From 5951ab5b3f20447f64a37cad87a334be50fcd82a Mon Sep 17 00:00:00 2001 From: ectasy663 Date: Fri, 4 Sep 2026 12:01:02 +0530 Subject: [PATCH] fix(auth): restrict seeded credentials exclusively to super admin and demo student in backend and api documentation --- API_DOCUMENTATION.md | 19 ++++---- backend/main.py | 6 ++- backend/seed.py | 107 ++++++++++++++----------------------------- 3 files changed, 48 insertions(+), 84 deletions(-) diff --git a/API_DOCUMENTATION.md b/API_DOCUMENTATION.md index 5cd6792..27c8425 100644 --- a/API_DOCUMENTATION.md +++ b/API_DOCUMENTATION.md @@ -169,7 +169,7 @@ FastAPI dependency `require_tier(allowed_tiers: List[models.TierEnum])` inspects - **Request Headers:** - `Accept: application/json` - **Request Query Parameters:** - - `phone_or_email` (string, required): e.g. `9876543210` or `student@pragativeer.com` + - `phone_or_email` (string, required): e.g. `9876543210` or `demo@pragativeer.com` - **Response Headers:** - `Content-Type: application/json` - **Status Codes & Response Payloads:** @@ -233,7 +233,7 @@ PragatiVeer v2 enforces a strict single-device login policy: { "id": "b0e17378-864d-439e-8806-708dc48a891b", "phone": "9999999999", - "email": "student@pragativeer.com", + "email": "demo@pragativeer.com", "name": "Rahul Sharma", "student_class": "12", "medium": "English", @@ -1156,7 +1156,7 @@ All Admin endpoints require superadmin access: - **Request Body Schema:** ```json { - "email": "student@pragativeer.com" + "email": "demo@pragativeer.com" } ``` - **Response Headers:** @@ -1205,15 +1205,12 @@ The following endpoints are specified in [PRD.md](file:///c:/Users/naman/OneDriv | **Study Materials Library** | `GET /api/materials` | [materials/page.tsx](file:///c:/Users/naman/OneDrive/Desktop/pragativeer-v2/src/app/dashboard/materials/page.tsx) | MinIO PDF formula sheet catalog and access controls | | **Voice AI & Live Battle** | `/ws/battles`, `/api/ai-coach/voice` | Future Scope | WebSockets for multiplayer CBT battles & Whisper voice | ---- - ## 5. Seeded Credentials Reference +The platform provides two pre-configured accounts for administration and end-to-end evaluation: + | Role | Email | Password | Tier / Features | | :--- | :--- | :--- | :--- | -| **AI Coach Student** | `demo@pragativeer.com` | `Pv9#kL2$mQ8!vX4@` | AI Coach (AI Tutor, College Predictor, Spaced Repetition) | -| **AI Coach Student** | `student@pragativeer.com` | `Password123!` | Rahul Sharma (Default AI Coach Profile) | -| **AI Coach Student** | `neha@pragativeer.com` | `Password123!` | Neha Verma (62-Day Streak presentation account) | -| **Pro Tier Student** | `pro@pragativeer.com` | `Password123!` | Priya Singh (Pro Tier, Full CBT engine access) | -| **Free Tier Student** | `free@pragativeer.com` | `Password123!` | Amit Kumar (Free Tier, baseline practice) | -| **Super Admin** | `admin@pragativeer.com` | `admin123` | Full access to `/admin` management console | +| **Super Admin** | `admin@pragativeer.com` | `admin123` | Full access to `/admin` management console & question bank | +| **AI Coach Student** | `demo@pragativeer.com` | `Pv9#kL2$mQ8!vX4@` | Full AI Coach access (AI Tutor SSE stream, College Predictor, CBT Mock Engine, Spaced Repetition) | + diff --git a/backend/main.py b/backend/main.py index b561846..e13acc4 100644 --- a/backend/main.py +++ b/backend/main.py @@ -125,7 +125,11 @@ def login(payload: LoginPayload, session: Session = Depends(get_session)): # Allow demo/admin mock logic to still work if needed if payload.email == "demo@pragativeer.com" and payload.password == "Pv9#kL2$mQ8!vX4@": - demo_user = session.exec(select(models.User).where(models.User.email == "student@pragativeer.com")).first() + demo_user = session.exec(select(models.User).where((models.User.email == "demo@pragativeer.com") | (models.User.email == "student@pragativeer.com"))).first() + if demo_user and demo_user.email != "demo@pragativeer.com": + demo_user.email = "demo@pragativeer.com" + session.add(demo_user) + session.commit() token_id = str(demo_user.id) if demo_user else "b0e17378-864d-439e-8806-708dc48a891b" return {"success": True, "role": "user", "token": token_id} if payload.email == "admin@pragativeer.com" and payload.password == "admin123": diff --git a/backend/seed.py b/backend/seed.py index ff21350..3bca454 100644 --- a/backend/seed.py +++ b/backend/seed.py @@ -28,110 +28,73 @@ def seed_local_database(): print("Seeding baseline content entities...") with Session(engine) as session: - # 0. Create the baseline student users (Free, Pro, AI Coach) - free_student_id = UUID("11111111-1111-1111-1111-111111111111") - free_student = models.User( - id=free_student_id, - phone="8888888888", - email="free@pragativeer.com", - password_hash=DEFAULT_SEED_HASH, - name="Amit Kumar (Free Tier)", + # 1. Super Admin User + admin_id = UUID("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa") + admin_user = models.User( + id=admin_id, + phone="9999999998", + email="admin@pragativeer.com", + password_hash=bcrypt.hashpw("admin123".encode('utf-8'), bcrypt.gensalt()).decode('utf-8'), + name="Super Admin", student_class=models.ClassEnum.TWELFTH, medium=models.MediumEnum.ENGLISH, target_exam=models.ExamEnum.JEE_MAIN, - city="Patna", - state="Bihar", - tier=models.TierEnum.FREE, - streak_count=1, + city="New Delhi", + state="Delhi", + tier=models.TierEnum.AI_COACH, + streak_count=0, last_active=datetime.utcnow() ) - session.add(free_student) + session.add(admin_user) - pro_student_id = UUID("22222222-2222-2222-2222-222222222222") - pro_student = models.User( - id=pro_student_id, - phone="7777777777", - email="pro@pragativeer.com", - password_hash=DEFAULT_SEED_HASH, - name="Priya Singh (Pro Tier)", + # 2. AI Coach Demo Student User + student_id = UUID("b0e17378-864d-439e-8806-708dc48a891b") + student_user = models.User( + id=student_id, + phone="9999999999", + email="demo@pragativeer.com", + password_hash=bcrypt.hashpw("Pv9#kL2$mQ8!vX4@".encode('utf-8'), bcrypt.gensalt()).decode('utf-8'), + name="Rahul Sharma (Demo AI Coach)", student_class=models.ClassEnum.TWELFTH, medium=models.MediumEnum.ENGLISH, - target_exam=models.ExamEnum.NEET, - city="Kota", - state="Rajasthan", - tier=models.TierEnum.PRO, - streak_count=3, - last_active=datetime.utcnow() - ) - session.add(pro_student) - - # Neha Verma — full AI Coach demo profile for manager presentations - neha_id = UUID("33333333-3333-3333-3333-333333333333") - neha_student = models.User( - id=neha_id, - phone="6666666666", - email="neha@pragativeer.com", - password_hash=DEFAULT_SEED_HASH, - name="Neha Verma", - student_class=models.ClassEnum.TWELFTH, - medium=models.MediumEnum.ENGLISH, - target_exam=models.ExamEnum.NEET, + target_exam=models.ExamEnum.JEE_MAIN, school="Delhi Public School, R.K. Puram", city="New Delhi", state="Delhi", tier=models.TierEnum.AI_COACH, trial_end=None, subscription_end=datetime.utcnow() + timedelta(days=345), - streak_count=62, - longest_streak=62, + streak_count=6, + longest_streak=6, last_active=datetime.utcnow() ) - session.add(neha_student) + session.add(student_user) - # Seed Neha's Subscription record - neha_subscription = models.Subscription( + # Seed Demo Student Subscription record + demo_subscription = models.Subscription( id=uuid4(), - user_id=neha_id, + user_id=student_id, tier=models.TierEnum.AI_COACH, billing_cycle="Annual", start_date=datetime.utcnow() - timedelta(days=20), end_date=datetime.utcnow() + timedelta(days=345), - amount=1199900, # ₹11,999 in paise - payment_id="PAY_NEHA_DEMO_001", + amount=1199900, + payment_id="PAY_DEMO_001", status="Active", auto_renew=True, ) - session.add(neha_subscription) + session.add(demo_subscription) - # Seed Neha's Transaction record - neha_txn = models.Transaction( + # Seed Demo Student Transaction record + demo_txn = models.Transaction( id=uuid4(), - user_id=neha_id, + user_id=student_id, amount=11999.0, tier="Al_Coach", status="Success", created_at=datetime.utcnow() - timedelta(days=20), ) - session.add(neha_txn) - - - student_id = UUID("b0e17378-864d-439e-8806-708dc48a891b") - student_user = models.User( - id=student_id, - phone="9999999999", - email="student@pragativeer.com", - password_hash=DEFAULT_SEED_HASH, - name="Rahul Sharma (AI Coach Tier)", - student_class=models.ClassEnum.TWELFTH, - medium=models.MediumEnum.ENGLISH, - target_exam=models.ExamEnum.JEE_MAIN, - city="New Delhi", - state="Delhi", - tier=models.TierEnum.AI_COACH, - streak_count=5, - last_active=datetime.utcnow() - ) - session.add(student_user) + session.add(demo_txn) admin_id = uuid4()