resolved security issue alerted by Dependabot

app/auth.py

@@ -1,10 +1,13 @@
 # app/auth.py
 
+import os, requests
 from .schema import LoginSchema, SignUpSchema
 from fastapi.responses import JSONResponse
 from starlette import status
 from firebase_admin import auth, firestore
-from .firebase_init import db, firebase
+from .firebase_init import db
+
+FIREBASE_API_KEY = os.getenv("FIREBASE_API_KEY")
 
 def _create_response(status_code: int, message: str, **kwargs):
   content = {"message": message}
@@ -40,7 +43,7 @@
   valid, msg = _validate_passwords(password, confirm_password)
   if not valid:
     return _create_response(status.HTTP_400_BAD_REQUEST, msg)
 
   college_id, college_data = _get_college_by_domain(email)
   if not college_id:
     return _create_response(
@@ -60,7 +63,7 @@
       }
     )
     return _create_response(
       status.HTTP_201_CREATED, "User created successfully", uid=user.uid
     )
   except Exception as e:
     return _create_response(status.HTTP_500_INTERNAL_SERVER_ERROR, str(e))
@@ -76,16 +79,29 @@
       status.HTTP_400_BAD_REQUEST,
       "Your college domain is not registered.",
     )
 
   try:
-    user = firebase.auth().sign_in_with_email_and_password(email, password)
-    return _create_response(
-      status.HTTP_200_OK,
-      "Login successful",
-      idToken=user["idToken"],
-    )
+    request_url = f"https://identitytoolkit.googleapis.com/v1/accounts:signInWithPassword?key={FIREBASE_API_KEY}"
+    payload = {
+      "email": email,
+      "password": password,
+      "returnSecureToken": True
+    }
+    response = requests.post(request_url, json=payload)
+    response_data = response.json()
+
+    if response.status_code == 200:
+      return _create_response(
+        status.HTTP_200_OK,
+        "Login successful",
+        idToken=response_data["idToken"],
+      )
+    else:
+      error_msg = response_data.get("error", {}).get("message", "Login failed")
+      return _create_response(status.HTTP_401_UNAUTHORIZED, error_msg)
+
   except Exception as e:
-    return _create_response(status.HTTP_401_UNAUTHORIZED, str(e))
+    return _create_response(status.HTTP_500_INTERNAL_SERVER_ERROR, str(e))
 
 async def verify_staff_access(token: str):
   try:

app/firebase_init.py

@@ -3,26 +3,12 @@
 import os
 import firebase_admin
 from firebase_admin import credentials, firestore
-import pyrebase
 from dotenv import load_dotenv
 
 load_dotenv()
 
 IS_CI = os.environ.get("CI") == "true"
 
-firebaseConfig = {
-    "apiKey": os.getenv("FIREBASE_API_KEY"),
-    "authDomain": os.getenv("FIREBASE_AUTH_DOMAIN"),
-    "databaseURL": os.getenv("FIREBASE_DATABASE_URL"),
-    "projectId": os.getenv("FIREBASE_PROJECT_ID"),
-    "storageBucket": os.getenv("FIREBASE_STORAGE_BUCKET"),
-    "messagingSenderId": os.getenv("FIREBASE_MESSAGING_SENDER_ID"),
-    "appId": os.getenv("FIREBASE_APP_ID"),
-    "measurementId": os.getenv("FIREBASE_MEASUREMENT_ID")
-}
-
-firebase = pyrebase.initialize_app(firebaseConfig)
-
 firebase_credentials = os.environ.get("FIREBASE_SERVICE_ACCOUNT")
 
 if not firebase_credentials and not IS_CI:

requirements.txt

@@ -47,7 +47,6 @@ pydantic==2.12.5
 pydantic_core==2.41.5
 PyJWT==2.10.1
 pyparsing==3.2.5
-Pyrebase4==4.8.0
 python-dotenv==1.2.1
 python-jwt==4.1.0
 python-multipart==0.0.21