Inyeon

@@ -15,8 +15,21 @@ class AuthService:
     def __init__(self, db: Database):
         self.db = db
-        self.secret = "hardcoded"
+        self.secret = os.environ.get("JWT_SECRET")
+        self.session_timeout = 3600
+        self.active_sessions: dict[str, Session] = {}
-    def login(self, user, pwd):
-        if self.db.check(user, pwd):
-            return True
+    def login(self, username: str, password: str) -> str | None:
+        """Authenticate user and create session."""
+        user = self.db.verify_credentials(username, password)
+        if user:
+            session_id = self._create_session(user.id)
+            return session_id
+        return None
+    def _create_session(self, user_id: int) -> str:
+        session_id = secrets.token_urlsafe(32)
+        self.active_sessions[session_id] = Session(
+            user_id=user_id,
+            expires_at=time.time() + self.session_timeout
+        )
+        return session_id