From ecd63fc65f370fda678ed06ed2b0b0bb1ac6f9c5 Mon Sep 17 00:00:00 2001
From: jtricerolph <info@tricerolph.com>
Date: Sun, 12 Jul 2026 12:34:01 +0000
Subject: [PATCH] Add get_current_user_from_token to auth.py; fix missing
 import in 3 api files

?token= query-param endpoints (PO/invoice print previews, recipe image exports,
backup download) call get_current_user_from_token which was not ported from the
original archive auth module. Added the function and fixed the missing import in
backup.py, ingredients.py, and invoices.py.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 backend/api/backup.py      |  2 +-
 backend/api/ingredients.py |  2 +-
 backend/api/invoices.py    |  2 +-
 backend/auth.py            | 29 +++++++++++++++++++++++++++++
 4 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/backend/api/backup.py b/backend/api/backup.py
index da6b2ab..5a1ef74 100644
--- a/backend/api/backup.py
+++ b/backend/api/backup.py
@@ -16,7 +16,7 @@ from database import get_db
 from models.user import User
 from models.settings import KitchenSettings
 from models.backup import BackupHistory
-from auth import get_current_user, require_cap
+from auth import get_current_user, require_cap, get_current_user_from_token
 from services.backup_service import BackupService
 
 router = APIRouter()
diff --git a/backend/api/ingredients.py b/backend/api/ingredients.py
index 2982884..4501380 100644
--- a/backend/api/ingredients.py
+++ b/backend/api/ingredients.py
@@ -22,7 +22,7 @@ from models.line_item import LineItem
 from models.invoice import Invoice
 from models.supplier import Supplier
 from models.recipe import Recipe, RecipeIngredient, RecipeSubRecipe
-from auth import get_current_user, require_cap
+from auth import get_current_user, require_cap, get_current_user_from_token
 
 logger = logging.getLogger(__name__)
 
diff --git a/backend/api/invoices.py b/backend/api/invoices.py
index 8e3d686..19bb1be 100644
--- a/backend/api/invoices.py
+++ b/backend/api/invoices.py
@@ -19,7 +19,7 @@ from models.invoice import Invoice, InvoiceStatus
 from models.line_item import LineItem
 from models.product_definition import ProductDefinition
 from models.settings import KitchenSettings
-from auth import get_current_user, require_cap
+from auth import get_current_user, require_cap, get_current_user_from_token
 from ocr.extractor import process_invoice_image
 from ocr.azure_extractor import parse_pack_size
 from services.duplicate_detector import DuplicateDetector
diff --git a/backend/auth.py b/backend/auth.py
index 2603e7c..55b9cbd 100644
--- a/backend/auth.py
+++ b/backend/auth.py
@@ -73,6 +73,35 @@ def require_cap(cap: str):
     return checker
 
 
+async def get_current_user_from_token(token: str, db: AsyncSession = None):
+    """Decode a JWT passed as a query-param (e.g. ?token=...) and return a user or None."""
+    try:
+        payload = jwt.decode(token, CENTRAL_AUTH_SECRET, algorithms=[JWT_ALGORITHM])
+    except JWTError:
+        return None
+
+    apps = payload.get("apps", [])
+    if APP_SLUG not in apps:
+        return None
+
+    prefix = f"{APP_SLUG}:"
+    raw_caps = payload.get("caps", [])
+    caps = [c[len(prefix):] for c in raw_caps if isinstance(c, str) and c.startswith(prefix)]
+
+    return SimpleNamespace(
+        id=0,
+        email=payload.get("sub", ""),
+        username=payload.get("sub", ""),
+        name=payload.get("name", ""),
+        display_name=payload.get("name", ""),
+        is_admin=payload.get("is_admin", False),
+        is_active=True,
+        kitchen_id=1,
+        caps=caps,
+        role="admin" if payload.get("is_admin", False) else "user",
+    )
+
+
 async def get_admin_user(user=Depends(get_current_user)):
     if not user.is_admin:
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Admin access required")