User Management

User profile and authentication status endpoints

Get Current User

cURL

curl -X GET https://api.nectr.ai/auth/me \
  -H "Cookie: access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

Returns the profile information for the currently authenticated user.

Authentication

Cookie · string · required

access_token - JWT token in httpOnly cookie (automatically sent by browsers)

Response

id · integer

Internal user ID

github_id · integer

GitHub user ID

github_username · string

GitHub username (login)

name · string | null

User’s full name from GitHub profile

email · string | null

User’s email address from GitHub

avatar_url · string | null

URL to the user’s GitHub avatar image

created_at · string

ISO 8601 timestamp of when the user was created in the system

200 Response

{
  "id": 123,
  "github_id": 98765432,
  "github_username": "octocat",
  "name": "The Octocat",
  "email": "[e-mail]",
  "avatar_url": "https://avatars.githubusercontent.com/u/98765432",
  "created_at": "2024-01-15T10:30:00.000Z"
}

Error Responses

401 · error

Not authenticated - The access_token cookie is missing

401 · error

Invalid or expired token - The JWT token is invalid, malformed, or expired

401 · error

User not found - The user ID from the token doesn’t exist in the database

---

User Model

The User model represents an authenticated user in the system.

Database Schema

id · integer · required

Primary key, auto-incremented

github_id · integer · required

Unique GitHub user ID, indexed for fast lookups

github_username · string · required

GitHub username (login)

github_access_token · string · required

Encrypted GitHub OAuth access token. Encrypted using Fernet (AES-128-CBC + HMAC-SHA256) derived from SECRET_KEY.

email · string | null

User’s email address from GitHub. May be null if email is private.

avatar_url · string | null

URL to the user’s GitHub avatar image

name · string | null

User’s full name from GitHub profile

created_at · datetime

Timestamp when the user was created (UTC, with timezone)

updated_at · datetime

Timestamp when the user was last updated (UTC, with timezone)

---

Token Encryption

GitHub access tokens are encrypted at rest using symmetric encryption for security.

Implementation

Defined in app/auth/token_encryption.py:

Encrypt

def encrypt_token(plaintext: str) -> str:
    """Encrypt a GitHub access token for storage."""
    f = _get_fernet()
    return f.encrypt(plaintext.encode()).decode()

Encryption Details

• Algorithm: Fernet (AES-128-CBC + HMAC-SHA256)
• Key Derivation: SHA-256 hash of SECRET_KEY, encoded as URL-safe base64
• Security: Provides confidentiality and authenticity

Token Prefixes

The system recognizes these GitHub token prefixes for plaintext detection:

• ghp_ - Personal access token
• gho_ - OAuth access token
• ghs_ - Server-to-server token
• ghu_ - User access token
• github_pat_ - Fine-grained personal access token

Migration Support

The decryption function gracefully handles legacy plaintext tokens. If a token cannot be decrypted but matches a GitHub token prefix, it’s returned as-is and a warning is logged. The token will be encrypted on the user’s next login.

If SECRET_KEY changes, all encrypted tokens become unreadable. Users must log out and sign in again to re-encrypt their tokens with the new key.