update: pipeline, search, clip, embedding fixes

src/core/auth/jwt.rs

@@ -0,0 +1,53 @@
+use anyhow::{Context, Result};
+use jsonwebtoken::{decode, encode, DecodingKey, EncodingKey, Header, Validation};
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+use crate::core::config::JWT_SECRET;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Claims {
+    pub sub: String,
+    pub exp: usize,
+    pub iat: usize,
+    pub jti: String,
+    pub role: String,
+    pub name: String,
+}
+
+pub fn create_jwt(user_id: i32, username: &str, role: &str) -> Result<String> {
+    let now = chrono::Utc::now();
+    let exp = (now + chrono::Duration::hours(1)).timestamp() as usize;
+    let iat = now.timestamp() as usize;
+
+    let claims = Claims {
+        sub: user_id.to_string(),
+        exp,
+        iat,
+        jti: Uuid::new_v4().to_string(),
+        role: role.to_string(),
+        name: username.to_string(),
+    };
+
+    encode(
+        &Header::default(),
+        &claims,
+        &EncodingKey::from_secret(JWT_SECRET.as_bytes()),
+    )
+    .context("Failed to encode JWT")
+}
+
+pub fn verify_jwt(token: &str) -> Result<Claims> {
+    let token_data = decode::<Claims>(
+        token,
+        &DecodingKey::from_secret(JWT_SECRET.as_bytes()),
+        &Validation::default(),
+    )
+    .context("Failed to decode JWT")?;
+
+    Ok(token_data.claims)
+}
+
+pub fn is_jwt(token: &str) -> bool {
+    token.starts_with("eyJ") && token.split('.').count() == 3
+}

src/core/auth/mod.rs

@@ -0,0 +1,2 @@
+pub mod jwt;
+pub mod password;

src/core/auth/password.rs

@@ -0,0 +1,41 @@
+use anyhow::Result;
+use argon2::{
+    password_hash::{rand_core::OsRng, PasswordHash, PasswordHasher, PasswordVerifier, SaltString},
+    Argon2,
+};
+
+pub fn hash_password(password: &str) -> Result<String> {
+    let salt = SaltString::generate(&mut OsRng);
+    let hash = Argon2::default()
+        .hash_password(password.as_bytes(), &salt)
+        .map_err(|e| anyhow::anyhow!("Failed to hash password: {}", e))?;
+    Ok(hash.to_string())
+}
+
+pub fn verify_password(password: &str, hash: &str) -> bool {
+    let parsed = match PasswordHash::new(hash) {
+        Ok(p) => p,
+        Err(_) => return false,
+    };
+    Argon2::default()
+        .verify_password(password.as_bytes(), &parsed)
+        .is_ok()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_hash_and_verify() {
+        let password = "test_password_123";
+        let hash = hash_password(password).unwrap();
+        assert!(verify_password(password, &hash));
+        assert!(!verify_password("wrong_password", &hash));
+    }
+
+    #[test]
+    fn test_verify_fails_on_bad_hash() {
+        assert!(!verify_password("test", "not_a_valid_hash"));
+    }
+}