Fix Google Auth and Registration flow

app/api/routes/auth.py

@@ -11,6 +11,7 @@ from app.core.security import create_access_token
 from app.db.repositories.user_repo import UserRepository
 from datetime import timedelta
 import uuid
+from app.core.logging import logger
 
 router = APIRouter()
 
@@ -35,17 +36,24 @@ async def login_google(request: Request):
             detail="Google OAuth is not configured on the server."
         )
 
-    # Always use the explicit setting — never derive from request.url
-    # (Hugging Face proxies strip https → causes redirect_uri mismatch)
+    # If settings.GOOGLE_REDIRECT_URI is set, use it. 
+    # Otherwise, derive it from the current request URL (base) + callback path.
     redirect_uri = settings.GOOGLE_REDIRECT_URI
+    if not redirect_uri:
+        # Construct redirect URI from the request base URL
+        base_url = str(request.base_url).rstrip('/')
+        # Ensure we use https if we are behind a proxy that terminates SSL
+        if "hf.space" in base_url or request.headers.get("x-forwarded-proto") == "https":
+            base_url = base_url.replace("http://", "https://")
+        redirect_uri = f"{base_url}/api/v1/auth/google/callback"
     
     logger.info(f"Initiating Google OAuth login")
     logger.info(f"Using Google Redirect URI: {redirect_uri}")
     logger.info(f"Request Host Header: {request.headers.get('host')}")
-    logger.info(f"Request X-Forwarded-Proto: {request.headers.get('x-forwarded-proto')}")
-
-    # Tell Authlib the real scheme so the state URL is correct too
-    request.scope["scheme"] = "https"
+    
+    # Ensure Authlib uses https for the state param if we are in production
+    if "https" in redirect_uri:
+        request.scope["scheme"] = "https"
 
     try:
         return await oauth.google.authorize_redirect(request, redirect_uri)
@@ -57,19 +65,22 @@ async def login_google(request: Request):
         )
 
 
-from app.core.logging import logger
-
 @router.get("/google/callback")
 async def auth_google(request: Request, db: Session = Depends(get_db)):
     """Gère le retour de Google après authentification"""
     logger.info("Google callback route reached")
     
-    # Ensure scheme is https for callback as well (important for Authlib internal state validation)
-    request.scope["scheme"] = "https"
-    
+    # Determine the redirect_uri used during the initial request
+    redirect_uri = settings.GOOGLE_REDIRECT_URI
+    if not redirect_uri:
+        base_url = str(request.base_url).rstrip('/')
+        if "hf.space" in base_url or request.headers.get("x-forwarded-proto") == "https":
+            base_url = base_url.replace("http://", "https://")
+            request.scope["scheme"] = "https"
+        redirect_uri = f"{base_url}/api/v1/auth/google/callback"
+
     try:
         logger.info(f"Callback full URL: {request.url}")
-        logger.info(f"Callback Params: {dict(request.query_params)}")
         
         token = await oauth.google.authorize_access_token(request)
         user_info = token.get('userinfo')
@@ -82,7 +93,7 @@ async def auth_google(request: Request, db: Session = Depends(get_db)):
             )
             
         email = user_info.get('email')
-        name = user_info.get('name') or email.split('@')[0] if email else "User"
+        name = user_info.get('name') or (email.split('@')[0] if email else "User")
         
         logger.info(f"Google login successful for email: {email}")
         
@@ -93,19 +104,10 @@ async def auth_google(request: Request, db: Session = Depends(get_db)):
                 detail="Email not provided by Google."
             )
             
-        user_repo = UserRepository(db)
-        user = user_repo.get_by_email(email)
+        from app.services.user_service import UserService
+        service = UserService(db)
+        user = service.register_user_oauth(email=email, name=name)
         
-        if not user:
-            logger.info(f"Creating new user for email: {email}")
-            user = user_repo.create_user(
-                email=email,
-                name=name,
-                hashed_password=None, # OAuth users don't have a local password
-                institution=None,
-                role="user"
-            )
-            
         access_token = create_access_token(
             data={"sub": str(user.id)},
             expires_delta=timedelta(minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES)

app/api/routes/users.py

@@ -38,6 +38,7 @@ async def create_user(user: UserCreate, db: Session = Depends(get_db)):
 @router.post("/register", response_model=dict, status_code=status.HTTP_201_CREATED)
 async def register(user: UserCreate, db: Session = Depends(get_db)):
     """Enregistre un nouvel utilisateur avec mot de passe"""
+    logger.info(f"Registering new user: {user.email}")
     try:
         service = UserService(db)
         new_user = service.register_user(
@@ -47,6 +48,7 @@ async def register(user: UserCreate, db: Session = Depends(get_db)):
             institution=user.institution,
             role=user.role
         )
+        logger.info(f"User registered successfully: {user.email}")
         return {
             "message": "User created successfully",
             "user": {
@@ -56,20 +58,29 @@ async def register(user: UserCreate, db: Session = Depends(get_db)):
             }
         }
     except ValueError as e:
+        logger.warning(f"Registration conflict for {user.email}: {str(e)}")
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
             detail=str(e)
         )
+    except Exception as e:
+        logger.error(f"Unexpected error during registration for {user.email}: {str(e)}", exc_info=True)
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Registration failed: {str(e)}"
+        )
 
 
 @router.post("/login", response_model=dict)
 async def login(user_login: UserLogin, db: Session = Depends(get_db)):
     """Connecte un utilisateur par email/password et retourne un JWT"""
+    logger.info(f"Login attempt for: {user_login.email}")
     try:
         service = UserService(db)
         user = service.login_user(user_login.email, user_login.password)
         
         if not user:
+            logger.warning(f"Failed login attempt for: {user_login.email}")
             raise HTTPException(
                 status_code=status.HTTP_401_UNAUTHORIZED,
                 detail="Invalid email or password."
@@ -79,12 +90,15 @@ async def login(user_login: UserLogin, db: Session = Depends(get_db)):
             data={"sub": str(user.id)},
             expires_delta=timedelta(minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES)
         )
+        logger.info(f"Successful login for: {user_login.email}")
         return {"access_token": token, "token_type": "bearer", "user": {"id": str(user.id), "name": user.name, "email": user.email}}
     except HTTPException:
         raise
     except Exception as e:
+        logger.error(f"Error during login for {user_login.email}: {str(e)}", exc_info=True)
         # Fallback to Demo Mode ONLY if explicitly enabled or for testing connection issues
         if ("OperationalError" in str(type(e)) or "connection" in str(e).lower()) and settings.ENVIRONMENT == "development":
+            logger.warning("Database unavailable. Falling back to Demo Mode for login.")
             mock_id = str(uuid.uuid4())
             token = create_access_token(
                 data={"sub": mock_id, "demo": True},
@@ -102,6 +116,7 @@ async def login(user_login: UserLogin, db: Session = Depends(get_db)):
 @router.post("/register-and-login", response_model=dict, status_code=status.HTTP_201_CREATED)
 async def register_and_login(user: UserCreate, db: Session = Depends(get_db)):
     """Enregistre un nouvel utilisateur et retourne un JWT directement"""
+    logger.info(f"Register-and-login attempt for: {user.email}")
     try:
         service = UserService(db)
         new_user = service.register_user(
@@ -115,12 +130,14 @@ async def register_and_login(user: UserCreate, db: Session = Depends(get_db)):
             data={"sub": str(new_user.id)},
             expires_delta=timedelta(minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES)
         )
+        logger.info(f"Successful register-and-login for: {user.email}")
         return {"access_token": token, "token_type": "bearer", "user": {"id": str(new_user.id), "name": new_user.name, "email": new_user.email}}
     except Exception as e:
-        logger.error(f"Registration error: {str(e)}")
+        logger.error(f"Registration error for {user.email}: {str(e)}")
         
         # Capture conflict errors (user already exists)
         if isinstance(e, ValueError) or "unique constraint" in str(e).lower() or "already exists" in str(e).lower():
+            logger.warning(f"Registration conflict: user {user.email} already exists")
             raise HTTPException(
                 status_code=status.HTTP_409_CONFLICT, 
                 detail="User with this email already exists."
@@ -144,7 +161,7 @@ async def register_and_login(user: UserCreate, db: Session = Depends(get_db)):
                 "mode": "demo"
             }
             
-        logger.exception("Unexpected error during registration")
+        logger.exception(f"Unexpected error during registration for {user.email}")
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
             detail=f"Registration failed: {str(e)}"

app/core/settings.py

@@ -76,7 +76,8 @@ class Settings(BaseSettings):
     # Google OAuth
     GOOGLE_CLIENT_ID: Optional[str] = None
     GOOGLE_CLIENT_SECRET: Optional[str] = None
-    GOOGLE_REDIRECT_URI: str = "https://dama12-scientific-backend.hf.space/api/v1/auth/google/callback"
+    # If not set, the app will try to construct it from the request URL
+    GOOGLE_REDIRECT_URI: Optional[str] = None
 
     model_config = SettingsConfigDict(
         env_file=".env",

app/services/user_service.py

@@ -24,6 +24,23 @@ class UserService:
         hashed_password = hash_password(password)
         return self.user_repo.create_user(email, name, hashed_password, institution, role)
     
+    def register_user_oauth(self, email: str, name: str):
+        """
+        Enregistre ou récupère un utilisateur via OAuth.
+        Si l'utilisateur n'existe pas, il est créé sans mot de passe.
+        """
+        user = self.user_repo.get_by_email(email)
+        if not user:
+            # Create new user for OAuth
+            user = self.user_repo.create_user(
+                email=email,
+                name=name,
+                hashed_password=None, # No local password for OAuth-only accounts
+                institution="OAuth",
+                role="user"
+            )
+        return user
+
     def login_user(self, email: str, password: str):
         """Connecte un utilisateur"""
         user = self.user_repo.authenticate(email, password)