chore: configured backend to frontend communication

[sreenandpk]

Summary by CodeRabbit

• New Features

  • Email verification now signs users in automatically after successful verification.
  • Verification responses include an access token, and a refresh session is established.
  • Verification emails can be resent using either a username or email address.
  • Google sign-in redirects now work with hash-based application routing.

• Bug Fixes

  • Added support for local development through port 5173 in allowed connection origins.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b306c711-37ea-4de7-a0be-e2e84774e642

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• ✅ Review completed - (🔄 Check again to review again)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/connection

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (2)

src/ai_trading_discipline_copilot/routers/auth.py (2)

593-595: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Duplicated request-metadata extraction.

This ip_address/user_agent/device_name block duplicates the same three lines in refresh (Lines 199-201). Consider extracting a small helper (e.g. a FastAPI dependency or parse_client_context(request)) to avoid drift between the two call sites.

♻️ Proposed helper

def get_client_context(request: Request) -> tuple[str | None, str | None, str]:
    """Extract (ip_address, user_agent, device_name) from a request."""
    ip_address = request.client.host if request.client else None
    user_agent = request.headers.get("user-agent")
    return ip_address, user_agent, parse_device_name(user_agent)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/ai_trading_discipline_copilot/routers/auth.py` around lines 593 - 595,
The request-metadata extraction for ip_address, user_agent, and device_name is
duplicated in both refresh and the other auth flow, so factor it into a shared
helper such as parse_client_context or get_client_context in auth.py. Update
both call sites to use that helper and return the same tuple values so the logic
stays consistent and avoids drift.

---

597-597: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Expose a public AuthService token helper — verify_email is reaching into AuthService._create_tokens; add a public create_tokens wrapper and use that instead.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/ai_trading_discipline_copilot/routers/auth.py` at line 597,
`verify_email` is calling the private `AuthService._create_tokens` helper
directly, so expose a public `AuthService.create_tokens` wrapper and update the
auth flow to use it instead. Make the new public method delegate to the existing
token creation logic, then replace the `_create_tokens` call in `verify_email`
with `create_tokens` so token generation is accessed through the supported API.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/ai_trading_discipline_copilot/routers/auth.py`:
- Around line 585-619: The email verification flow in auth.py is not atomic
because EmailVerificationService.verify_email completes and commits before the
auto-login/session setup finishes, so a later failure in
AuthService._create_tokens or RefreshTokenService.create_session can leave the
user verified but unable to log in. Update the verification handler to wrap the
auto-login portion after verify_email in a try/except, and if token creation or
session creation fails, still return the verification-success response without
issuing tokens while logging the failure for later investigation. Use the
existing verify_email, _create_tokens, create_session, and set_refresh_cookie
flow as the reference points.

---

Nitpick comments:
In `@src/ai_trading_discipline_copilot/routers/auth.py`:
- Around line 593-595: The request-metadata extraction for ip_address,
user_agent, and device_name is duplicated in both refresh and the other auth
flow, so factor it into a shared helper such as parse_client_context or
get_client_context in auth.py. Update both call sites to use that helper and
return the same tuple values so the logic stays consistent and avoids drift.
- Line 597: `verify_email` is calling the private `AuthService._create_tokens`
helper directly, so expose a public `AuthService.create_tokens` wrapper and
update the auth flow to use it instead. Make the new public method delegate to
the existing token creation logic, then replace the `_create_tokens` call in
`verify_email` with `create_tokens` so token generation is accessed through the
supported API.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b4c1adf8-8079-494f-8f9b-ffa244e2fe50

📥 Commits

Reviewing files that changed from the base of the PR and between 63da326 and 1f4caed.

📒 Files selected for processing (7)

• .env.example
• docker-compose.yml
• src/ai_trading_discipline_copilot/core/config.py
• src/ai_trading_discipline_copilot/routers/auth.py
• src/ai_trading_discipline_copilot/schemas/email_verification.py
• src/ai_trading_discipline_copilot/services/email_verification_service.py
• tests/test_email_verification.py