Function api_login

main.py:1078–1152

Login endpoint with fallback to in-memory storage

(request: Request, email: str = Form(...), password: str = Form(...), db: Session = Depends(get_db))

@app.post("/api/login")
async def api_login(request: Request, email: str = Form(...), password: str = Form(...), db: Session = Depends(get_db)):
    """Login endpoint with fallback to in-memory storage"""
    logger.info(f"Login attempt for {email}, USE_POSTGRES={USE_POSTGRES}")

    if USE_POSTGRES:
        logger.info("Using PostgreSQL login")
        try:
            user = login_or_create_user(email, password, db)
            set_session_for_user(user)

            # Ensure user has a valid Stripe customer
            valid_stripe_id = validate_stripe_customer(user.stripe_id, email) if user.stripe_id else None
            if not valid_stripe_id:
                logger.info(f"Creating/updating Stripe customer for user {email}")
                stripe_id = get_or_create_stripe_customer(email, user.id)
                if stripe_id:
                    user.stripe_id = stripe_id
                    db.commit()
                    db.refresh(user)
                else:
                    logger.error(f"Failed to create Stripe customer for user {email}")
            elif valid_stripe_id != user.stripe_id:
                # Update stored customer ID if we found a different valid one
                logger.info(f"Updating Stripe customer ID for user {email} from {user.stripe_id} to {valid_stripe_id}")
                user.stripe_id = valid_stripe_id
                db.commit()
                db.refresh(user)

            # Check subscription status
            subscription_item_id = get_subscription_item_id_for_user_email(user.email)
            user.is_subscribed = subscription_item_id is not None

            # Set session_secret cookie
            response = JSONResponse(user.to_dict())
            response.set_cookie(
                key="session_secret",
                value=user.secret,
                httponly=True,
                secure=False,  # Set to True in production with HTTPS
                samesite="lax",
                path="/",
            )
            return response
        except HTTPException:
            raise
        except Exception as e:
            logger.error(f"PostgreSQL login error: {e}")
            raise HTTPException(status_code=401, detail="Invalid email or password")
    else:
        # Fallback to simple in-memory authentication
        logger.info("Using in-memory login")
        if email in test_users and test_users[email]["password"] == password:
            session_secret = random_string(32)
            user_data = {
                "id": test_users[email]["id"],
                "email": email,
                "secret": session_secret,
                "is_subscribed": False,