Address urgent pull request review and security issues

.github/workflows/quality.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.8", "3.9", "3.10", "3.11"]
+        python-version: ["3.10", "3.11", "3.12"]
 
     steps:
     - uses: actions/checkout@v4

.pylintrc

@@ -270,7 +270,7 @@ max-elif-branches=5
 
 [FORMAT]
 # Maximum number of characters on a single line.
-max-line-length=100
+max-line-length=88
 
 # Regexp for a line that is allowed to be longer than the limit.
 ignore-long-lines=^\s*(# )?<?https?://\S+>?$

src/security/auth.py

@@ -37,13 +37,13 @@ async def get_current_user(credentials: HTTPAuthorizationCredentials = Depends(s
     # Check Authorization scheme
     if not credentials or credentials.scheme.lower() != "bearer":
         raise HTTPException(
-            status_code=status.HTTP_401_UNAUTHORIZED,
+            status_code=status.HTTP_403_FORBIDDEN,
             detail="Invalid authentication scheme. Expected 'Bearer'",
             headers={"WWW-Authenticate": "Bearer"},
         )
-    
+
     credentials_exception = HTTPException(
-        status_code=status.HTTP_401_UNAUTHORIZED,
+        status_code=status.HTTP_403_FORBIDDEN,
         detail="Could not validate credentials",
         headers={"WWW-Authenticate": "Bearer"},
     )
@@ -55,7 +55,7 @@ async def get_current_user(credentials: HTTPAuthorizationCredentials = Depends(s
     except JWTError as jwt_error:
         # Preserve original JWT error details for debugging
         raise HTTPException(
-            status_code=status.HTTP_401_UNAUTHORIZED,
+            status_code=status.HTTP_403_FORBIDDEN,
             detail=f"JWT validation failed: {str(jwt_error)}",
             headers={"WWW-Authenticate": "Bearer"},
         ) from jwt_error

src/unified_ai_api.py

@@ -1041,7 +1041,7 @@ async def refresh_token(request: RefreshTokenRequest) -> TokenResponse:
         payload = jwt_manager.verify_token(request.refresh_token)
         if not payload or payload.type != "refresh":
             raise HTTPException(
-                status_code=status.HTTP_401_UNAUTHORIZED,
+                status_code=status.HTTP_403_FORBIDDEN,
                 detail="Invalid refresh token"
             )
 

tests/test_api_integration.py

@@ -98,7 +98,7 @@ def test_endpoint_consistency(self):
             # Test all endpoints
             endpoints = [
                 ('/api/analyze/journal', {'text': 'I feel happy today.', 'generate_summary': True}),
-                ('/api/summarize/', {'text': 'This is a long text for testing.', 'max_length': 50}),
+                ('/api/summarize/', {'text': 'This is a longer text for testing that intentionally exceeds fifty characters to satisfy validation.', 'max_length': 50}),
                 ('/api/transcribe/', {'audio_data': self.mock_audio_data, 'language': 'en'}),
                 ('/api/complete-analysis/', {'text': 'I feel happy today.', 'include_summary': True, 'include_emotion': True})
             ]

tests/test_model_integration.py

@@ -95,7 +95,7 @@ def test_model_loading_consistency(self):
             # Test all endpoints to trigger model loading
             endpoints = [
                 ('/api/analyze/journal', {'text': 'I feel happy today.', 'generate_summary': True}),
-                ('/api/summarize/', {'text': 'This is a long text for testing.', 'max_length': 50}),
+                ('/api/summarize/', {'text': 'This is a longer text for testing that intentionally exceeds fifty characters to satisfy validation.', 'max_length': 50}),
                 ('/api/transcribe/', {'audio_data': self.mock_audio_data, 'language': 'en'}),
                 ('/api/complete-analysis/', {'text': 'I feel happy today.', 'include_summary': True, 'include_emotion': True})
             ]
@@ -122,7 +122,7 @@ def test_model_error_handling(self):
             # Test that endpoints handle model loading failures gracefully
             endpoints = [
                 ('/api/analyze/journal', {'text': 'I feel happy today.', 'generate_summary': True}),
-                ('/api/summarize/', {'text': 'This is a long text for testing.', 'max_length': 50}),
+                ('/api/summarize/', {'text': 'This is a longer text for testing that intentionally exceeds fifty characters to satisfy validation.', 'max_length': 50}),
                 ('/api/transcribe/', {'audio_data': self.mock_audio_data, 'language': 'en'}),
                 ('/api/complete-analysis/', {'text': 'I feel happy today.', 'include_summary': True, 'include_emotion': True})
             ]

tests/test_summarize_endpoint.py

@@ -52,7 +52,7 @@ def test_summarize_short_text(self):
     def test_summarize_invalid_parameters(self):
         """Test summarization with invalid parameters."""
         response = self.client.post('/api/summarize/', 
-                                  json={'text': 'This is a long text for testing.', 
+                                  json={'text': 'This is a longer text for testing that intentionally exceeds fifty characters to satisfy validation.', 
                                         'max_length': 10, 'min_length': 20})
         self.assertEqual(response.status_code, 400)
         data = json.loads(response.data)
@@ -61,7 +61,7 @@ def test_summarize_invalid_parameters(self):
     def test_summarize_invalid_temperature(self):
         """Test summarization with invalid temperature."""
         response = self.client.post('/api/summarize/', 
-                                  json={'text': 'This is a long text for testing.', 
+                                  json={'text': 'This is a longer text for testing that intentionally exceeds fifty characters to satisfy validation.', 
                                         'temperature': 3.0})
         self.assertEqual(response.status_code, 400)
         data = json.loads(response.data)