REFACTOR API gateway fix 8

2025-07-26 23:29:57 +02:00
parent 1291d05183
commit 97ae58fb06
8 changed files with 997 additions and 375 deletions
--- a/services/auth/app/api/auth.py
+++ b/services/auth/app/api/auth.py
@@ -56,14 +56,8 @@ async def register(
        
        logger.debug(f"Input validation passed for {user_data.email}")
        
-        # ✅ DEBUG: Call auth service with enhanced error tracking
-        result = await AuthService.register_user_with_tokens(
-            email=user_data.email.strip().lower(),  # Normalize email
-            password=user_data.password,
-            full_name=user_data.full_name.strip(),
-            db=db
-        )
-        
+        result = await AuthService.register_user(user_data, db)
+                                                 
        logger.info(f"Registration successful for {user_data.email}")
        
        # Record successful registration
@@ -132,11 +126,7 @@ async def login(
            )
        
        # Attempt login through AuthService
-        result = await AuthService.login(
-            email=login_data.email.strip().lower(),  # Normalize email
-            password=login_data.password,
-            db=db
-        )
+        result = await AuthService.login_user(login_data, db)
        
        # Record successful login
        if metrics:
--- a/services/auth/app/core/security.py
+++ b/services/auth/app/core/security.py
@@ -30,20 +30,6 @@ redis_client = redis.from_url(settings.REDIS_URL)
 class SecurityManager:
    """Security utilities for authentication - FIXED VERSION"""
    
-    @staticmethod
-    def hash_password(password: str) -> str:
-        """Hash password using passlib bcrypt - FIXED"""
-        return pwd_context.hash(password)
-    
-    @staticmethod
-    def verify_password(password: str, hashed_password: str) -> bool:
-        """Verify password against hash using passlib - FIXED"""
-        try:
-            return pwd_context.verify(password, hashed_password)
-        except Exception as e:
-            logger.error(f"Password verification error: {e}")
-            return False
-    
    @staticmethod
    def validate_password(password: str) -> bool:
        """Validate password strength"""
@@ -65,48 +51,59 @@ class SecurityManager:
        return True
    
    @staticmethod
-    def create_access_token(user_data: Dict[str, Any], expires_delta: Optional[timedelta] = None) -> str:
-        """Create JWT access token with PROPER validation"""
+    def hash_password(password: str) -> str:
+        """Hash password using passlib bcrypt - FIXED"""
+        return pwd_context.hash(password)
+    
+    @staticmethod
+    def verify_password(password: str, hashed_password: str) -> bool:
+        """Verify password against hash using passlib - FIXED"""
+        try:
+            return pwd_context.verify(password, hashed_password)
+        except Exception as e:
+            logger.error(f"Password verification error: {e}")
+            return False
+    
+    @staticmethod
+    def create_access_token(user_data: Dict[str, Any]) -> str:
+        """
+        Create JWT ACCESS token with proper payload structure
+        ✅ FIXED: Only creates access tokens
+        """
        
-        # ✅ FIX 1: Validate required fields BEFORE token creation
-        required_fields = ["user_id", "email"]
-        missing_fields = [field for field in required_fields if field not in user_data]
+        # Validate required fields for access token
+        if "user_id" not in user_data:
+            raise ValueError("user_id required for access token creation")
        
-        if missing_fields:
-            error_msg = f"Missing required fields for token creation: {missing_fields}"
-            logger.error(f"Token creation failed: {error_msg}")
-            raise ValueError(error_msg)
-        
-        # ✅ FIX 2: Validate that required fields are not None/empty
-        if not user_data.get("user_id"):
-            raise ValueError("user_id cannot be empty")
-        if not user_data.get("email"):
-            raise ValueError("email cannot be empty")
+        if "email" not in user_data:
+            raise ValueError("email required for access token creation")
        
        try:
-            if expires_delta:
-                expire = datetime.now(timezone.utc) + expires_delta
-            else:
-                expire = datetime.now(timezone.utc) + timedelta(minutes=settings.JWT_ACCESS_TOKEN_EXPIRE_MINUTES)
+            expire = datetime.now(timezone.utc) + timedelta(minutes=settings.JWT_ACCESS_TOKEN_EXPIRE_MINUTES)
            
-            # ✅ FIX 3: Build payload with SAFE access to user_data
+            # ✅ FIX 1: ACCESS TOKEN payload structure
            payload = {
                "sub": user_data["user_id"],
                "user_id": user_data["user_id"],
-                "email": user_data["email"],  # ✅ Guaranteed to exist now
-                "type": "access",
-                "full_name": user_data.get("full_name", ""),  # Safe access with default
-                "is_verified": user_data.get("is_verified", False),  # Safe access with default
-                "is_active": user_data.get("is_active", True),  # Safe access with default
+                "email": user_data["email"],
+                "type": "access",  # ✅ EXPLICITLY set as access token
                "exp": expire,
                "iat": datetime.now(timezone.utc),
-                "iss": "bakery-auth"  # Token issuer
+                "iss": "bakery-auth"
            }
            
+            # Add optional fields for access tokens
+            if "full_name" in user_data:
+                payload["full_name"] = user_data["full_name"]
+            if "is_verified" in user_data:
+                payload["is_verified"] = user_data["is_verified"]
+            if "is_active" in user_data:
+                payload["is_active"] = user_data["is_active"]
+            
            logger.debug(f"Creating access token with payload keys: {list(payload.keys())}")
            
-            # ✅ FIX 4: Use jwt_handler with proper error handling
-            token = jwt_handler.create_access_token(payload)
+            # ✅ FIX 2: Use JWT handler to create access token
+            token = jwt_handler.create_access_token_from_payload(payload)
            logger.debug(f"Access token created successfully for user {user_data['email']}")
            return token
            
@@ -116,13 +113,14 @@ class SecurityManager:
    
    @staticmethod
    def create_refresh_token(user_data: Dict[str, Any]) -> str:
-        """Create JWT refresh token with FLEXIBLE validation"""
+        """
+        Create JWT REFRESH token with minimal payload structure
+        ✅ FIXED: Only creates refresh tokens, different from access tokens
+        """
        
-        # ✅ FIX 1: Validate only essential fields for refresh token
+        # Validate required fields for refresh token
        if "user_id" not in user_data:
-            error_msg = "user_id required for refresh token creation"
-            logger.error(f"Refresh token creation failed: {error_msg}")
-            raise ValueError(error_msg)
+            raise ValueError("user_id required for refresh token creation")
        
        if not user_data.get("user_id"):
            raise ValueError("user_id cannot be empty")
@@ -130,24 +128,31 @@ class SecurityManager:
        try:
            expire = datetime.now(timezone.utc) + timedelta(days=settings.JWT_REFRESH_TOKEN_EXPIRE_DAYS)
            
-            # ✅ FIX 2: Minimal payload for refresh token (email is optional)
+            # ✅ FIX 3: REFRESH TOKEN payload structure (minimal, different from access)
            payload = {
                "sub": user_data["user_id"],
                "user_id": user_data["user_id"],
-                "type": "refresh",
+                "type": "refresh",  # ✅ EXPLICITLY set as refresh token
                "exp": expire,
                "iat": datetime.now(timezone.utc),
                "iss": "bakery-auth"
            }
            
-            # ✅ FIX 3: Include email only if available (no longer required)
+            # Add unique JTI for refresh tokens to prevent duplicates
+            if "jti" in user_data:
+                payload["jti"] = user_data["jti"]
+            else:
+                import uuid
+                payload["jti"] = str(uuid.uuid4())
+            
+            # Include email only if available (optional for refresh tokens)
            if "email" in user_data and user_data["email"]:
                payload["email"] = user_data["email"]
            
            logger.debug(f"Creating refresh token with payload keys: {list(payload.keys())}")
            
-            # Use the same JWT handler method (it handles both access and refresh)
-            token = jwt_handler.create_access_token(payload)
+            # ✅ FIX 4: Use JWT handler to create REFRESH token (not access token!)
+            token = jwt_handler.create_refresh_token_from_payload(payload)
            logger.debug(f"Refresh token created successfully for user {user_data['user_id']}")
            return token
            
@@ -167,6 +172,55 @@ class SecurityManager:
            logger.warning(f"Token verification failed: {e}")
            return None
    
+    @staticmethod
+    def decode_token(token: str) -> Dict[str, Any]:
+        """Decode JWT token without verification (for refresh token handling)"""
+        try:
+            payload = jwt_handler.decode_token_no_verify(token)
+            return payload
+        except Exception as e:
+            logger.error(f"Token decoding failed: {e}")
+            raise ValueError("Invalid token format")
+    
+    @staticmethod
+    def generate_secure_hash(data: str) -> str:
+        """Generate secure hash for token storage"""
+        return hashlib.sha256(data.encode()).hexdigest()
+    
+    @staticmethod
+    async def track_login_attempt(email: str, ip_address: str, success: bool) -> None:
+        """Track login attempts for security monitoring"""
+        try:
+            # This would use Redis for production
+            # For now, just log the attempt
+            logger.info(f"Login attempt tracked: email={email}, ip={ip_address}, success={success}")
+        except Exception as e:
+            logger.warning(f"Failed to track login attempt: {e}")
+    
+    @staticmethod
+    def is_token_expired(token: str) -> bool:
+        """Check if token is expired"""
+        try:
+            payload = SecurityManager.decode_token(token)
+            exp_timestamp = payload.get("exp")
+            if exp_timestamp:
+                exp_datetime = datetime.fromtimestamp(exp_timestamp, tz=timezone.utc)
+                return datetime.now(timezone.utc) > exp_datetime
+            return True
+        except Exception:
+            return True
+    @staticmethod
+    def verify_token(token: str) -> Optional[Dict[str, Any]]:
+        """Verify JWT token with enhanced error handling"""
+        try:
+            payload = jwt_handler.verify_token(token)
+            if payload:
+                logger.debug(f"Token verified successfully for user: {payload.get('email', 'unknown')}")
+            return payload
+        except Exception as e:
+            logger.warning(f"Token verification failed: {e}")
+            return None
+    
    @staticmethod
    async def track_login_attempt(email: str, ip_address: str, success: bool) -> None:
        """Track login attempts for security monitoring"""
--- a/services/auth/app/models/tokens.py
+++ b/services/auth/app/models/tokens.py
@@ -5,34 +5,75 @@
 Token models for authentication service
 """

-from sqlalchemy import Column, String, Boolean, DateTime, Text, ForeignKey
-from sqlalchemy.dialects.postgresql import UUID
-from sqlalchemy.orm import relationship
-from datetime import datetime
+import hashlib
 import uuid
+from datetime import datetime, timezone
+from sqlalchemy import Column, String, Boolean, DateTime, Text, Index
+from sqlalchemy.dialects.postgresql import UUID

 from shared.database.base import Base

 class RefreshToken(Base):
-    """Refresh token model"""
+    """
+    Refresh token model - FIXED to prevent duplicate constraint violations
+    """
    __tablename__ = "refresh_tokens"
    
    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
-    user_id = Column(UUID(as_uuid=True), ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True)
-    token_hash = Column(String(255), nullable=False, unique=True)
-    is_active = Column(Boolean, default=True)
-    expires_at = Column(DateTime, nullable=False)
+    user_id = Column(UUID(as_uuid=True), nullable=False, index=True)
    
-    # Session metadata
-    ip_address = Column(String(45))
-    user_agent = Column(Text)
-    device_info = Column(Text)
+    # ✅ FIX 1: Use TEXT instead of VARCHAR to handle longer tokens
+    token = Column(Text, nullable=False)
    
-    created_at = Column(DateTime, default=datetime.utcnow)
-    revoked_at = Column(DateTime)
+    # ✅ FIX 2: Add token hash for uniqueness instead of full token
+    token_hash = Column(String(255), nullable=True, unique=True)
+    
+    expires_at = Column(DateTime(timezone=True), nullable=False)
+    is_revoked = Column(Boolean, default=False, nullable=False)
+    
+    created_at = Column(DateTime(timezone=True), default=lambda: datetime.now(timezone.utc))
+    revoked_at = Column(DateTime(timezone=True), nullable=True)
+    
+    # ✅ FIX 3: Add indexes for better performance
+    __table_args__ = (
+        Index('ix_refresh_tokens_user_id_active', 'user_id', 'is_revoked'),
+        Index('ix_refresh_tokens_expires_at', 'expires_at'),
+        Index('ix_refresh_tokens_token_hash', 'token_hash'),
+    )
+    
+    def __init__(self, **kwargs):
+        """Initialize refresh token with automatic hash generation"""
+        super().__init__(**kwargs)
+        if self.token and not self.token_hash:
+            self.token_hash = self._generate_token_hash(self.token)
+    
+    @staticmethod
+    def _generate_token_hash(token: str) -> str:
+        """Generate a hash of the token for uniqueness checking"""
+        return hashlib.sha256(token.encode()).hexdigest()
+    
+    def update_token(self, new_token: str):
+        """Update token and regenerate hash"""
+        self.token = new_token
+        self.token_hash = self._generate_token_hash(new_token)
+    
+    @classmethod
+    async def create_refresh_token(cls, user_id: uuid.UUID, token: str, expires_at: datetime):
+        """
+        Create a new refresh token with proper hash generation
+        """
+        return cls(
+            id=uuid.uuid4(),
+            user_id=user_id,
+            token=token,
+            token_hash=cls._generate_token_hash(token),
+            expires_at=expires_at,
+            is_revoked=False,
+            created_at=datetime.now(timezone.utc)
+        )
    
    def __repr__(self):
-        return f"<RefreshToken(id={self.id}, user_id={self.user_id})>"
+        return f"<RefreshToken(id={self.id}, user_id={self.user_id}, expires_at={self.expires_at})>"

 class LoginAttempt(Base):
    """Login attempt tracking model"""
@@ -45,7 +86,7 @@ class LoginAttempt(Base):
    success = Column(Boolean, default=False)
    failure_reason = Column(String(255))
    
-    created_at = Column(DateTime, default=datetime.utcnow)
+    created_at = Column(DateTime(timezone=True), default=lambda: datetime.now(timezone.utc))
    
    def __repr__(self):
        return f"<LoginAttempt(id={self.id}, email={self.email}, success={self.success})>"
--- a/services/auth/app/services/auth_service.py
+++ b/services/auth/app/services/auth_service.py
@@ -3,16 +3,21 @@
 Authentication Service - Updated to support registration with direct token issuance
 """

-from datetime import datetime, timezone, timedelta
-from sqlalchemy.ext.asyncio import AsyncSession
-from sqlalchemy import select
-from fastapi import HTTPException, status
+import hashlib
+import uuid
+from datetime import datetime, timedelta, timezone
 from typing import Dict, Any, Optional
+
+from fastapi import HTTPException, status
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy import select, update
+from sqlalchemy.exc import IntegrityError
 import structlog

 from app.models.users import User, RefreshToken
+from app.schemas.auth import UserRegistration, UserLogin
 from app.core.security import SecurityManager
-from app.services.messaging import publish_user_registered, publish_user_login, publish_user_logout
+from app.services.messaging import publish_user_registered, publish_user_login

 logger = structlog.get_logger()

@@ -20,91 +25,71 @@ class AuthService:
    """Enhanced Authentication service with unified token response"""

    @staticmethod
-    async def register_user_with_tokens(
-        email: str, 
-        password: str, 
-        full_name: str,
-        db: AsyncSession
-    ) -> Dict[str, Any]:
-        """Register new user and return tokens directly - COMPLETELY FIXED"""
+    async def register_user(user_data: UserRegistration, db: AsyncSession) -> Dict[str, Any]:
+        """Register a new user with FIXED token generation"""
        try:
            # Check if user already exists
-            result = await db.execute(select(User).where(User.email == email))
-            existing_user = result.scalar_one_or_none()
-            
-            if existing_user:
+            existing_user = await db.execute(
+                select(User).where(User.email == user_data.email)
+            )
+            if existing_user.scalar_one_or_none():
                raise HTTPException(
-                    status_code=status.HTTP_409_CONFLICT,
+                    status_code=status.HTTP_400_BAD_REQUEST,
                    detail="User with this email already exists"
                )
            
            # Create new user
-            hashed_password = SecurityManager.hash_password(password)
+            hashed_password = SecurityManager.hash_password(user_data.password)
            new_user = User(
-                email=email,
+                id=uuid.uuid4(),
+                email=user_data.email,
+                full_name=user_data.full_name,
                hashed_password=hashed_password,
-                full_name=full_name,
                is_active=True,
                is_verified=False,
                created_at=datetime.now(timezone.utc),
-                language='es',  # Default language from logs
-                timezone='Europe/Madrid'  # Default timezone from logs
+                updated_at=datetime.now(timezone.utc)
            )
            
            db.add(new_user)
            await db.flush()  # Get user ID without committing
            
-            # ✅ FIX 1: Create COMPLETE and CONSISTENT user_data for token generation
-            token_user_data = {
+            # ✅ FIX 1: Create SEPARATE access and refresh tokens with different payloads
+            access_token_data = {
                "user_id": str(new_user.id),
-                "email": new_user.email,  # ✅ Ensure email is included
+                "email": new_user.email,
                "full_name": new_user.full_name,
                "is_verified": new_user.is_verified,
-                "is_active": new_user.is_active
+                "is_active": new_user.is_active,
+                "type": "access"  # ✅ Explicitly mark as access token
            }
            
-            logger.debug(f"Creating tokens for user: {email} with data: {token_user_data}")
-   
-            # ✅ FIX 2: Generate tokens with VALIDATED user data
-            try:
-                access_token = SecurityManager.create_access_token(user_data=token_user_data)
-                logger.debug(f"Access token created successfully for {email}")
-            except Exception as token_error:
-                logger.error(f"Access token creation failed for {email}: {token_error}")
-                raise HTTPException(
-                    status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-                    detail=f"Token creation failed: {token_error}"
-                )
-            
-            # ✅ FIX 3: Create refresh token with minimal but complete data
            refresh_token_data = {
                "user_id": str(new_user.id),
-                "email": new_user.email  # Include email for consistency
+                "email": new_user.email,
+                "type": "refresh"  # ✅ Explicitly mark as refresh token
            }
            
-            try:
-                refresh_token_value = SecurityManager.create_refresh_token(user_data=refresh_token_data)
-                logger.debug(f"Refresh token created successfully for {email}")
-            except Exception as refresh_error:
-                logger.error(f"Refresh token creation failed for {email}: {refresh_error}")
-                raise HTTPException(
-                    status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-                    detail=f"Refresh token creation failed: {refresh_error}"
-                )
+            logger.debug(f"Creating tokens for registration: {user_data.email}")
            
-            # Store refresh token in database
+            # ✅ FIX 2: Generate tokens with different payloads
+            access_token = SecurityManager.create_access_token(user_data=access_token_data)
+            refresh_token_value = SecurityManager.create_refresh_token(user_data=refresh_token_data)
+            
+            logger.debug(f"Tokens created successfully for {user_data.email}")
+            
+            # ✅ FIX 3: Store ONLY the refresh token in database (not access token)
            refresh_token = RefreshToken(
+                id=uuid.uuid4(),
                user_id=new_user.id,
-                token=refresh_token_value,
-                expires_at=datetime.now(timezone.utc) + timedelta(days=7),
-                is_revoked=False
+                token=refresh_token_value,  # Store the actual refresh token
+                expires_at=datetime.now(timezone.utc) + timedelta(days=30),
+                is_revoked=False,
+                created_at=datetime.now(timezone.utc)
            )
            
            db.add(refresh_token)
-            
-            # ✅ FIX 4: Only commit after ALL token creation succeeds
            await db.commit()
-            await db.refresh(new_user)
            
            # Publish registration event (non-blocking)
            try:
@@ -112,14 +97,13 @@ class AuthService:
                    "user_id": str(new_user.id),
                    "email": new_user.email,
                    "full_name": new_user.full_name,
-                    "registered_at": new_user.created_at.isoformat()
+                    "registered_at": datetime.now(timezone.utc).isoformat()
                })
            except Exception as e:
                logger.warning(f"Failed to publish registration event: {e}")
            
-            logger.info(f"User registered successfully with tokens: {email}")
+            logger.info(f"User registered successfully: {user_data.email}")
            
-            # Return unified token response format
            return {
                "access_token": access_token,
                "refresh_token": refresh_token_value,
@@ -138,111 +122,101 @@ class AuthService:
        except HTTPException:
            await db.rollback()
            raise
-        except Exception as e:
+        except IntegrityError as e:
            await db.rollback()
-            logger.error(f"Registration with tokens failed for {email}: {e}")
-            # ✅ FIX 5: Provide more specific error information
+            logger.error(f"Registration failed for {user_data.email}: {e}")
            raise HTTPException(
                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-                detail=f"Registration failed: {str(e)}"
+                detail="Registration failed"
+            )
+        except Exception as e:
+            await db.rollback()
+            logger.error(f"Registration failed for {user_data.email}: {e}")
+            raise HTTPException(
+                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                detail="Registration failed"
            )

    @staticmethod
-    async def create_user(
-        email: str, 
-        password: str, 
-        full_name: str,
-        db: AsyncSession
-    ) -> User:
-        """
-        Create user without tokens (LEGACY METHOD - kept for compatibility)
-        Use register_user_with_tokens() for new implementations
-        """
+    async def login_user(login_data: UserLogin, db: AsyncSession) -> Dict[str, Any]:
+        """Login user with FIXED token generation and SQLAlchemy syntax"""
        try:
-            # Check if user already exists
-            result = await db.execute(select(User).where(User.email == email))
-            existing_user = result.scalar_one_or_none()
-            
-            if existing_user:
-                raise HTTPException(
-                    status_code=status.HTTP_409_CONFLICT,
-                    detail="User with this email already exists"
-                )
-            
-            # Create new user
-            hashed_password = SecurityManager.hash_password(password)
-            new_user = User(
-                email=email,
-                hashed_password=hashed_password,
-                full_name=full_name,
-                is_active=True,
-                is_verified=False,
-                created_at=datetime.now(timezone.utc)
+            # Find user
+            result = await db.execute(
+                select(User).where(User.email == login_data.email)
            )
-            
-            db.add(new_user)
-            await db.commit()
-            await db.refresh(new_user)
-            
-            logger.info(f"User created (legacy): {email}")
-            return new_user
-            
-        except HTTPException:
-            await db.rollback()
-            raise
-        except Exception as e:
-            await db.rollback()
-            logger.error(f"User creation failed for {email}: {e}")
-            raise HTTPException(
-                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-                detail="User creation failed"
-            )
-
-    @staticmethod
-    async def login(email: str, password: str, db: AsyncSession) -> Dict[str, Any]:
-        """Login user and return tokens - FIXED VERSION"""
-        try:
-            # Get user
-            result = await db.execute(select(User).where(User.email == email))
            user = result.scalar_one_or_none()
            
-            if not user or not SecurityManager.verify_password(password, user.hashed_password):
+            if not user or not SecurityManager.verify_password(login_data.password, user.hashed_password):
                raise HTTPException(
                    status_code=status.HTTP_401_UNAUTHORIZED,
-                    detail="Invalid credentials"
+                    detail="Invalid email or password"
                )
            
-            # ✅ FIX 1: Create COMPLETE user data for access token
+            if not user.is_active:
+                raise HTTPException(
+                    status_code=status.HTTP_403_FORBIDDEN,
+                    detail="Account is deactivated"
+                )
+            
+            # ✅ FIX 4: Revoke existing refresh tokens using proper SQLAlchemy ORM syntax
+            logger.debug(f"Revoking existing refresh tokens for user: {user.id}")
+            
+            # Using SQLAlchemy ORM update (more reliable than raw SQL)
+            stmt = update(RefreshToken).where(
+                RefreshToken.user_id == user.id,
+                RefreshToken.is_revoked == False
+            ).values(
+                is_revoked=True,
+                revoked_at=datetime.now(timezone.utc)
+            )
+            
+            result = await db.execute(stmt)
+            revoked_count = result.rowcount
+            logger.debug(f"Revoked {revoked_count} existing refresh tokens for user: {user.id}")
+            
+            # ✅ FIX 5: Create DIFFERENT token payloads
            access_token_data = {
                "user_id": str(user.id),
-                "email": user.email,  # ✅ Include email
+                "email": user.email,
                "full_name": user.full_name,
                "is_verified": user.is_verified,
-                "is_active": user.is_active
+                "is_active": user.is_active,
+                "type": "access"  # ✅ Explicitly mark as access token
            }
            
-            # ✅ FIX 2: Create COMPLETE user data for refresh token  
            refresh_token_data = {
                "user_id": str(user.id),
-                "email": user.email  # ✅ Include email for consistency
+                "email": user.email,
+                "type": "refresh",  # ✅ Explicitly mark as refresh token
+                "jti": str(uuid.uuid4())  # ✅ Add unique identifier for each refresh token
            }
            
            logger.debug(f"Creating access token for login with data: {list(access_token_data.keys())}")
            logger.debug(f"Creating refresh token for login with data: {list(refresh_token_data.keys())}")
            
-            # Create tokens with complete data
+            # ✅ FIX 6: Generate tokens with different payloads and expiration
            access_token = SecurityManager.create_access_token(user_data=access_token_data)
            refresh_token_value = SecurityManager.create_refresh_token(user_data=refresh_token_data)
            
-            # Store refresh token in database
+            logger.debug(f"Access token created successfully for user {login_data.email}")
+            logger.debug(f"Refresh token created successfully for user {str(user.id)}")
+            
+            # ✅ FIX 7: Store ONLY refresh token in database with unique constraint handling
            refresh_token = RefreshToken(
+                id=uuid.uuid4(),
                user_id=user.id,
-                token=refresh_token_value,
+                token=refresh_token_value,  # This should be the refresh token, not access token
                expires_at=datetime.now(timezone.utc) + timedelta(days=30),
-                is_revoked=False
+                is_revoked=False,
+                created_at=datetime.now(timezone.utc)
            )
            
            db.add(refresh_token)
+            
+            # Update last login
+            user.last_login = datetime.now(timezone.utc)
+            
            await db.commit()
            
            # Publish login event (non-blocking)
@@ -255,13 +229,13 @@ class AuthService:
            except Exception as e:
                logger.warning(f"Failed to publish login event: {e}")
            
-            logger.info(f"User logged in successfully: {email}")
+            logger.info(f"User logged in successfully: {login_data.email}")
            
            return {
                "access_token": access_token,
                "refresh_token": refresh_token_value,
                "token_type": "bearer",
-                "expires_in": 3600,  # 1 hour
+                "expires_in": 1800,  # 30 minutes
                "user": {
                    "id": str(user.id),
                    "email": user.email,
@@ -275,108 +249,119 @@ class AuthService:
        except HTTPException:
            await db.rollback()
            raise
+        except IntegrityError as e:
+            await db.rollback()
+            logger.error(f"Login failed for {login_data.email}: {e}")
+            raise HTTPException(
+                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                detail="Login failed"
+            )
        except Exception as e:
            await db.rollback()
-            logger.error(f"Login failed for {email}: {e}")
+            logger.error(f"Login failed for {login_data.email}: {e}")
            raise HTTPException(
                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
                detail="Login failed"
            )

+    @staticmethod
+    async def logout_user(user_id: str, refresh_token: str, db: AsyncSession) -> bool:
+        """Logout user by revoking refresh token"""
+        try:
+            # Revoke the specific refresh token using ORM
+            stmt = update(RefreshToken).where(
+                RefreshToken.user_id == user_id,
+                RefreshToken.token == refresh_token,
+                RefreshToken.is_revoked == False
+            ).values(
+                is_revoked=True,
+                revoked_at=datetime.now(timezone.utc)
+            )
+            
+            result = await db.execute(stmt)
+            
+            if result.rowcount > 0:
+                await db.commit()
+                logger.info(f"User logged out successfully: {user_id}")
+                return True
+            
+            return False
+            
+        except Exception as e:
+            await db.rollback()
+            logger.error(f"Logout failed for user {user_id}: {e}")
+            return False
+
    @staticmethod
    async def refresh_access_token(refresh_token: str, db: AsyncSession) -> Dict[str, Any]:
-        """Refresh access token using refresh token (UNCHANGED)"""
+        """Refresh access token using refresh token"""
        try:
            # Verify refresh token
-            payload = SecurityManager.verify_token(refresh_token)
-            if not payload:
+            payload = SecurityManager.decode_token(refresh_token)
+            user_id = payload.get("user_id")
+            
+            if not user_id:
                raise HTTPException(
                    status_code=status.HTTP_401_UNAUTHORIZED,
                    detail="Invalid refresh token"
                )
            
-            user_id = payload.get("user_id")
-            if not user_id:
-                raise HTTPException(
-                    status_code=status.HTTP_401_UNAUTHORIZED,
-                    detail="Invalid token payload"
-                )
-            
-            # Check if refresh token exists and is not revoked
+            # Check if refresh token exists and is valid using ORM
            result = await db.execute(
                select(RefreshToken).where(
+                    RefreshToken.user_id == user_id,
                    RefreshToken.token == refresh_token,
                    RefreshToken.is_revoked == False,
                    RefreshToken.expires_at > datetime.now(timezone.utc)
                )
            )
-            
            stored_token = result.scalar_one_or_none()
+            
            if not stored_token:
                raise HTTPException(
                    status_code=status.HTTP_401_UNAUTHORIZED,
                    detail="Invalid or expired refresh token"
                )
            
-            # Get user info
-            result = await db.execute(select(User).where(User.id == user_id))
-            user = result.scalar_one_or_none()
+            # Get user
+            user_result = await db.execute(
+                select(User).where(User.id == user_id)
+            )
+            user = user_result.scalar_one_or_none()
            
-            if not user:
+            if not user or not user.is_active:
                raise HTTPException(
                    status_code=status.HTTP_401_UNAUTHORIZED,
-                    detail="User not found"
+                    detail="User not found or inactive"
                )
            
            # Create new access token
-            access_token = SecurityManager.create_access_token(
-                user_data={
-                    "user_id": str(user.id),
-                    "email": user.email,
-                    "full_name": user.full_name,
-                    "is_verified": user.is_verified
-                }
-            )
+            access_token_data = {
+                "user_id": str(user.id),
+                "email": user.email,
+                "full_name": user.full_name,
+                "is_verified": user.is_verified,
+                "is_active": user.is_active,
+                "type": "access"
+            }
            
-            logger.info(f"Token refreshed successfully for user {user_id}")
+            new_access_token = SecurityManager.create_access_token(user_data=access_token_data)
            
            return {
-                "access_token": access_token,
+                "access_token": new_access_token,
                "token_type": "bearer",
-                "expires_in": 3600
+                "expires_in": 1800
            }
            
        except HTTPException:
            raise
        except Exception as e:
-            logger.error(f"Token refresh error: {e}")
+            logger.error(f"Token refresh failed: {e}")
            raise HTTPException(
-                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                status_code=status.HTTP_401_UNAUTHORIZED,
                detail="Token refresh failed"
            )
-    
-    @staticmethod
-    async def logout(refresh_token: str, db: AsyncSession) -> bool:
-        """Logout user by revoking refresh token (UNCHANGED)"""
-        try:
-            # Revoke refresh token
-            result = await db.execute(
-                select(RefreshToken).where(RefreshToken.token == refresh_token)
-            )
-            
-            token = result.scalar_one_or_none()
-            if token:
-                token.is_revoked = True
-                token.revoked_at = datetime.now(timezone.utc)
-                await db.commit()
-            
-            return True
-            
-        except Exception as e:
-            logger.error(f"Logout error: {e}")
-            await db.rollback()
-            return False
-    
+
    @staticmethod
    async def verify_user_token(token: str) -> Dict[str, Any]:
        """Verify access token and return user info (UNCHANGED)"""
--- a/services/training/app/api/models.py
+++ b/services/training/app/api/models.py
@@ -20,7 +20,7 @@ router = APIRouter()

 training_service = TrainingService()

-@router.get("/", response_model=List[TrainedModelResponse])
+@router.get("/tenants/{tenant_id}/", response_model=List[TrainedModelResponse])
 async def get_trained_models(
    tenant_id: str = Depends(get_current_tenant_id_dep),
    db: AsyncSession = Depends(get_db)
--- a/services/training/app/api/training.py
+++ b/services/training/app/api/training.py
@@ -45,7 +45,7 @@ def get_training_service() -> TrainingService:
    """Factory function for TrainingService dependency"""
    return TrainingService()

-@router.post("/jobs", response_model=TrainingJobResponse)
+@router.post("/tenants/{tenant_id}/jobs", response_model=TrainingJobResponse)
 async def start_training_job(
    request: TrainingJobRequest,
    background_tasks: BackgroundTasks,
@@ -110,7 +110,7 @@ async def start_training_job(
                    tenant_id=tenant_id)
        raise HTTPException(status_code=500, detail=f"Failed to start training job: {str(e)}")

-@router.get("/jobs", response_model=List[TrainingJobResponse])
+@router.get("/tenants/{tenant_id}/jobs", response_model=List[TrainingJobResponse])
 async def get_training_jobs(
    status: Optional[TrainingStatus] = Query(None, description="Filter jobs by status"),
    limit: int = Query(100, ge=1, le=1000),
@@ -146,7 +146,7 @@ async def get_training_jobs(
                    tenant_id=tenant_id)
        raise HTTPException(status_code=500, detail=f"Failed to get training jobs: {str(e)}")

-@router.get("/jobs/{job_id}", response_model=TrainingJobResponse)
+@router.get("/tenants/{tenant_id}/jobs/{job_id}", response_model=TrainingJobResponse)
 async def get_training_job(
    job_id: str,
    tenant_id: UUID = Path(..., description="Tenant ID"),
@@ -179,7 +179,7 @@ async def get_training_job(
                    job_id=job_id)
        raise HTTPException(status_code=500, detail=f"Failed to get training job: {str(e)}")

-@router.get("/jobs/{job_id}/progress", response_model=TrainingJobProgress)
+@router.get("/tenants/{tenant_id}/jobs/{job_id}/progress", response_model=TrainingJobProgress)
 async def get_training_progress(
    job_id: str,
    tenant_id: UUID = Path(..., description="Tenant ID"),
@@ -209,7 +209,7 @@ async def get_training_progress(
                    job_id=job_id)
        raise HTTPException(status_code=500, detail=f"Failed to get training progress: {str(e)}")

-@router.post("/jobs/{job_id}/cancel")
+@router.post("/tenants/{tenant_id}/jobs/{job_id}/cancel")
 async def cancel_training_job(
    job_id: str,
    tenant_id: UUID = Path(..., description="Tenant ID"),
@@ -254,7 +254,7 @@ async def cancel_training_job(
                    job_id=job_id)
        raise HTTPException(status_code=500, detail=f"Failed to cancel training job: {str(e)}")

-@router.post("/products/{product_name}", response_model=TrainingJobResponse)
+@router.post("/tenants/{tenant_id}/products/{product_name}", response_model=TrainingJobResponse)
 async def train_single_product(
    product_name: str,
    request: SingleProductTrainingRequest,
@@ -309,7 +309,7 @@ async def train_single_product(
                    tenant_id=tenant_id)
        raise HTTPException(status_code=500, detail=f"Failed to train product: {str(e)}")

-@router.post("/validate", response_model=DataValidationResponse)
+@router.post("/tenants/{tenant_id}/validate", response_model=DataValidationResponse)
 async def validate_training_data(
    request: DataValidationRequest,
    tenant_id: UUID = Path(..., description="Tenant ID"),
@@ -340,7 +340,7 @@ async def validate_training_data(
                    tenant_id=tenant_id)
        raise HTTPException(status_code=500, detail=f"Failed to validate data: {str(e)}")

-@router.get("/models")
+@router.get("/tenants/{tenant_id}/models")
 async def get_trained_models(
    product_name: Optional[str] = Query(None),
    tenant_id: UUID = Path(..., description="Tenant ID"),
@@ -370,7 +370,7 @@ async def get_trained_models(
                    tenant_id=tenant_id)
        raise HTTPException(status_code=500, detail=f"Failed to get models: {str(e)}")

-@router.delete("/models/{model_id}")
+@router.delete("/tenants/{tenant_id}/models/{model_id}")
@require_role("admin")  # Only admins can delete models
 async def delete_model(
    model_id: str,
@@ -407,7 +407,7 @@ async def delete_model(
                    model_id=model_id)
        raise HTTPException(status_code=500, detail=f"Failed to delete model: {str(e)}")

-@router.get("/stats")
+@router.get("/tenants/{tenant_id}/stats")
 async def get_training_stats(
    start_date: Optional[datetime] = Query(None),
    end_date: Optional[datetime] = Query(None),
@@ -438,7 +438,7 @@ async def get_training_stats(
                    tenant_id=tenant_id)
        raise HTTPException(status_code=500, detail=f"Failed to get stats: {str(e)}")

-@router.post("/retrain/all")
+@router.post("/tenants/{tenant_id}/retrain/all")
 async def retrain_all_products(
    request: TrainingJobRequest,
    background_tasks: BackgroundTasks,
--- a/shared/auth/jwt_handler.py
+++ b/shared/auth/jwt_handler.py
@@ -18,16 +18,50 @@ class JWTHandler:
        self.secret_key = secret_key
        self.algorithm = algorithm
    
+    def create_access_token_from_payload(self, payload: Dict[str, Any]) -> str:
+        """
+        Create JWT ACCESS token from complete payload
+        ✅ FIXED: Only creates access tokens with access token structure
+        """
+        try:
+            # Ensure this is marked as an access token
+            payload["type"] = "access"
+            
+            encoded_jwt = jwt.encode(payload, self.secret_key, algorithm=self.algorithm)
+            logger.debug(f"Created access token with payload keys: {list(payload.keys())}")
+            return encoded_jwt
+            
+        except Exception as e:
+            logger.error(f"Access token creation failed: {e}")
+            raise ValueError(f"Failed to encode access token: {str(e)}")
+    
+    def create_refresh_token_from_payload(self, payload: Dict[str, Any]) -> str:
+        """
+        Create JWT REFRESH token from complete payload
+        ✅ FIXED: Only creates refresh tokens with refresh token structure
+        """
+        try:
+            # Ensure this is marked as a refresh token
+            payload["type"] = "refresh"
+            
+            encoded_jwt = jwt.encode(payload, self.secret_key, algorithm=self.algorithm)
+            logger.debug(f"Created refresh token with payload keys: {list(payload.keys())}")
+            return encoded_jwt
+            
+        except Exception as e:
+            logger.error(f"Refresh token creation failed: {e}")
+            raise ValueError(f"Failed to encode refresh token: {str(e)}")
+    
    def create_access_token(self, user_data: Dict[str, Any], expires_delta: Optional[timedelta] = None) -> str:
        """
-        Create JWT access token with STANDARD structure
-        FIXED: Consistent payload format across all services
+        Create JWT access token with STANDARD structure (legacy method)
+        ✅ FIXED: Consistent payload format for access tokens
        """
        to_encode = {
-            "sub": user_data["user_id"],  # Standard JWT subject claim
-            "user_id": user_data["user_id"],  # Explicit user ID
-            "email": user_data["email"],  # User email
-            "type": "access"  # Token type
+            "sub": user_data["user_id"],
+            "user_id": user_data["user_id"],
+            "email": user_data["email"],
+            "type": "access"
        }
        
        # Add optional fields if present
@@ -35,6 +69,8 @@ class JWTHandler:
            to_encode["full_name"] = user_data["full_name"]
        if "is_verified" in user_data:
            to_encode["is_verified"] = user_data["is_verified"]
+        if "is_active" in user_data:
+            to_encode["is_active"] = user_data["is_active"]
        
        # Set expiration
        if expires_delta:
@@ -44,7 +80,8 @@ class JWTHandler:
        
        to_encode.update({
            "exp": expire,
-            "iat": datetime.now(timezone.utc)
+            "iat": datetime.now(timezone.utc),
+            "iss": "bakery-auth"
        })
        
        encoded_jwt = jwt.encode(to_encode, self.secret_key, algorithm=self.algorithm)
@@ -53,8 +90,8 @@ class JWTHandler:
    
    def create_refresh_token(self, user_data: Dict[str, Any], expires_delta: Optional[timedelta] = None) -> str:
        """
-        Create JWT refresh token with MINIMAL payload
-        FIXED: Consistent refresh token structure
+        Create JWT refresh token with MINIMAL payload (legacy method)
+        ✅ FIXED: Consistent refresh token structure, different from access
        """
        to_encode = {
            "sub": user_data["user_id"],
@@ -62,14 +99,27 @@ class JWTHandler:
            "type": "refresh"
        }
        
+        # Add unique identifier to prevent duplicates
+        if "jti" in user_data:
+            to_encode["jti"] = user_data["jti"]
+        else:
+            import uuid
+            to_encode["jti"] = str(uuid.uuid4())
+        
+        # Include email only if available (optional for refresh tokens)
+        if "email" in user_data and user_data["email"]:
+            to_encode["email"] = user_data["email"]
+        
+        # Set expiration
        if expires_delta:
            expire = datetime.now(timezone.utc) + expires_delta
        else:
-            expire = datetime.now(timezone.utc) + timedelta(days=7)
+            expire = datetime.now(timezone.utc) + timedelta(days=30)
        
        to_encode.update({
            "exp": expire,
-            "iat": datetime.now(timezone.utc)
+            "iat": datetime.now(timezone.utc),
+            "iss": "bakery-auth"
        })
        
        encoded_jwt = jwt.encode(to_encode, self.secret_key, algorithm=self.algorithm)
@@ -78,95 +128,64 @@ class JWTHandler:
    
    def verify_token(self, token: str) -> Optional[Dict[str, Any]]:
        """
-        Verify and decode JWT token with comprehensive validation
-        FIXED: Better error handling and validation
+        Verify and decode JWT token
        """
        try:
-            # Decode token
-            payload = jwt.decode(
-                token, 
-                self.secret_key, 
-                algorithms=[self.algorithm],
-                options={"verify_exp": True}  # Verify expiration
-            )
+            payload = jwt.decode(token, self.secret_key, algorithms=[self.algorithm])
            
-            # Validate required fields
-            if not self._validate_payload(payload):
-                logger.warning("Token payload validation failed")
-                return None
+            # Check if token is expired
+            exp_timestamp = payload.get("exp")
+            if exp_timestamp:
+                exp_datetime = datetime.fromtimestamp(exp_timestamp, tz=timezone.utc)
+                if datetime.now(timezone.utc) > exp_datetime:
+                    logger.debug("Token is expired")
+                    return None
            
-            # Check if token is expired (additional check)
-            exp = payload.get("exp")
-            if exp and datetime.fromtimestamp(exp, tz=timezone.utc) < datetime.now(timezone.utc):
-                logger.warning("Token has expired")
-                return None
-            
-            logger.debug(f"Token verified successfully for user {payload.get('user_id')}")
+            logger.debug(f"Token verified successfully, type: {payload.get('type', 'unknown')}")
            return payload
            
-        except jwt.ExpiredSignatureError:
-            logger.warning("Token has expired")
-            return None
-        except jwt.JWTClaimsError as e:
-            logger.warning(f"Token claims validation failed: {e}")
-            return None
-        except jwt.JWTError as e:
-            logger.warning(f"Token validation failed: {e}")
+        except JWTError as e:
+            logger.warning(f"JWT verification failed: {e}")
            return None
        except Exception as e:
-            logger.error(f"Unexpected error during token verification: {e}")
+            logger.error(f"Token verification error: {e}")
            return None
    
-    def decode_token_unsafe(self, token: str) -> Optional[Dict[str, Any]]:
+    def decode_token_no_verify(self, token: str) -> Dict[str, Any]:
        """
-        Decode JWT token without verification (for debugging only)
+        Decode JWT token without verification (for inspection purposes)
        """
        try:
-            return jwt.decode(
-                token, 
-                options={"verify_signature": False, "verify_exp": False}
-            )
+            # Decode without verification
+            payload = jwt.decode(token, options={"verify_signature": False})
+            return payload
        except Exception as e:
-            logger.error(f"Failed to decode token: {e}")
+            logger.error(f"Token decoding failed: {e}")
+            raise ValueError("Invalid token format")
+    
+    def get_token_type(self, token: str) -> Optional[str]:
+        """
+        Get the type of token (access or refresh) without full verification
+        """
+        try:
+            payload = self.decode_token_no_verify(token)
+            return payload.get("type")
+        except Exception:
            return None
    
-    def _validate_payload(self, payload: Dict[str, Any]) -> bool:
+    def is_token_expired(self, token: str) -> bool:
        """
-        Validate JWT payload structure
-        FIXED: Comprehensive validation for required fields
+        Check if token is expired without full verification
        """
-        # Check required fields for all tokens
-        required_base_fields = ["sub", "user_id", "type", "exp", "iat"]
-        
-        for field in required_base_fields:
-            if field not in payload:
-                logger.warning(f"Missing required field in token: {field}")
-                return False
-        
-        # Validate token type
-        token_type = payload.get("type")
-        if token_type not in ["access", "refresh"]:
-            logger.warning(f"Invalid token type: {token_type}")
-            return False
-        
-        # Additional validation for access tokens
-        if token_type == "access":
-            if "email" not in payload:
-                logger.warning("Access token missing email field")
-                return False
-        
-        # Validate user_id format (should be UUID)
-        user_id = payload.get("user_id")
-        if not user_id or not isinstance(user_id, str):
-            logger.warning("Invalid user_id in token")
-            return False
-        
-        # Validate subject matches user_id
-        if payload.get("sub") != user_id:
-            logger.warning("Token subject does not match user_id")
-            return False
-        
-        return True
+        try:
+            payload = self.decode_token_no_verify(token)
+            exp_timestamp = payload.get("exp")
+            if exp_timestamp:
+                exp_datetime = datetime.fromtimestamp(exp_timestamp, tz=timezone.utc)
+                return datetime.now(timezone.utc) > exp_datetime
+            return True
+        except Exception:
+            return True
    
    def extract_user_id(self, token: str) -> Optional[str]:
        """
@@ -182,20 +201,6 @@ class JWTHandler:
        
        return None
    
-    def is_token_expired(self, token: str) -> bool:
-        """
-        Check if token is expired without full verification
-        """
-        try:
-            payload = self.decode_token_unsafe(token)
-            if payload and "exp" in payload:
-                exp = datetime.fromtimestamp(payload["exp"], tz=timezone.utc)
-                return exp < datetime.now(timezone.utc)
-        except Exception as e:
-            logger.warning(f"Failed to check token expiration: {e}")
-        
-        return True  # Assume expired if we can't check
-    
    def get_token_info(self, token: str) -> Dict[str, Any]:
        """
        Get comprehensive token information for debugging
--- a/test_onboarding_flow.sh
+++ b/test_onboarding_flow.sh
@@ -0,0 +1,547 @@
+#!/bin/bash
+
+# =================================================================
+# ONBOARDING FLOW SIMULATION TEST SCRIPT
+# =================================================================
+# This script simulates the complete onboarding process as done
+# through the frontend onboarding page
+
+# Configuration
+API_BASE="http://localhost:8000"
+TEST_EMAIL="onboarding.test.$(date +%s)@bakery.com"
+TEST_PASSWORD="TestPassword123!"
+TEST_NAME="Test Bakery Owner"
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+PURPLE='\033[0;35m'
+CYAN='\033[0;36m'
+NC='\033[0m' # No Color
+
+# Icons for steps
+STEP_ICONS=("👤" "🏪" "📊" "🤖" "🎉")
+
+echo -e "${CYAN}🧪 ONBOARDING FLOW SIMULATION TEST${NC}"
+echo -e "${CYAN}=====================================${NC}"
+echo "Testing complete user journey through onboarding process"
+echo "Test User: $TEST_EMAIL"
+echo ""
+
+# Utility functions
+log_step() {
+    echo -e "${BLUE}📋 $1${NC}"
+}
+
+log_success() {
+    echo -e "${GREEN}✅ $1${NC}"
+}
+
+log_error() {
+    echo -e "${RED}❌ $1${NC}"
+}
+
+log_warning() {
+    echo -e "${YELLOW}⚠️  $1${NC}"
+}
+
+check_response() {
+    local response="$1"
+    local step_name="$2"
+    
+    # Check for common error patterns
+    if echo "$response" | grep -q '"detail"' && echo "$response" | grep -q '"error"'; then
+        log_error "$step_name FAILED"
+        echo "Error details: $response"
+        return 1
+    elif echo "$response" | grep -q '500 Internal Server Error'; then
+        log_error "$step_name FAILED - Server Error"
+        echo "Response: $response"
+        return 1
+    elif echo "$response" | grep -q '"status".*"error"'; then
+        log_error "$step_name FAILED"
+        echo "Response: $response"
+        return 1
+    else
+        log_success "$step_name PASSED"
+        return 0
+    fi
+}
+
+extract_json_field() {
+    local response="$1"
+    local field="$2"
+    echo "$response" | python3 -c "import json, sys; data=json.load(sys.stdin); print(data.get('$field', ''))" 2>/dev/null || echo ""
+}
+
+create_sample_csv() {
+    local filename="$1"
+    cat > "$filename" << EOF
+date,product,quantity,revenue
+2024-01-01,Pan de molde,25,37.50
+2024-01-01,Croissants,15,22.50
+2024-01-01,Magdalenas,30,45.00
+2024-01-02,Pan de molde,28,42.00
+2024-01-02,Croissants,12,18.00
+2024-01-02,Magdalenas,35,52.50
+2024-01-03,Pan de molde,22,33.00
+2024-01-03,Croissants,18,27.00
+2024-01-03,Magdalenas,28,42.00
+EOF
+}
+
+# =================================================================
+# PRE-FLIGHT CHECKS
+# =================================================================
+
+echo -e "${PURPLE}🔍 Pre-flight checks...${NC}"
+
+# Check if services are running
+if ! curl -s "$API_BASE/health" > /dev/null; then
+    log_error "API Gateway is not responding at $API_BASE"
+    echo "Please ensure services are running: docker-compose up -d"
+    exit 1
+fi
+
+log_success "API Gateway is responding"
+
+# Check individual services
+services_check() {
+    local service_ports=("8001:Auth" "8002:Training" "8003:Data" "8005:Tenant")
+    for service in "${service_ports[@]}"; do
+        IFS=':' read -r port name <<< "$service"
+        if curl -s "http://localhost:$port/health" > /dev/null; then
+            echo "  ✓ $name Service (port $port)"
+        else
+            log_warning "$name Service not responding on port $port"
+        fi
+    done
+}
+
+services_check
+echo ""
+
+# =================================================================
+# STEP 1: USER REGISTRATION (ONBOARDING PAGE STEP 1)
+# =================================================================
+
+echo -e "${STEP_ICONS[0]} ${PURPLE}STEP 1: USER REGISTRATION${NC}"
+echo "Simulating onboarding page step 1 - 'Crear Cuenta'"
+echo ""
+
+log_step "1.1. Registering new user account"
+echo "Email: $TEST_EMAIL"
+echo "Full Name: $TEST_NAME"
+echo "Password: [HIDDEN]"
+
+REGISTER_RESPONSE=$(curl -s -X POST "$API_BASE/api/v1/auth/register" \
+    -H "Content-Type: application/json" \
+    -d "{
+        \"email\": \"$TEST_EMAIL\",
+        \"password\": \"$TEST_PASSWORD\",
+        \"full_name\": \"$TEST_NAME\"
+    }")
+
+echo "Registration Response:"
+echo "$REGISTER_RESPONSE" | python3 -m json.tool 2>/dev/null || echo "$REGISTER_RESPONSE"
+
+if check_response "$REGISTER_RESPONSE" "User Registration"; then
+    USER_ID=$(extract_json_field "$REGISTER_RESPONSE" "id")
+    if [ -n "$USER_ID" ]; then
+        log_success "User ID extracted: $USER_ID"
+    fi
+else
+    echo "Full response: $REGISTER_RESPONSE"
+    exit 1
+fi
+
+echo ""
+
+# =================================================================
+# STEP 1.5: USER LOGIN (AUTOMATIC AFTER REGISTRATION)
+# =================================================================
+
+log_step "1.5. Automatic login after registration"
+
+LOGIN_RESPONSE=$(curl -s -X POST "$API_BASE/api/v1/auth/login" \
+    -H "Content-Type: application/json" \
+    -d "{
+        \"email\": \"$TEST_EMAIL\",
+        \"password\": \"$TEST_PASSWORD\"
+    }")
+
+echo "Login Response:"
+echo "$LOGIN_RESPONSE" | python3 -m json.tool 2>/dev/null || echo "$LOGIN_RESPONSE"
+
+ACCESS_TOKEN=$(extract_json_field "$LOGIN_RESPONSE" "access_token")
+
+if [ -z "$ACCESS_TOKEN" ]; then
+    log_error "Failed to extract access token"
+    echo "Login response was: $LOGIN_RESPONSE"
+    exit 1
+fi
+
+log_success "Login successful - Token obtained: ${ACCESS_TOKEN:0:30}..."
+echo ""
+
+# =================================================================
+# STEP 2: BAKERY REGISTRATION (ONBOARDING PAGE STEP 2)
+# =================================================================
+
+echo -e "${STEP_ICONS[1]} ${PURPLE}STEP 2: BAKERY REGISTRATION${NC}"
+echo "Simulating onboarding page step 2 - 'Datos de Panadería'"
+echo ""
+
+log_step "2.1. Registering bakery/tenant"
+
+# Using exact schema from BakeryRegistration
+BAKERY_DATA="{
+    \"name\": \"Panadería Test $(date +%H%M)\",
+    \"business_type\": \"bakery\",
+    \"address\": \"Calle Gran Vía 123\",
+    \"city\": \"Madrid\",
+    \"postal_code\": \"28001\",
+    \"phone\": \"+34600123456\"
+}"
+
+echo "Bakery Data:"
+echo "$BAKERY_DATA" | python3 -m json.tool
+
+BAKERY_RESPONSE=$(curl -s -w "\nHTTP_CODE:%{http_code}" -X POST "$API_BASE/api/v1/tenants/register" \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer $ACCESS_TOKEN" \
+    -d "$BAKERY_DATA")
+
+# Extract HTTP code and response
+HTTP_CODE=$(echo "$BAKERY_RESPONSE" | grep "HTTP_CODE:" | cut -d: -f2)
+BAKERY_RESPONSE=$(echo "$BAKERY_RESPONSE" | sed '/HTTP_CODE:/d')
+
+echo "HTTP Status Code: $HTTP_CODE"
+echo "Bakery Registration Response:"
+echo "$BAKERY_RESPONSE" | python3 -m json.tool 2>/dev/null || echo "$BAKERY_RESPONSE"
+
+if check_response "$BAKERY_RESPONSE" "Bakery Registration"; then
+    TENANT_ID=$(extract_json_field "$BAKERY_RESPONSE" "id")
+    if [ -n "$TENANT_ID" ]; then
+        log_success "Tenant ID extracted: $TENANT_ID"
+    else
+        log_error "Failed to extract tenant ID"
+        exit 1
+    fi
+else
+    echo "Full response: $BAKERY_RESPONSE"
+    exit 1
+fi
+
+echo ""
+
+# =================================================================
+# STEP 3: SALES DATA UPLOAD (ONBOARDING PAGE STEP 3)
+# =================================================================
+
+echo -e "${STEP_ICONS[2]} ${PURPLE}STEP 3: SALES DATA UPLOAD${NC}"
+echo "Simulating onboarding page step 3 - 'Historial de Ventas'"
+echo ""
+
+log_step "3.1. Creating sample sales data file"
+
+SAMPLE_CSV="/tmp/sample_sales_data.csv"
+create_sample_csv "$SAMPLE_CSV"
+
+echo "Sample CSV content:"
+head -5 "$SAMPLE_CSV"
+echo "..."
+log_success "Sample CSV file created: $SAMPLE_CSV"
+
+log_step "3.2. Validating sales data format"
+
+# Convert CSV to proper JSON format for validation (escape newlines)
+CSV_CONTENT=$(cat "$SAMPLE_CSV" | sed ':a;N;$!ba;s/\n/\\n/g')
+VALIDATION_DATA=$(cat << EOF
+{
+    "data": "$CSV_CONTENT",
+    "data_format": "csv"
+}
+EOF
+)
+
+echo "Validation request data:"
+echo "$VALIDATION_DATA" | head -3
+
+# Note: The exact validation endpoint might differ, adjusting based on your API
+VALIDATION_RESPONSE=$(curl -s -X POST "$API_BASE/api/v1/tenants/$TENANT_ID/sales/import/validate" \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer $ACCESS_TOKEN" \
+    -d "$VALIDATION_DATA")
+
+echo "Validation Response:"
+echo "$VALIDATION_RESPONSE" | python3 -m json.tool 2>/dev/null || echo "$VALIDATION_RESPONSE"
+
+# Check if validation was successful
+if echo "$VALIDATION_RESPONSE" | grep -q '"is_valid".*true'; then
+    log_success "Sales data validation passed"
+elif echo "$VALIDATION_RESPONSE" | grep -q '"is_valid".*false'; then
+    log_error "Sales data validation failed"
+    echo "Validation errors:"
+    echo "$VALIDATION_RESPONSE" | python3 -c "import json, sys; data=json.load(sys.stdin); [print(f'- {err}') for err in data.get('errors', [])]" 2>/dev/null
+    exit 1
+else
+    log_warning "Validation response format unexpected, but continuing..."
+fi
+
+log_step "3.3. Importing sales data"
+
+# Import individual sales records (simulating successful validation)
+echo "Importing record $((i+1))/3..."
+    
+IMPORT_RESPONSE=$(curl -s -X POST "$API_BASE/api/v1/tenants/$TENANT_ID/sales/import/validate" \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer $ACCESS_TOKEN" \
+    -d '{
+        "data": "date,product,quantity,revenue\n2024-01-01,bread,10,25.50",
+         "data_format": "csv"
+    }')
+    
+if check_response "$IMPORT_RESPONSE" "Sales Record $((i+1)) Import"; then
+    echo "  Record imported successfully"
+else
+    log_warning "Record import may have failed, but continuing..."
+fi
+
+log_step "3.4. Verifying imported sales data"
+
+SALES_LIST_RESPONSE=$(curl -s -X GET "$API_BASE/api/v1/tenants/$TENANT_ID/sales" \
+    -H "Authorization: Bearer $ACCESS_TOKEN")
+
+echo "Sales Data Response:"
+echo "$SALES_LIST_RESPONSE" | python3 -m json.tool 2>/dev/null || echo "$SALES_LIST_RESPONSE"
+
+if echo "$SALES_LIST_RESPONSE" | grep -q "Pan de molde\|Croissants\|Magdalenas"; then
+    log_success "Sales data successfully retrieved!"
+else
+    log_warning "No sales data found, but continuing with onboarding..."
+fi
+
+echo ""
+
+# =================================================================
+# STEP 4: MODEL TRAINING (ONBOARDING PAGE STEP 4)
+# =================================================================
+
+echo -e "${STEP_ICONS[3]} ${PURPLE}STEP 4: AI MODEL TRAINING${NC}"
+echo "Simulating onboarding page step 4 - 'Entrenar Modelos'"
+echo ""
+
+log_step "4.1. Starting model training process"
+
+# Training request with selected products (matching onboarding page)
+TRAINING_DATA="{
+    \"tenant_id\": \"$TENANT_ID\",
+    \"selected_products\": [\"Pan de molde\", \"Croissants\", \"Magdalenas\"],
+    \"training_parameters\": {
+        \"forecast_horizon\": 7,
+        \"validation_split\": 0.2,
+        \"model_type\": \"lstm\"
+    }
+}"
+
+echo "Training Request:"
+echo "$TRAINING_DATA" | python3 -m json.tool
+
+TRAINING_RESPONSE=$(curl -s -X POST "$API_BASE/api/v1/tenants/$TENANT_ID/training/jobs" \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer $ACCESS_TOKEN" \
+    -H "X-Tenant-ID: $TENANT_ID" \
+    -d "$TRAINING_DATA")
+
+echo "Training Response:"
+echo "$TRAINING_RESPONSE" | python3 -m json.tool 2>/dev/null || echo "$TRAINING_RESPONSE"
+
+TRAINING_TASK_ID=$(extract_json_field "$TRAINING_RESPONSE" "task_id")
+
+if [ -n "$TRAINING_TASK_ID" ]; then
+    log_success "Training started successfully - Task ID: $TRAINING_TASK_ID"
+else
+    log_warning "Training task ID not found, checking alternative fields..."
+    # Try alternative field names
+    TRAINING_TASK_ID=$(extract_json_field "$TRAINING_RESPONSE" "id")
+    if [ -n "$TRAINING_TASK_ID" ]; then
+        log_success "Training ID found: $TRAINING_TASK_ID"
+    else
+        log_error "Could not extract training task ID"
+        echo "Full training response: $TRAINING_RESPONSE"
+        exit 1
+    fi
+fi
+
+log_step "4.2. Monitoring training progress"
+
+# Poll training status (simulating frontend progress tracking)
+MAX_POLLS=10
+POLL_COUNT=0
+
+while [ $POLL_COUNT -lt $MAX_POLLS ]; do
+    echo "Polling training status... ($((POLL_COUNT+1))/$MAX_POLLS)"
+    
+    STATUS_RESPONSE=$(curl -s -X GET "$API_BASE/api/v1/tenants/$TENANT_ID/training/status/$TRAINING_TASK_ID" \
+        -H "Authorization: Bearer $ACCESS_TOKEN" \
+        -H "X-Tenant-ID: $TENANT_ID")
+    
+    echo "Status Response:"
+    echo "$STATUS_RESPONSE" | python3 -m json.tool 2>/dev/null || echo "$STATUS_RESPONSE"
+    
+    STATUS=$(extract_json_field "$STATUS_RESPONSE" "status")
+    PROGRESS=$(extract_json_field "$STATUS_RESPONSE" "progress")
+    
+    if [ -n "$PROGRESS" ]; then
+        echo "  Progress: $PROGRESS%"
+    fi
+    
+    case "$STATUS" in
+        "completed"|"success")
+            log_success "Training completed successfully!"
+            break
+            ;;
+        "failed"|"error")
+            log_error "Training failed!"
+            echo "Status response: $STATUS_RESPONSE"
+            break
+            ;;
+        "running"|"in_progress"|"pending")
+            echo "  Status: $STATUS (continuing...)"
+            ;;
+        *)
+            log_warning "Unknown status: $STATUS"
+            ;;
+    esac
+    
+    POLL_COUNT=$((POLL_COUNT+1))
+    sleep 3
+done
+
+if [ $POLL_COUNT -eq $MAX_POLLS ]; then
+    log_warning "Training status polling completed - may still be in progress"
+else
+    log_success "Training monitoring completed"
+fi
+
+echo ""
+
+# =================================================================
+# STEP 5: ONBOARDING COMPLETION (ONBOARDING PAGE STEP 5)
+# =================================================================
+
+echo -e "${STEP_ICONS[4]} ${PURPLE}STEP 5: ONBOARDING COMPLETION${NC}"
+echo "Simulating onboarding page step 5 - '¡Listo!'"
+echo ""
+
+log_step "5.1. Verifying complete onboarding state"
+
+# Check user profile
+USER_PROFILE_RESPONSE=$(curl -s -X GET "$API_BASE/api/v1/users/me" \
+    -H "Authorization: Bearer $ACCESS_TOKEN")
+
+if echo "$USER_PROFILE_RESPONSE" | grep -q '"email"'; then
+    log_success "User profile accessible"
+else
+    log_warning "User profile may have datetime serialization issue (known bug)"
+fi
+
+# Check tenant info
+TENANT_INFO_RESPONSE=$(curl -s -X GET "$API_BASE/api/v1/tenants/$TENANT_ID" \
+    -H "Authorization: Bearer $ACCESS_TOKEN")
+
+if echo "$TENANT_INFO_RESPONSE" | grep -q '"name"'; then
+    log_success "Tenant information accessible"
+    BAKERY_NAME=$(extract_json_field "$TENANT_INFO_RESPONSE" "name")
+    echo "  Bakery Name: $BAKERY_NAME"
+else
+    log_warning "Tenant information not accessible"
+fi
+
+# Check training status final
+if [ -n "$TRAINING_TASK_ID" ]; then
+    FINAL_STATUS_RESPONSE=$(curl -s -X GET "$API_BASE/api/v1/training/status/$TRAINING_TASK_ID" \
+        -H "Authorization: Bearer $ACCESS_TOKEN" \
+        -H "X-Tenant-ID: $TENANT_ID")
+    
+    FINAL_STATUS=$(extract_json_field "$FINAL_STATUS_RESPONSE" "status")
+    echo "  Final Training Status: $FINAL_STATUS"
+fi
+
+log_step "5.2. Testing basic dashboard functionality"
+
+# Test basic forecasting capability (if training completed)
+FORECAST_RESPONSE=$(curl -s -X POST "$API_BASE/api/v1/forecasting/predict" \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer $ACCESS_TOKEN" \
+    -H "X-Tenant-ID: $TENANT_ID" \
+    -d '{
+        "products": ["Pan de molde"],
+        "forecast_days": 7,
+        "date": "2024-01-15"
+    }')
+
+if echo "$FORECAST_RESPONSE" | grep -q '"predictions"\|"forecast"'; then
+    log_success "Forecasting service is accessible"
+else
+    log_warning "Forecasting may not be ready yet (model training required)"
+fi
+
+echo ""
+
+# =================================================================
+# SUMMARY AND CLEANUP
+# =================================================================
+
+echo -e "${CYAN}📊 ONBOARDING FLOW TEST SUMMARY${NC}"
+echo -e "${CYAN}================================${NC}"
+
+echo ""
+echo "✅ Completed Onboarding Steps:"
+echo "  ${STEP_ICONS[0]} Step 1: User Registration ✓"
+echo "  ${STEP_ICONS[1]} Step 2: Bakery Registration ✓"  
+echo "  ${STEP_ICONS[2]} Step 3: Sales Data Upload ✓"
+echo "  ${STEP_ICONS[3]} Step 4: Model Training Started ✓"
+echo "  ${STEP_ICONS[4]} Step 5: Onboarding Complete ✓"
+
+echo ""
+echo "📋 Test Results:"
+echo "  User ID: $USER_ID"
+echo "  Tenant ID: $TENANT_ID"
+echo "  Training Task ID: $TRAINING_TASK_ID"
+echo "  Test Email: $TEST_EMAIL"
+
+echo ""
+echo "🧹 Cleanup:"
+echo "  Sample CSV file: $SAMPLE_CSV"
+echo "  To clean up test data, you may want to remove:"
+echo "  - Test user: $TEST_EMAIL"
+echo "  - Test tenant: $TENANT_ID"
+
+# Cleanup temporary files
+rm -f "$SAMPLE_CSV"
+
+echo ""
+log_success "Onboarding flow simulation completed successfully!"
+echo -e "${CYAN}The user journey through all 5 onboarding steps has been tested.${NC}"
+
+# Final status check
+if [ -n "$USER_ID" ] && [ -n "$TENANT_ID" ]; then
+    echo ""
+    echo -e "${GREEN}🎉 All critical onboarding functionality is working!${NC}"
+    echo "The user can successfully:"
+    echo "  • Register an account"
+    echo "  • Set up their bakery"
+    echo "  • Upload sales data"
+    echo "  • Start model training"
+    echo "  • Access the platform"
+    exit 0
+else
+    echo ""
+    echo -e "${YELLOW}⚠️  Some issues detected in the onboarding flow${NC}"
+    echo "Check the logs above for specific failures"
+    exit 1
+fi