fix(api): parse signed session cookie instead of SHA-256 hashing

fix(api): parse signed session cookie instead of SHA-256 hashing

api/src/cartsnitch_api/auth/dependencies.py

@@ -5,7 +5,6 @@ Sessions are verified by querying the shared sessions table directly.
 """
 
 from datetime import UTC, datetime
-from hashlib import sha256
 from uuid import UUID
 
 from fastapi import Cookie, Depends, Header, HTTPException, Request, status
@@ -32,13 +31,15 @@ async def _validate_session_token(token: str, db: AsyncSession) -> UUID:
     """Validate a Better-Auth session token against the sessions table.
 
     Returns the user_id (as UUID) if the session is valid and not expired.
-    Better-Auth v1.5.6+ stores tokens as SHA-256 hashes, so we hash the
-    incoming raw token before querying.
+    Better-Auth v1.5.6 stores raw tokens in the DB. The session cookie
+    is signed: ``rawToken.base64HMACSignature``. Strip the signature
+    before querying.
     """
-    hashed_token = sha256(token.encode("utf-8")).hexdigest()
+    # Signed cookie format: rawToken.hmacSignature — split and use only the token part
+    raw_token = token.split(".")[0] if "." in token else token
     result = await db.execute(
         text("SELECT user_id, expires_at FROM sessions WHERE token = :token"),
-        {"token": hashed_token},
+        {"token": raw_token},
     )
     row = result.first()
 

api/src/cartsnitch_api/models/coupon.py

@@ -9,14 +9,14 @@ from sqlalchemy import Boolean, Date, DateTime, ForeignKey, Numeric, String
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 
 from cartsnitch_api.constants import DiscountType
-from cartsnitch_api.models.base import Base, UUIDPrimaryKeyMixin
+from cartsnitch_api.models.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
 
 if TYPE_CHECKING:
     from cartsnitch_api.models.product import NormalizedProduct
     from cartsnitch_api.models.store import Store
 
 
-class Coupon(UUIDPrimaryKeyMixin, Base):
+class Coupon(UUIDPrimaryKeyMixin, TimestampMixin, Base):
     """A coupon or deal for a product at a store."""
 
     __tablename__ = "coupons"

api/src/cartsnitch_api/models/price.py

@@ -9,7 +9,7 @@ from sqlalchemy import Date, ForeignKey, Index, Numeric, String
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 
 from cartsnitch_api.constants import PriceSource
-from cartsnitch_api.models.base import Base, UUIDPrimaryKeyMixin
+from cartsnitch_api.models.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
 
 if TYPE_CHECKING:
     from cartsnitch_api.models.product import NormalizedProduct
@@ -17,7 +17,7 @@ if TYPE_CHECKING:
     from cartsnitch_api.models.store import Store
 
 
-class PriceHistory(UUIDPrimaryKeyMixin, Base):
+class PriceHistory(UUIDPrimaryKeyMixin, TimestampMixin, Base):
     """A single price observation for a product at a store on a date."""
 
     __tablename__ = "price_history"

api/src/cartsnitch_api/models/purchase.py

@@ -18,7 +18,7 @@ from sqlalchemy import (
 )
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 
-from cartsnitch_api.models.base import Base, UUIDPrimaryKeyMixin
+from cartsnitch_api.models.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
 
 if TYPE_CHECKING:
     from cartsnitch_api.models.price import PriceHistory
@@ -27,7 +27,7 @@ if TYPE_CHECKING:
     from cartsnitch_api.models.user import User
 
 
-class Purchase(UUIDPrimaryKeyMixin, Base):
+class Purchase(UUIDPrimaryKeyMixin, TimestampMixin, Base):
     """A single shopping trip / receipt."""
 
     __tablename__ = "purchases"
@@ -61,7 +61,7 @@ class Purchase(UUIDPrimaryKeyMixin, Base):
     )
 
 
-class PurchaseItem(UUIDPrimaryKeyMixin, Base):
+class PurchaseItem(UUIDPrimaryKeyMixin, TimestampMixin, Base):
     """Individual line item on a receipt."""
 
     __tablename__ = "purchase_items"

api/src/cartsnitch_api/models/shrinkflation.py

@@ -9,13 +9,13 @@ from sqlalchemy import Date, ForeignKey, Numeric, String
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 
 from cartsnitch_api.constants import SizeUnit
-from cartsnitch_api.models.base import Base, UUIDPrimaryKeyMixin
+from cartsnitch_api.models.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
 
 if TYPE_CHECKING:
     from cartsnitch_api.models.product import NormalizedProduct
 
 
-class ShrinkflationEvent(UUIDPrimaryKeyMixin, Base):
+class ShrinkflationEvent(UUIDPrimaryKeyMixin, TimestampMixin, Base):
     """Detected shrinkflation event — product size changed while price held or rose."""
 
     __tablename__ = "shrinkflation_events"