Authentication Fix Summary

Date: January 2025
Issue: Subscription status endpoint being called without authentication credentials
Status: ✅ Fixed

Problem

The /api/subscription/status/{user_id} endpoint was being called by SubscriptionContext before authentication was ready, causing 401 errors in logs:

ERROR | middleware.auth_middleware:get_current_user:242 - 🔒 AUTHENTICATION ERROR: 
No credentials provided for authenticated endpoint: GET /api/subscription/status/user_33Gz1FPI86VDXhRY8QN4ragRFGN

Root Cause

Race Condition: SubscriptionContext was making API calls before the authTokenGetter was installed by TokenInstaller in App.tsx. The apiClient interceptor needs authTokenGetter to be set before it can add authentication tokens to requests.

Solution

1. Improved Authentication Wait Logic

File: frontend/src/contexts/SubscriptionContext.tsx

Added proper wait logic for authentication to be ready
Checks for user_id in localStorage (indicates user is authenticated)
Waits up to 2 seconds for authTokenGetter to be installed
Skips API call if authentication is not ready (prevents 401 errors)

2. Enhanced Error Messages

File: backend/middleware/auth_middleware.py

Added caller function name and module name to error messages
Added user agent information
Better debugging information for authentication failures

New Error Format:

🔒 AUTHENTICATION ERROR: No credentials provided for authenticated endpoint: GET /api/subscription/status/...
(client_ip=127.0.0.1, caller=routers.subscription.get_user_subscription_status, user_agent=Mozilla/5.0...)

Verification

All Product Marketing Endpoints Require Authentication ✅

All endpoints in backend/routers/product_marketing.py use Depends(get_current_user):

✅ Campaign endpoints
✅ Asset generation endpoints
✅ Product image/video/avatar endpoints
✅ Templates endpoints
✅ Brand DNA endpoints

Subscription Endpoint Requires Authentication ✅

The /api/subscription/status/{user_id} endpoint requires authentication:

✅ Uses Depends(get_current_user)
✅ Verifies user can only access their own data
✅ Properly protected

Testing

Before Fix: SubscriptionContext would call API before auth ready → 401 errors
After Fix: SubscriptionContext waits for auth → No 401 errors during initialization

Impact

✅ No more 401 errors in logs during app initialization
✅ Better error messages for debugging authentication issues
✅ All endpoints properly authenticated
✅ Improved user experience (no failed API calls)

Last Updated: January 2025
Status: Fixed and Verified

2.7 KiB Raw Blame History