend.data import db
 from backend.data.block import Block, BlockSchema, initialize_blocks
 from backend.data.execution import (
@@ -17,7 +19,6 @@ from backend.data.user import create_default_user
 from backend.executor import DatabaseManager, ExecutionManager, Scheduler
 from backend.notifications.notifications import NotificationManager
 from backend.server.rest_api import AgentServer
-from backend.server.utils import get_user_id
 
 log = logging.getLogger(__name__)
 

autogpt_platform/backend/poetry.lock

@@ -409,9 +409,7 @@ google-cloud-logging = "^3.12.1"
 launchdarkly-server-sdk = "^9.12.0"
 pydantic = "^2.11.7"
 pydantic-settings = "^2.10.1"
-pyjwt = "^2.10.1"
-pytest-asyncio = "^1.1.0"
-pytest-mock = "^3.14.1"
+pyjwt = {version = "^2.10.1", extras = ["crypto"]}
 redis = "^6.2.0"
 supabase = "^2.16.0"
 uvicorn = "^0.35.0"
@@ -868,7 +866,7 @@ files = [
     {file = "colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"},
     {file = "colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"},
 ]
-markers = {dev = "sys_platform == \"win32\" or platform_system == \"Windows\""}
+markers = {dev = "platform_system == \"Windows\" or sys_platform == \"win32\""}
 
 [[package]]
 name = "crashtest"
@@ -4744,6 +4742,9 @@ files = [
     {file = "pyjwt-2.10.1.tar.gz", hash = "sha256:3cc5772eb20009233caf06e9d8a0577824723b44e6648ee0a2aedb6cf9381953"},
 ]
 
+[package.dependencies]
+cryptography = {version = ">=3.4.0", optional = true, markers = "extra == \"crypto\""}
+
 [package.extras]
 crypto = ["cryptography (>=3.4.0)"]
 dev = ["coverage[toml] (==5.0.4)", "cryptography (>=3.4.0)", "pre-commit", "pytest (>=6.0.0,<7.0.0)", "sphinx", "sphinx-rtd-theme", "zope.interface"]
@@ -4860,7 +4861,7 @@ version = "3.14.1"
 description = "Thin-wrapper around the mock package for easier use with pytest"
 optional = false
 python-versions = ">=3.8"
-groups = ["main", "dev"]
+groups = ["dev"]
 files = [
     {file = "pytest_mock-3.14.1-py3-none-any.whl", hash = "sha256:178aefcd11307d874b4cd3100344e7e2d888d9791a6a1d9bfe90fbc1b74fd1d0"},
     {file = "pytest_mock-3.14.1.tar.gz", hash = "sha256:159e9edac4c451ce77a5cdb9fc5d1100708d2dd4ba3c3df572f14097351af80e"},

autogpt_platform/frontend/orval.config.ts

@@ -45,7 +45,8 @@ export default defineConfig({
       },
     },
     hooks: {
-      afterAllFilesWrite: "prettier --write",
+      afterAllFilesWrite:
+        "prettier --ignore-path= --write ./src/app/api/__generated__",
     },
   },
   // autogpt_zod_schema: {

autogpt_platform/frontend/src/app/(platform)/library/agents/[id]/components/OldAgentLibraryView/components/agent-schedule-details-view.tsx

@@ -42,8 +42,11 @@ export function AgentScheduleDetailsView({
   const toastOnFail = useToastOnFail();
 
   // Get user's timezone for displaying schedule times
-  const { data: timezoneData } = useGetV1GetUserTimezone();
-  const userTimezone = timezoneData?.data?.timezone || "UTC";
+  const { data: userTimezone } = useGetV1GetUserTimezone({
+    query: {
+      select: (res) => (res.status === 200 ? res.data.timezone : undefined),
+    },
+  });
 
   const infoStats: { label: string; value: React.ReactNode }[] = useMemo(() => {
     return [

autogpt_platform/frontend/src/app/(platform)/profile/(user)/settings/page.tsx

@@ -17,30 +17,21 @@ export default function SettingsPage() {
     isError: preferencesError,
     isLoading: preferencesLoading,
   } = useGetV1GetNotificationPreferences({
-    query: {
-      select: (res) => {
-        return res.data;
-      },
-    },
+    query: { select: (res) => (res.status === 200 ? res.data : null) },
   });
 
-  const { data: timezoneData, isLoading: timezoneLoading } =
+  const { data: timezone, isLoading: timezoneLoading } =
     useGetV1GetUserTimezone({
       query: {
         select: (res) => {
-          return res.data;
+          return res.status === 200 ? String(res.data.timezone) : "not-set";
         },
       },
     });
+  useTimezoneDetection(timezone);
 
   const { user, isUserLoading } = useSupabase();
 
-  // Auto-detect timezone if it's not set
-  const timezone = timezoneData?.timezone
-    ? String(timezoneData.timezone)
-    : "not-set";
-  useTimezoneDetection(timezone);
-
   if (preferencesLoading || isUserLoading || timezoneLoading) {
     return <SettingsLoading />;
   }
@@ -50,7 +41,7 @@ export default function SettingsPage() {
   }
 
   if (preferencesError || !preferences || !preferences.preferences) {
-    return "Errror..."; // TODO: Will use a Error reusable components from Block Menu redesign
+    return "Error..."; // TODO: Will use a Error reusable components from Block Menu redesign
   }
 
   return (

autogpt_platform/frontend/src/app/api/__generated__/models/storeSubmissionEditRequest.ts

@@ -1,19 +0,0 @@
-/**
- * Generated by orval v7.11.2 🍺
- * Do not edit manually.
- * AutoGPT Agent Server
- * This server is used to execute agents that are created by the AutoGPT system.
- * OpenAPI spec version: 0.1
- */
-import type { StoreSubmissionEditRequestVideoUrl } from './storeSubmissionEditRequestVideoUrl';
-import type { StoreSubmissionEditRequestChangesSummary } from './storeSubmissionEditRequestChangesSummary';
-
-export interface StoreSubmissionEditRequest {
-  name: string;
-  sub_heading: string;
-  video_url?: StoreSubmissionEditRequestVideoUrl;
-  image_urls?: string[];
-  description?: string;
-  categories?: string[];
-  changes_summary?: StoreSubmissionEditRequestChangesSummary;
-}

autogpt_platform/frontend/src/app/api/mutators/custom-mutator.ts

@@ -33,7 +33,9 @@ const getBody = <T>(c: Response | Request): Promise<T> => {
   return c.text() as Promise<T>;
 };
 
-export const customMutator = async <T = any>(
+export const customMutator = async <
+  T extends { data: any; status: number; headers: Headers },
+>(
   url: string,
   options: RequestInit & {
     params?: any;
@@ -98,7 +100,7 @@ export const customMutator = async <T = any>(
     throw new Error(`Request failed with status ${response.status}`);
   }
 
-  const response_data = await getBody<T>(response);
+  const response_data = await getBody<T["data"]>(response);
 
   // Transform ISO date strings to Date objects in the response data
   const transformedData = transformDates(response_data);

autogpt_platform/frontend/src/components/CustomNode.tsx

@@ -261,10 +261,11 @@ export const CustomNode = React.memo(
       const handleSSOLogin = async () => {
         setIsLoading(true);
         try {
-          const {
-            data: { sso_url },
-          } = await getV1GetAyrshareSsoUrl();
-          const popup = window.open(sso_url, "_blank", "popup=true");
+          const { data, status } = await getV1GetAyrshareSsoUrl();
+          if (status !== 200) {
+            throw new Error(data.detail);
+          }
+          const popup = window.open(data.sso_url, "_blank", "popup=true");
           if (!popup) {
             throw new Error(
               "Please allow popups for this site to be able to login with Ayrshare",

autogpt_platform/frontend/src/components/cron-scheduler-dialog.tsx

@@ -27,9 +27,12 @@ export function CronSchedulerDialog({
   const [scheduleName, setScheduleName] = useState<string>(defaultScheduleName);
 
   // Get user's timezone
-  const { data: timezoneData } = useGetV1GetUserTimezone();
-  const userTimezone = timezoneData?.data?.timezone || "UTC";
-  const timezoneDisplay = getTimezoneDisplayName(userTimezone);
+  const { data: userTimezone } = useGetV1GetUserTimezone({
+    query: {
+      select: (res) => (res.status === 200 ? res.data.timezone : undefined),
+    },
+  });
+  const timezoneDisplay = getTimezoneDisplayName(userTimezone || "UTC");
 
   // Reset state when dialog opens
   useEffect(() => {

autogpt_platform/frontend/src/components/layout/Navbar/components/AgentActivityDropdown/useAgentActivityDropdown.ts

@@ -44,7 +44,9 @@ export function useAgentActivityDropdown() {
     data: executions,
     isSuccess: executionsSuccess,
     error: executionsError,
-  } = useGetV1ListAllExecutions();
+  } = useGetV1ListAllExecutions({
+    query: { select: (res) => (res.status === 200 ? res.data : null) },
+  });
 
   // Create a map of library agents
   useEffect(() => {
@@ -112,7 +114,7 @@ export function useAgentActivityDropdown() {
   // Process initial execution state when data loads
   useEffect(() => {
     if (executions && executionsSuccess && agentInfoMap.size > 0) {
-      const notifications = categorizeExecutions(executions.data, agentInfoMap);
+      const notifications = categorizeExecutions(executions, agentInfoMap);
       setNotifications(notifications);
     }
   }, [executions, executionsSuccess, agentInfoMap]);

autogpt_platform/frontend/src/components/layout/Navbar/components/NavbarView.tsx

@@ -16,9 +16,7 @@ interface NavbarViewProps {
 export const NavbarView = ({ isLoggedIn }: NavbarViewProps) => {
   const { data: profile } = useGetV2GetUserProfile({
     query: {
-      select: (x) => {
-        return x.data;
-      },
+      select: (res) => (res.status === 200 ? res.data : null),
       enabled: isLoggedIn,
     },
   });

autogpt_platform/frontend/src/components/monitor/scheduleTable.tsx

@@ -65,8 +65,11 @@ export const SchedulesTable = ({
   const [selectedFilter, setSelectedFilter] = useState<string>(""); // Graph ID
 
   // Get user's timezone for displaying schedule times
-  const { data: timezoneData } = useGetV1GetUserTimezone();
-  const userTimezone = timezoneData?.data?.timezone || "UTC";
+  const { data: userTimezone } = useGetV1GetUserTimezone({
+    query: {
+      select: (res) => (res.status === 200 ? res.data.timezone : "UTC"),
+    },
+  });
 
   const filteredAndSortedSchedules = [...schedules]
     .filter(
@@ -259,7 +262,7 @@ export const SchedulesTable = ({
                   </TableCell>
                   <TableCell>
                     <span className="text-sm text-muted-foreground">
-                      {getTimezoneAbbreviation(userTimezone)}
+                      {userTimezone && getTimezoneAbbreviation(userTimezone)}
                     </span>
                   </TableCell>
                   <TableCell>

autogpt_platform/frontend/src/lib/timezone-utils.ts

@@ -71,14 +71,13 @@ export function getTimezoneAbbreviation(timezone: string): string {
  */
 export function formatScheduleTime(
   nextRunTime: string | Date,
-  displayTimezone: string,
+  displayTimezone: string = "UTC",
 ): string {
   const date =
     typeof nextRunTime === "string" ? new Date(nextRunTime) : nextRunTime;
 
   // Use provided timezone for display, fallback to UTC
-  const timezone = displayTimezone || "UTC";
-  const formatted = formatInTimezone(date, timezone, {
+  const formatted = formatInTimezone(date, displayTimezone, {
     month: "short",
     day: "numeric",
     hour: "2-digit",