Fix persistent auth so users stay logged in across refreshes and redeploys.

Persist JWT signing secrets under DATA_DIR when unset, validate stored sessions on app startup, and restore auth state synchronously from localStorage to avoid false re-login prompts.

Co-authored-by: Cursor <cursoragent@cursor.com>

multi_llm_chatbot_backend/app/config.py

@@ -215,6 +215,43 @@ class OrchestratorConfig(BaseModel):
         return self
 
 
+def resolve_jwt_secret(explicit: str = "") -> str:
+    """Resolve a stable JWT signing secret across restarts.
+
+    Precedence: config value → JWT_SECRET_KEY env → persisted file under
+    DATA_DIR (generated on first run) → insecure dev fallback.
+    """
+    if explicit and explicit.strip():
+        return explicit.strip()
+
+    env_secret = os.getenv("JWT_SECRET_KEY", "").strip()
+    if env_secret:
+        return env_secret
+
+    data_dir = Path(os.environ.get("DATA_DIR") or Path.home() / "data")
+    secret_path = data_dir / "jwt_secret"
+    try:
+        data_dir.mkdir(parents=True, exist_ok=True)
+        if secret_path.is_file():
+            stored = secret_path.read_text(encoding="utf-8").strip()
+            if stored:
+                return stored
+        import secrets
+
+        generated = secrets.token_urlsafe(48)
+        secret_path.write_text(generated, encoding="utf-8")
+        logger.info("Generated persistent JWT secret at %s", secret_path)
+        return generated
+    except OSError as exc:
+        logger.warning(
+            "Cannot persist JWT secret at %s (%s); using insecure default. "
+            "Set JWT_SECRET_KEY or auth.jwt_secret for production.",
+            secret_path,
+            exc,
+        )
+        return "your-secret-key-change-me"
+
+
 class AuthConfig(BaseModel):
     jwt_secret: str = Field(default=os.getenv("JWT_SECRET_KEY", ""))
     algorithm: str = "HS256"
@@ -222,11 +259,7 @@ class AuthConfig(BaseModel):
 
     @model_validator(mode="after")
     def _validate_jwt_secret(self):
-        if not self.jwt_secret:
-            logger.warning(
-                    "Insecure default JWT secret will be used. "
-                    "Set auth.jwt_secret in config.yaml for production use.")
-            self.jwt_secret = "your-secret-key-change-me"
+        self.jwt_secret = resolve_jwt_secret(self.jwt_secret)
         return self
 
 

multi_llm_chatbot_backend/app/core/auth.py

@@ -37,8 +37,9 @@ def create_access_token(data: dict, expires_delta: Optional[timedelta] = None):
         expire = datetime.utcnow() + expires_delta
     else:
         expire = datetime.utcnow() + timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
-    
-    to_encode.update({"exp": expire})
+
+    # JWT NumericDate must be a Unix timestamp (RFC 7519).
+    to_encode.update({"exp": int(expire.timestamp())})
     encoded_jwt = jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)
     return encoded_jwt
 

multi_llm_chatbot_backend/app/tests/unit/test_jwt_secret.py

@@ -0,0 +1,30 @@
+import os
+import tempfile
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+from app.config import resolve_jwt_secret
+
+
+class TestResolveJwtSecret(unittest.TestCase):
+    def test_prefers_explicit_config_value(self):
+        self.assertEqual(resolve_jwt_secret("from-config"), "from-config")
+
+    @patch.dict(os.environ, {"JWT_SECRET_KEY": "from-env"}, clear=False)
+    def test_uses_env_when_config_empty(self):
+        self.assertEqual(resolve_jwt_secret(""), "from-env")
+
+    def test_persists_generated_secret_to_data_dir(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            with patch.dict(os.environ, {"DATA_DIR": tmp, "JWT_SECRET_KEY": ""}, clear=False):
+                first = resolve_jwt_secret("")
+                second = resolve_jwt_secret("")
+                secret_path = Path(tmp) / "jwt_secret"
+                self.assertTrue(secret_path.is_file())
+                self.assertEqual(first, second)
+                self.assertGreater(len(first), 20)
+
+
+if __name__ == "__main__":
+    unittest.main()

phd-advisor-frontend/src/App.js

@@ -1,4 +1,4 @@
-import React, { useState, useEffect } from 'react';
+import React, { useState, useEffect, useCallback, useRef } from 'react';
 import { ThemeProvider } from './contexts/ThemeContext';
 import { AppConfigProvider } from './contexts/AppConfigContext';
 import HomePage from './pages/HomePage';
@@ -6,35 +6,88 @@ import ChatPage from './pages/ChatPage';
 import AuthPage from './pages/AuthPage';
 import CanvasPage from './pages/CanvasPage';
 import UserGuide from './components/UserGuide';
+import {
+  readStoredAuth,
+  persistAuth,
+  clearStoredAuth,
+  getApiBaseUrl,
+} from './utils/authStorage';
 import './styles/components.css';
 
 function App() {
-  const [currentView, setCurrentView] = useState('home');
-  const [isAuthenticated, setIsAuthenticated] = useState(false);
-  const [user, setUser] = useState(null);
-  const [authToken, setAuthToken] = useState(null);
+  const initialAuthRef = useRef(null);
+  if (initialAuthRef.current === null) {
+    initialAuthRef.current = readStoredAuth();
+  }
+  const initialAuth = initialAuthRef.current;
+  const [currentView, setCurrentView] = useState(initialAuth ? 'chat' : 'home');
+  const [isAuthenticated, setIsAuthenticated] = useState(Boolean(initialAuth));
+  const [user, setUser] = useState(initialAuth?.user ?? null);
+  const [authToken, setAuthToken] = useState(initialAuth?.token ?? null);
+  const [authBootstrapping, setAuthBootstrapping] = useState(Boolean(initialAuth));
 
-  // Check for existing authentication on app start
+  const clearAuthState = useCallback(() => {
+    clearStoredAuth();
+    setUser(null);
+    setAuthToken(null);
+    setIsAuthenticated(false);
+    setCurrentView('home');
+  }, []);
+
+  // Re-validate stored credentials on startup so stale tokens are cleared
+  // and profile data stays fresh after refresh.
   useEffect(() => {
-    const token = localStorage.getItem('authToken');
-    const userData = localStorage.getItem('user');
-    
-    if (token && userData) {
+    if (!initialAuth) {
+      return;
+    }
+
+    let cancelled = false;
+
+    const validateStoredSession = async () => {
       try {
-        const parsedUser = JSON.parse(userData);
-        setAuthToken(token);
-        setUser(parsedUser);
-        setIsAuthenticated(true);
-        setCurrentView('chat');
-      } catch (error) {
-        // Clear invalid data
-        localStorage.removeItem('authToken');
-        localStorage.removeItem('user');
+        const response = await fetch(`${getApiBaseUrl()}/auth/me`, {
+          headers: { Authorization: `Bearer ${initialAuth.token}` },
+        });
+
+        if (cancelled) {
+          return;
+        }
+
+        if (response.ok) {
+          const freshUser = await response.json();
+          persistAuth(freshUser, initialAuth.token);
+          setUser(freshUser);
+          setAuthToken(initialAuth.token);
+          setIsAuthenticated(true);
+          return;
+        }
+
+        if (response.status === 401 || response.status === 403) {
+          clearAuthState();
+        }
+      } catch {
+        // Keep the cached session on transient network errors so refresh
+        // does not force re-login when the API is briefly unavailable.
+      } finally {
+        if (!cancelled) {
+          setAuthBootstrapping(false);
+        }
       }
-    }
-  }, []);
+    };
+
+    validateStoredSession();
+
+    return () => {
+      cancelled = true;
+    };
+  }, [initialAuth, clearAuthState]);
+
+  const sessionReady = isAuthenticated && !authBootstrapping;
 
   const navigateToAuth = () => {
+    if (authBootstrapping) {
+      return;
+    }
     setCurrentView('auth');
   };
 
@@ -49,44 +102,44 @@ function App() {
     setCurrentView('chat');
   };
 
-  
-
   const navigateToHome = () => {
     setCurrentView('home');
   };
 
   const handleAuthSuccess = (userData, token) => {
+    persistAuth(userData, token);
     setUser(userData);
     setAuthToken(token);
     setIsAuthenticated(true);
+    setAuthBootstrapping(false);
     setCurrentView('chat');
   };
 
   const handleSignOut = () => {
-    localStorage.removeItem('authToken');
-    localStorage.removeItem('user');
-    setUser(null);
-    setAuthToken(null);
-    setIsAuthenticated(false);
-    setCurrentView('home');
+    clearAuthState();
   };
 
   return (
     <AppConfigProvider>
       <ThemeProvider>
         <div className="App">
+          {authBootstrapping && (
+            <div className="auth-bootstrap-overlay" aria-live="polite">
+              Restoring your session...
+            </div>
+          )}
           {currentView === 'home' && (
             <HomePage
               onNavigateToHome={navigateToHome}
-              onNavigateToChat={isAuthenticated ? navigateToChat : navigateToAuth}
-              onNavigateToCanvas={isAuthenticated ? navigateToCanvas : navigateToAuth}
-              isAuthenticated={isAuthenticated}
+              onNavigateToChat={sessionReady ? navigateToChat : navigateToAuth}
+              onNavigateToCanvas={sessionReady ? navigateToCanvas : navigateToAuth}
+              isAuthenticated={sessionReady}
             />
           )}
-          {currentView === 'auth' && (
+          {currentView === 'auth' && !sessionReady && (
             <AuthPage onAuthSuccess={handleAuthSuccess} />
           )}
-          {currentView === 'canvas' && isAuthenticated && (
+          {currentView === 'canvas' && sessionReady && (
             <CanvasPage
               user={user}
               authToken={authToken}
@@ -95,7 +148,7 @@ function App() {
               onSignOut={handleSignOut}
             />
           )}
-          {currentView === 'chat' && isAuthenticated && (
+          {currentView === 'chat' && sessionReady && (
             <ChatPage
               user={user}
               authToken={authToken}
@@ -104,7 +157,6 @@ function App() {
               onSignOut={handleSignOut}
             />
           )}
-          {/* Global help center — listens for the 'open-user-guide' event */}
           <UserGuide />
         </div>
       </ThemeProvider>

phd-advisor-frontend/src/components/Login.js

@@ -1,6 +1,7 @@
 import React, { useState } from 'react';
 import { Eye, EyeOff, Mail, Lock, ArrowRight, BookOpen, Phone } from 'lucide-react';
 import { useAppConfig } from '../contexts/AppConfigContext';
+import { persistAuth } from '../utils/authStorage';
 import CopyrightNotice from './CopyrightNotice';
 import '../styles/Login.css';
 
@@ -70,9 +71,7 @@ const Login = ({ onNavigateToSignup, onNavigateToHome }) => {
       const data = await response.json();
 
       if (response.ok) {
-        // Store the token and user info
-        localStorage.setItem('authToken', data.access_token);
-        localStorage.setItem('user', JSON.stringify(data.user));
+        persistAuth(data.user, data.access_token);
         onNavigateToHome?.(data.user, data.access_token);
       } else {
         setErrors({ submit: data.detail || 'Login failed. Please try again.' });

phd-advisor-frontend/src/components/Signup.js

@@ -1,6 +1,7 @@
 import React, { useState } from 'react';
 import { Eye, EyeOff, Mail, Lock, User, ArrowRight, Shield, Phone, Globe } from 'lucide-react';
 import { useAppConfig } from '../contexts/AppConfigContext';
+import { persistAuth } from '../utils/authStorage';
 import '../styles/Signup.css';
 
 const Signup = ({ onNavigateToLogin, onNavigateToHome }) => {
@@ -116,9 +117,7 @@ const Signup = ({ onNavigateToLogin, onNavigateToHome }) => {
       const data = await response.json();
 
       if (response.ok) {
-        // Store the token and user info
-        localStorage.setItem('authToken', data.access_token);
-        localStorage.setItem('user', JSON.stringify(data.user));
+        persistAuth(data.user, data.access_token);
         onNavigateToHome?.(data.user, data.access_token);
       } else {
         setErrors({ submit: data.detail || 'Signup failed. Please try again.' });

phd-advisor-frontend/src/styles/components.css

@@ -1293,4 +1293,18 @@
     text-overflow: initial;
   }
 
+}
+
+.auth-bootstrap-overlay {
+  position: fixed;
+  inset: 0;
+  z-index: 9999;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  background: rgba(255, 255, 255, 0.72);
+  color: var(--text-primary, #111827);
+  font-size: 0.95rem;
+  font-weight: 500;
+  pointer-events: none;
 }

phd-advisor-frontend/src/utils/authStorage.js

@@ -0,0 +1,31 @@
+const AUTH_TOKEN_KEY = 'authToken';
+const USER_KEY = 'user';
+
+export function readStoredAuth() {
+  const token = localStorage.getItem(AUTH_TOKEN_KEY);
+  const userData = localStorage.getItem(USER_KEY);
+  if (!token || !userData) {
+    return null;
+  }
+
+  try {
+    return { token, user: JSON.parse(userData) };
+  } catch {
+    clearStoredAuth();
+    return null;
+  }
+}
+
+export function persistAuth(user, token) {
+  localStorage.setItem(AUTH_TOKEN_KEY, token);
+  localStorage.setItem(USER_KEY, JSON.stringify(user));
+}
+
+export function clearStoredAuth() {
+  localStorage.removeItem(AUTH_TOKEN_KEY);
+  localStorage.removeItem(USER_KEY);
+}
+
+export function getApiBaseUrl() {
+  return process.env.REACT_APP_API_URL || '';
+}