05/02/2026 updated code for security 2

app/services/auth_service.py

@@ -4,7 +4,7 @@ import hmac
 import os
 import uuid
 import time
-from datetime import datetime, timedelta
+from datetime import datetime, timedelta, timezone
 from functools import wraps
 
 import jwt
@@ -72,7 +72,7 @@ def decrypt_totp_secret(ciphertext_b64: str, iv_b64: str) -> str:
 
 def generate_tokens(user_id: int) -> dict:
     """Return access_token and refresh_token JWTs, each with a unique jti."""
-    now = datetime.utcnow()
+    now = datetime.now(timezone.utc).replace(tzinfo=None)
     secret = current_app.config['JWT_SECRET_KEY']
     access_payload = {
         'sub': str(user_id),
@@ -96,7 +96,7 @@ def generate_tokens(user_id: int) -> dict:
 
 def generate_mfa_token(user_id: int) -> str:
     """Short-lived (5-min) single-use token issued after password but before TOTP."""
-    now = datetime.utcnow()
+    now = datetime.now(timezone.utc).replace(tzinfo=None)
     payload = {
         'sub': str(user_id),
         'type': 'mfa',
@@ -129,7 +129,7 @@ def blacklist_token(token: str, token_type: str) -> None:
         if not jti:
             return
         exp = payload.get('exp')
-        expires_at = datetime.utcfromtimestamp(exp) if exp else datetime.utcnow() + timedelta(days=7)
+        expires_at = datetime.fromtimestamp(exp) if exp else datetime.now(timezone.utc).replace(tzinfo=None) + timedelta(days=7, tz=timezone.utc).replace(tzinfo=None)
         from app.models.token_blacklist import TokenBlacklist
         from app import db
         # Avoid duplicate if already blacklisted
@@ -279,4 +279,4 @@ def verify_and_consume_backup_code(hashed_codes: list[str], candidate: str) -> t
         return False, hashed_codes
 
     remaining = [h for i, h in enumerate(hashed_codes) if i != matched_index]
-    return True, remaining
+    return True, remaining