feat: Implement User Authentication and Session Ownership

[yuxiang-wu]

Description:

This PR introduces user authentication to the Weco API, allowing users to create accounts and associate optimization sessions with their accounts. It enhances security and enables personalized experiences.

Motivation:

Previously, all sessions were anonymous. This change adds a layer of user management, enabling:

• Users to track their past optimization sessions.
• Protection of session data, ensuring only the owner (if authenticated) can access or modify their sessions.
• Future features that rely on user accounts.

Changes Made:

• Authentication Endpoints: Added new endpoints under /v1/auth for user registration (/signup), login (/token), and potentially retrieving user info.
• JWT Implementation: Integrated JWT for handling user authentication tokens. Login returns an access token, which should be included in subsequent requests as a Bearer token.
• Supabase Integration: Leverages Supabase Auth for user management (signup, login verification).
• Middleware/Dependency: Implemented FastAPI dependencies (get_current_user_id) to extract the user ID from valid JWT tokens in request headers.
• Session Endpoint Updates:
  • Modified POST /v1/sessions/ (create_session) to associate the new session with the authenticated user's ID, if available.
  • Updated POST /v1/sessions/{session_id}/suggest (suggest_solution) and GET /v1/sessions/{session_id} (get_session_status) to verify that if a session has a user_id, the requesting user (identified via token) matches the session owner. Unauthorized access attempts result in a 403 Forbidden error.
  • Sessions created without authentication remain accessible without a token but are not associated with any user.
• Database Schema: (Implicit) Assumes the sessions table now includes a nullable user_id column (likely a UUID referencing the auth.users table).
• Configuration: Added necessary environment variables for Supabase URL and keys.

Testing:

• Manually tested signup, login, and token retrieval.
• Verified that authenticated requests to session endpoints succeed for the owner.
• Verified that unauthenticated requests to owned sessions fail (403).
• Verified that requests to unowned sessions fail (403).
• Verified that sessions created without authentication can still be accessed and managed without a token.
• Tested session creation both with and without authentication tokens.

Notes:

• API keys for LLM models are still passed via request metadata, separate from user authentication.
• Ensure necessary Supabase environment variables are set in deployment environments.

[DhruvSrikanth]

Looks good!