From 76db7c2611b0749f1fdd8f511240c41bdc7c402e Mon Sep 17 00:00:00 2001
From: Abhishek Kumar <abhishek@a6k.me>
Date: Mon, 6 Jul 2026 19:02:35 +0530
Subject: [PATCH] fix: keep current user route available in stack auth

---
 api/routes/auth.py            | 13 ++++++--
 api/tests/test_auth_routes.py | 63 +++++++++++++++++++++++++++++++++++
 2 files changed, 73 insertions(+), 3 deletions(-)
 create mode 100644 api/tests/test_auth_routes.py

diff --git a/api/routes/auth.py b/api/routes/auth.py
index baf5bdde..c67978e0 100644
--- a/api/routes/auth.py
+++ b/api/routes/auth.py
@@ -19,11 +19,14 @@ from api.utils.auth import create_jwt_token, hash_password, verify_password
 router = APIRouter(
     prefix="/auth",
     tags=["auth"],
-    dependencies=[Depends(require_local_auth)],
 )
 
 
-@router.post("/signup", response_model=AuthResponse)
+@router.post(
+    "/signup",
+    response_model=AuthResponse,
+    dependencies=[Depends(require_local_auth)],
+)
 async def signup(request: SignupRequest):
     # Check if email is already taken
     existing_user = await db_client.get_user_by_email(request.email)
@@ -90,7 +93,11 @@ async def signup(request: SignupRequest):
     )
 
 
-@router.post("/login", response_model=AuthResponse)
+@router.post(
+    "/login",
+    response_model=AuthResponse,
+    dependencies=[Depends(require_local_auth)],
+)
 async def login(request: LoginRequest):
     # Look up user by email
     user = await db_client.get_user_by_email(request.email)
diff --git a/api/tests/test_auth_routes.py b/api/tests/test_auth_routes.py
new file mode 100644
index 00000000..143266b1
--- /dev/null
+++ b/api/tests/test_auth_routes.py
@@ -0,0 +1,63 @@
+from types import SimpleNamespace
+
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+
+from api.routes.auth import router
+from api.services.auth import depends as auth_depends
+from api.services.auth.depends import get_user
+
+
+def _make_test_app() -> FastAPI:
+    app = FastAPI()
+    app.include_router(router)
+    return app
+
+
+def test_stack_mode_hides_email_password_auth_routes(monkeypatch):
+    monkeypatch.setattr(auth_depends, "AUTH_PROVIDER", "stack")
+    client = TestClient(_make_test_app())
+
+    signup_response = client.post(
+        "/auth/signup",
+        json={
+            "email": "user@example.com",
+            "password": "password123",
+            "name": "User",
+        },
+    )
+    login_response = client.post(
+        "/auth/login",
+        json={
+            "email": "user@example.com",
+            "password": "password123",
+        },
+    )
+
+    assert signup_response.status_code == 404
+    assert signup_response.json() == {"detail": "Not found"}
+    assert login_response.status_code == 404
+    assert login_response.json() == {"detail": "Not found"}
+
+
+def test_stack_mode_keeps_current_user_route_available(monkeypatch):
+    monkeypatch.setattr(auth_depends, "AUTH_PROVIDER", "stack")
+    app = _make_test_app()
+    app.dependency_overrides[get_user] = lambda: SimpleNamespace(
+        id=7,
+        email="user@example.com",
+        selected_organization_id=42,
+        provider_id="stack-user-1",
+    )
+    client = TestClient(app)
+
+    response = client.get("/auth/me")
+
+    assert response.status_code == 200
+    assert response.json() == {
+        "id": 7,
+        "email": "user@example.com",
+        "name": None,
+        "organization_id": 42,
+        "provider_id": "stack-user-1",
+    }