frontend/app/globals.css (1)

6-30: Verify color palette completeness against PR design objectives.

The primary color scale is correctly structured for Tailwind v4, but the PR objectives mention "purple-to-blue branding" whereas the CSS only defines a purple palette. There is no secondary blue/accent color scale defined.

Confirm whether:

1. Blue colors are intentionally deferred to a later phase, or
2. A complementary blue/accent palette should be added now (e.g., --secondary-* or --accent-* tokens).

Additionally, verify that these color tokens are being actively consumed in the new authentication components (login, signup, and role-specific dashboards). If unused at this stage, they can be deferred.

frontend/middleware.ts (1)

8-19: Tidy up unused middleware flags

publicRoutes/isPublicRoute and isProtectedRoute are computed but never used, and the middleware always falls through to NextResponse.next(). Either wire these checks into a redirect/early return or drop the dead code so the intent of the middleware stays clear.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: muntaxir4
Repo: AOSSIE-Org/InPactAI PR: 56
File: Backend/app/services/redis_client.py:1-4
Timestamp: 2025-05-07T21:28:06.358Z
Learning: Hardcoded Redis connection parameters in Backend/app/services/redis_client.py are intentional during development, with plans to implement environment variable configuration later during production preparation.

backend/app/api/routes/auth.py (2)

6-8: Consider dependency injection for the Supabase client.

While module-level initialization works, FastAPI best practices favor dependency injection for better testability and lifecycle management.

---

10-14: Consider stronger password requirements.

A minimum password length of 8 characters meets basic standards but is below modern security best practices. Consider increasing to 12 or adding complexity requirements.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: muntaxir4
Repo: AOSSIE-Org/InPactAI PR: 56
File: Backend/app/services/redis_client.py:1-4
Timestamp: 2025-05-07T21:28:06.358Z
Learning: Hardcoded Redis connection parameters in Backend/app/services/redis_client.py are intentional during development, with plans to implement environment variable configuration later during production preparation.

backend/app/api/routes/auth.py (2)

2-2: Remove unused import.

The constr import is not used anywhere in the file. All string constraints are defined using Field with validation parameters.

Apply this diff:

-from pydantic import BaseModel, EmailStr, constr,Field
+from pydantic import BaseModel, EmailStr, Field

---

31-79: Signup logic is robust and well-structured.

The endpoint correctly implements:

• Email verification flow (Supabase sends verification email automatically)
• Proper client separation (public for auth, admin for profile and rollback)
• Defensive error handling with retries for rollback operations
• Appropriate exception chaining to preserve error context

All previous critical issues have been addressed effectively.

Minor suggestion: Consider adding a small delay between rollback retry attempts to handle transient network issues more gracefully:

import asyncio

for attempt in range(2):
    try:
        supabase_admin.auth.admin.delete_user(user.id)
        break
    except Exception as rollback_err:
        rollback_error = rollback_err
        if attempt == 0:
            await asyncio.sleep(0.5)  # Brief delay before retry
            continue

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

backend/app/api/routes/auth.py (1)

113-124: Fix inconsistent exception handling pattern.

The login endpoint catches broad Exception and uses hasattr checks (line 122), while the signup endpoint properly catches AuthApiError directly (line 45). This inconsistency creates fragile error handling and violates the established pattern.

Additionally:

• AuthApiError is already imported (line 3) but not used here
• The comment on line 121 says "Import AuthApiError if available" which is confusing since it's already imported
• Missing exception chaining at lines 123-124 (Ruff B904 hints)

Apply this diff to align with the signup pattern:

         # 1. Authenticate user
         try:
             auth_resp = supabase_public.auth.sign_in_with_password({
                 "email": payload.email,
                 "password": payload.password
             })
             user = getattr(auth_resp, "user", None)
-        except Exception as e:
-            # Supabase Python SDK v2 raises exceptions for auth errors
-            # Import AuthApiError if available
-            if hasattr(e, "code") and e.code == "email_not_confirmed":
-                raise HTTPException(status_code=403, detail="Please verify your email before logging in.")
-            raise HTTPException(status_code=401, detail=str(e))
+        except AuthApiError as e:
+            if getattr(e, "code", None) == "email_not_confirmed":
+                raise HTTPException(status_code=403, detail="Please verify your email before logging in.") from e
+            raise HTTPException(status_code=401, detail=str(e)) from e

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro