feat(api): React-ready auth + profile endpoints + CORS

- auth_api.py: verify the frontend's bearer JWT (Supabase HS256 by default;
  provider-agnostic verify_token seam), get-or-create the control-plane user, and
  expose GET /me, GET/POST /profiles (tenant-scoped to the logged-in user).
- main.py: CORS middleware (FRONTEND_ORIGINS) + auth router.
- requirements: pyjwt (lazy-imported). .env.example: SUPABASE_JWT_SECRET, FRONTEND_ORIGINS.
- +4 tests (401 without bearer, user auto-create, profile create/list scoping, CORS
  header). Suite 172/172.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: HR-coding

.env.example

@@ -25,6 +25,10 @@ AGENT_REQUIRE_SIGNATURE=1                           # 1 in prod (signed-request
 CONTROL_ENC_KEY=                                   # 🔑 Fernet key (encrypts OAuth tokens)
 POLL_TOKEN=                                         # 🔑 guards /internal/poll (free-tier external cron)
 
+# ── Frontend (React) + auth provider ──
+FRONTEND_ORIGINS=http://localhost:5173,https://your-app.vercel.app   # CORS allow-list
+SUPABASE_JWT_SECRET=                               # 🔑 verifies the frontend's login JWT
+
 # ── Google OAuth client file (per-user web flow in prod) ──
 GOOGLE_CREDENTIALS_FILE=/etc/secrets/credentials.json   # Render Secret File path; defaults to ./credentials.json
 # GOOGLE_TOKEN_FILE=./token.json                   # single-user dev fallback only

app/main.py

@@ -1,7 +1,10 @@
+import os
 from contextlib import asynccontextmanager
 from fastapi import FastAPI
+from fastapi.middleware.cors import CORSMiddleware
 from app.orchestrator.gateway import router as gateway_router
 from app.orchestrator.feedback_api import router as feedback_router
+from app.orchestrator.auth_api import router as auth_router
 from app.core.db_initializer import initialize_database
 
 
@@ -12,8 +15,22 @@ async def lifespan(app: FastAPI):
 
 
 app = FastAPI(title="Tax Agent API", version="1.0.0", lifespan=lifespan)
+
+# CORS for the React frontend (set FRONTEND_ORIGINS to your deployed origins).
+_origins = os.getenv(
+    "FRONTEND_ORIGINS", "http://localhost:5173,http://localhost:3000"
+).split(",")
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=[o.strip() for o in _origins if o.strip()],
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
+
 app.include_router(gateway_router)
 app.include_router(feedback_router)
+app.include_router(auth_router)
 
 
 @app.get("/")

app/orchestrator/auth_api.py

@@ -0,0 +1,83 @@
+"""
+Frontend-facing auth + profile API (React-ready).
+
+The React app authenticates the user with the auth provider (Supabase by default)
+and sends its JWT as `Authorization: Bearer <token>`. We verify it, get-or-create
+the matching control-plane user, and expose the endpoints the UI needs:
+
+  GET  /me          -> current user + their profiles
+  GET  /profiles    -> list profiles
+  POST /profiles    -> create a profile (self / spouse / ...)
+
+Provider-agnostic: swap verify_token() for Firebase/Clerk if you change providers.
+"""
+import os
+from typing import Optional
+from fastapi import APIRouter, Depends, Header, HTTPException
+from pydantic import BaseModel
+
+router = APIRouter()
+
+
+def verify_token(token: str) -> dict:
+    """Verify a Supabase JWT (HS256) and return {id, email}. Fail closed."""
+    secret = os.getenv("SUPABASE_JWT_SECRET")
+    if not secret:
+        raise HTTPException(status_code=503, detail="Auth is not configured")
+    import jwt  # lazy: only needed when actually verifying
+    try:
+        claims = jwt.decode(token, secret, algorithms=["HS256"], audience="authenticated")
+    except Exception:
+        raise HTTPException(status_code=401, detail="Invalid or expired token")
+    return {"id": claims.get("sub"), "email": claims.get("email")}
+
+
+def get_current_user(authorization: Optional[str] = Header(None)) -> dict:
+    """FastAPI dependency: verify the bearer token and resolve our control-plane user."""
+    if not authorization or not authorization.lower().startswith("bearer "):
+        raise HTTPException(status_code=401, detail="Missing bearer token")
+    claims = verify_token(authorization.split(" ", 1)[1])
+    email = claims.get("email")
+    if not email:
+        raise HTTPException(status_code=401, detail="Token has no email")
+
+    from app.core import identity
+    user = identity.get_user_by_email(email)
+    if not user:
+        identity.create_user(email)
+        user = identity.get_user_by_email(email)
+    return {"user_id": user.id, "email": email}
+
+
+def _profile_dto(p):
+    return {"id": p.id, "display_name": p.display_name, "relation": p.relation,
+            "itr_type": p.itr_type, "drive_folder_id": p.drive_folder_id}
+
+
+@router.get("/me")
+def me(user: dict = Depends(get_current_user)):
+    from app.core import identity
+    profiles = identity.list_profiles(user["user_id"])
+    return {"user": user, "profiles": [_profile_dto(p) for p in profiles]}
+
+
+@router.get("/profiles")
+def list_profiles(user: dict = Depends(get_current_user)):
+    from app.core import identity
+    return [_profile_dto(p) for p in identity.list_profiles(user["user_id"])]
+
+
+class ProfileIn(BaseModel):
+    display_name: str
+    relation: str = "self"          # self | spouse | dependent | other
+    itr_type: str = "ITR1"
+    drive_folder_id: str = ""
+
+
+@router.post("/profiles")
+def create_profile(body: ProfileIn, user: dict = Depends(get_current_user)):
+    from app.core import identity
+    pid = identity.create_profile(
+        user["user_id"], body.display_name, relation=body.relation,
+        itr_type=body.itr_type, drive_folder_id=body.drive_folder_id)
+    return {"id": pid}

app/tests/integration/test_auth_api.py

@@ -0,0 +1,48 @@
+"""Frontend auth + profile API (JWT verification mocked)."""
+import unittest
+from unittest.mock import patch
+
+from fastapi.testclient import TestClient
+from app.core.control_db import init_control_db
+from app.main import app
+
+
+class TestAuthApi(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        init_control_db()
+        cls.client = TestClient(app)
+
+    def test_me_requires_bearer(self):
+        self.assertEqual(self.client.get("/me").status_code, 401)
+
+    def test_me_creates_user_and_returns_profiles(self):
+        with patch("app.orchestrator.auth_api.verify_token",
+                   return_value={"id": "sub-1", "email": "newuser@example.com"}):
+            r = self.client.get("/me", headers={"Authorization": "Bearer x"})
+            self.assertEqual(r.status_code, 200)
+            self.assertEqual(r.json()["user"]["email"], "newuser@example.com")
+            self.assertEqual(r.json()["profiles"], [])
+
+    def test_create_and_list_profiles_scoped_to_user(self):
+        hdr = {"Authorization": "Bearer x"}
+        with patch("app.orchestrator.auth_api.verify_token",
+                   return_value={"id": "sub-2", "email": "filer@example.com"}):
+            pid = self.client.post("/profiles", json={"display_name": "Self"}, headers=hdr).json()["id"]
+            spouse = self.client.post(
+                "/profiles", json={"display_name": "Spouse", "relation": "spouse", "itr_type": "ITR2"},
+                headers=hdr).json()["id"]
+            profiles = self.client.get("/profiles", headers=hdr).json()
+            ids = [p["id"] for p in profiles]
+            self.assertIn(pid, ids)
+            self.assertIn(spouse, ids)
+            self.assertEqual(len(profiles), 2)
+
+    def test_cors_headers_present(self):
+        with patch.dict("os.environ", {"FRONTEND_ORIGINS": "http://localhost:5173"}):
+            r = self.client.get("/", headers={"Origin": "http://localhost:5173"})
+            self.assertEqual(r.headers.get("access-control-allow-origin"), "http://localhost:5173")
+
+
+if __name__ == "__main__":
+    unittest.main(verbosity=2)

requirements.txt

@@ -7,6 +7,7 @@ mcp
 sqlalchemy
 psycopg[binary]
 cryptography
+pyjwt
 # Async agent runs (Phase 2)
 rq
 redis