naman_panwar_gnpl/pragativeer-v2
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(auth): restrict seeded credentials exclusively to super admin and demo student in backend and api documentation

Browse Source
This commit is contained in:
ectasy663
2026-09-04 12:01:02 +05:30
parent 3ad281aae6
commit 5951ab5b3f
3 changed files with 48 additions and 84 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
API_DOCUMENTATION.md
View File

@@ -169,7 +169,7 @@ FastAPI dependency `require_tier(allowed_tiers: List[models.TierEnum])` inspects
- **Request Headers:**
- `Accept: application/json`
- **Request Query Parameters:**
- `phone_or_email` (string, required): e.g. `9876543210` or `student@pragativeer.com`
- `phone_or_email` (string, required): e.g. `9876543210` or `demo@pragativeer.com`
- **Response Headers:**
- `Content-Type: application/json`
- **Status Codes & Response Payloads:**
@@ -233,7 +233,7 @@ PragatiVeer v2 enforces a strict single-device login policy:
{
"id": "b0e17378-864d-439e-8806-708dc48a891b",
"phone": "9999999999",
"email": "student@pragativeer.com",
"email": "demo@pragativeer.com",
"name": "Rahul Sharma",
"student_class": "12",
"medium": "English",
@@ -1156,7 +1156,7 @@ All Admin endpoints require superadmin access:
- **Request Body Schema:**
```json
{
"email": "student@pragativeer.com"
"email": "demo@pragativeer.com"
}
```
- **Response Headers:**
@@ -1205,15 +1205,12 @@ The following endpoints are specified in [PRD.md](file:///c:/Users/naman/OneDriv
| **Study Materials Library** | `GET /api/materials` | [materials/page.tsx](file:///c:/Users/naman/OneDrive/Desktop/pragativeer-v2/src/app/dashboard/materials/page.tsx) | MinIO PDF formula sheet catalog and access controls |
| **Voice AI & Live Battle** | `/ws/battles`, `/api/ai-coach/voice` | Future Scope | WebSockets for multiplayer CBT battles & Whisper voice |
---
## 5. Seeded Credentials Reference
The platform provides two pre-configured accounts for administration and end-to-end evaluation:
| Role | Email | Password | Tier / Features |
| :--- | :--- | :--- | :--- |
| **AI Coach Student** | `demo@pragativeer.com` | `Pv9#kL2$mQ8!vX4@` | AI Coach (AI Tutor, College Predictor, Spaced Repetition) |
| **AI Coach Student** | `student@pragativeer.com` | `Password123!` | Rahul Sharma (Default AI Coach Profile) |
| **AI Coach Student** | `neha@pragativeer.com` | `Password123!` | Neha Verma (62-Day Streak presentation account) |
| **Pro Tier Student** | `pro@pragativeer.com` | `Password123!` | Priya Singh (Pro Tier, Full CBT engine access) |
| **Free Tier Student** | `free@pragativeer.com` | `Password123!` | Amit Kumar (Free Tier, baseline practice) |
| **Super Admin** | `admin@pragativeer.com` | `admin123` | Full access to `/admin` management console |
| **Super Admin** | `admin@pragativeer.com` | `admin123` | Full access to `/admin` management console & question bank |
| **AI Coach Student** | `demo@pragativeer.com` | `Pv9#kL2$mQ8!vX4@` | Full AI Coach access (AI Tutor SSE stream, College Predictor, CBT Mock Engine, Spaced Repetition) |

6
backend/main.py
View File

@@ -125,7 +125,11 @@ def login(payload: LoginPayload, session: Session = Depends(get_session)):
# Allow demo/admin mock logic to still work if needed
if payload.email == "demo@pragativeer.com" and payload.password == "Pv9#kL2$mQ8!vX4@":
demo_user = session.exec(select(models.User).where(models.User.email == "student@pragativeer.com")).first()
demo_user = session.exec(select(models.User).where((models.User.email == "demo@pragativeer.com") | (models.User.email == "student@pragativeer.com"))).first()
if demo_user and demo_user.email != "demo@pragativeer.com":
demo_user.email = "demo@pragativeer.com"
session.add(demo_user)
session.commit()
token_id = str(demo_user.id) if demo_user else "b0e17378-864d-439e-8806-708dc48a891b"
return {"success": True, "role": "user", "token": token_id}
if payload.email == "admin@pragativeer.com" and payload.password == "admin123":

107
backend/seed.py
View File

@@ -28,110 +28,73 @@ def seed_local_database():
print("Seeding baseline content entities...")
with Session(engine) as session:
# 0. Create the baseline student users (Free, Pro, AI Coach)
free_student_id = UUID("11111111-1111-1111-1111-111111111111")
free_student = models.User(
id=free_student_id,
phone="8888888888",
email="free@pragativeer.com",
password_hash=DEFAULT_SEED_HASH,
name="Amit Kumar (Free Tier)",
# 1. Super Admin User
admin_id = UUID("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa")
admin_user = models.User(
id=admin_id,
phone="9999999998",
email="admin@pragativeer.com",
password_hash=bcrypt.hashpw("admin123".encode('utf-8'), bcrypt.gensalt()).decode('utf-8'),
name="Super Admin",
student_class=models.ClassEnum.TWELFTH,
medium=models.MediumEnum.ENGLISH,
target_exam=models.ExamEnum.JEE_MAIN,
city="Patna",
state="Bihar",
tier=models.TierEnum.FREE,
streak_count=1,
city="New Delhi",
state="Delhi",
tier=models.TierEnum.AI_COACH,
streak_count=0,
last_active=datetime.utcnow()
)
session.add(free_student)
session.add(admin_user)
pro_student_id = UUID("22222222-2222-2222-2222-222222222222")
pro_student = models.User(
id=pro_student_id,
phone="7777777777",
email="pro@pragativeer.com",
password_hash=DEFAULT_SEED_HASH,
name="Priya Singh (Pro Tier)",
# 2. AI Coach Demo Student User
student_id = UUID("b0e17378-864d-439e-8806-708dc48a891b")
student_user = models.User(
id=student_id,
phone="9999999999",
email="demo@pragativeer.com",
password_hash=bcrypt.hashpw("Pv9#kL2$mQ8!vX4@".encode('utf-8'), bcrypt.gensalt()).decode('utf-8'),
name="Rahul Sharma (Demo AI Coach)",
student_class=models.ClassEnum.TWELFTH,
medium=models.MediumEnum.ENGLISH,
target_exam=models.ExamEnum.NEET,
city="Kota",
state="Rajasthan",
tier=models.TierEnum.PRO,
streak_count=3,
last_active=datetime.utcnow()
)
session.add(pro_student)
# Neha Verma — full AI Coach demo profile for manager presentations
neha_id = UUID("33333333-3333-3333-3333-333333333333")
neha_student = models.User(
id=neha_id,
phone="6666666666",
email="neha@pragativeer.com",
password_hash=DEFAULT_SEED_HASH,
name="Neha Verma",
student_class=models.ClassEnum.TWELFTH,
medium=models.MediumEnum.ENGLISH,
target_exam=models.ExamEnum.NEET,
target_exam=models.ExamEnum.JEE_MAIN,
school="Delhi Public School, R.K. Puram",
city="New Delhi",
state="Delhi",
tier=models.TierEnum.AI_COACH,
trial_end=None,
subscription_end=datetime.utcnow() + timedelta(days=345),
streak_count=62,
longest_streak=62,
streak_count=6,
longest_streak=6,
last_active=datetime.utcnow()
)
session.add(neha_student)
session.add(student_user)
# Seed Neha's Subscription record
neha_subscription = models.Subscription(
# Seed Demo Student Subscription record
demo_subscription = models.Subscription(
id=uuid4(),
user_id=neha_id,
user_id=student_id,
tier=models.TierEnum.AI_COACH,
billing_cycle="Annual",
start_date=datetime.utcnow() - timedelta(days=20),
end_date=datetime.utcnow() + timedelta(days=345),
amount=1199900, # ₹11,999 in paise
payment_id="PAY_NEHA_DEMO_001",
amount=1199900,
payment_id="PAY_DEMO_001",
status="Active",
auto_renew=True,
)
session.add(neha_subscription)
session.add(demo_subscription)
# Seed Neha's Transaction record
neha_txn = models.Transaction(
# Seed Demo Student Transaction record
demo_txn = models.Transaction(
id=uuid4(),
user_id=neha_id,
user_id=student_id,
amount=11999.0,
tier="Al_Coach",
status="Success",
created_at=datetime.utcnow() - timedelta(days=20),
)
session.add(neha_txn)
student_id = UUID("b0e17378-864d-439e-8806-708dc48a891b")
student_user = models.User(
id=student_id,
phone="9999999999",
email="student@pragativeer.com",
password_hash=DEFAULT_SEED_HASH,
name="Rahul Sharma (AI Coach Tier)",
student_class=models.ClassEnum.TWELFTH,
medium=models.MediumEnum.ENGLISH,
target_exam=models.ExamEnum.JEE_MAIN,
city="New Delhi",
state="Delhi",
tier=models.TierEnum.AI_COACH,
streak_count=5,
last_active=datetime.utcnow()
)
session.add(student_user)
session.add(demo_txn)
admin_id = uuid4()