Address security concerns and PR review feedback

Security improvements:
- Implement OAuth CSRF protection with secure state parameter management
- Add proper validation and expiration for OAuth state tokens
- Add security warnings for SECRET_KEY configuration in production
- Sanitize database error logging to prevent sensitive info exposure

Code quality fixes:
- Fix missing import for get_user function in refresh endpoint
- Fix async/await usage in get_current_user_optional
- Standardize is_active default value to True across models
- Add security documentation for shell=True usage
- Update Alembic config to clarify placeholder database URL

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: User

backend/alembic.ini

@@ -35,8 +35,10 @@ sourceless = false
 # are written from script.py.mako
 output_encoding = utf-8
 
-# Database connection string (overridden by env.py)
-sqlalchemy.url = postgresql://postgres:postgres@localhost:5432/copilot
+# Database connection string
+# IMPORTANT: This value is overridden by env.py which uses the database URL from environment variables
+# The value below is just a placeholder and should NOT contain production credentials
+sqlalchemy.url = postgresql://user:pass@localhost/dbname
 
 # Logging configuration
 [loggers]

backend/app/alembic/versions/2025_05_26_1343_add_oauth_state_table_for_csrf_.py

@@ -0,0 +1,48 @@
+"""add_oauth_state_table_for_csrf_protection
+
+Revision ID: 87ddaa4fab90
+Revises: 1a31ce608336
+Create Date: 2025-05-26 13:43:36.423557+00:00
+
+"""
+from alembic import op
+import sqlalchemy as sa
+import sqlmodel.sql.sqltypes
+from sqlalchemy.dialects import postgresql
+
+
+# revision identifiers, used by Alembic.
+revision = '87ddaa4fab90'
+down_revision = '1a31ce608336'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    # Create oauth_state table
+    op.create_table(
+        'oauthstate',
+        sa.Column('state_token', sa.String(), nullable=False),
+        sa.Column('provider', sa.String(length=50), nullable=False),
+        sa.Column('redirect_uri', sa.String(length=500), nullable=False),
+        sa.Column('expires_at', sa.DateTime(timezone=True), nullable=False),
+        sa.Column('used', sa.Boolean(), nullable=False, server_default='false'),
+        sa.Column('id', sa.UUID(), nullable=False),
+        sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
+        sa.PrimaryKeyConstraint('id')
+    )
+    
+    # Create indexes
+    op.create_index(op.f('ix_oauthstate_state_token'), 'oauthstate', ['state_token'], unique=True)
+    
+    # Create index for cleanup queries
+    op.create_index('ix_oauthstate_expires_at', 'oauthstate', ['expires_at'])
+
+
+def downgrade():
+    # Drop indexes
+    op.drop_index('ix_oauthstate_expires_at', table_name='oauthstate')
+    op.drop_index(op.f('ix_oauthstate_state_token'), table_name='oauthstate')
+    
+    # Drop table
+    op.drop_table('oauthstate')

backend/app/api/routes/auth/auth.py

@@ -10,7 +10,7 @@
 from app.db import get_db
 from app.models import User
 from app.schemas.auth import Token, UserLogin, UserRegister, UserOut, PasswordResetRequest, PasswordResetConfirm
-from app.crud import create_user, get_user_by_email, update_user
+from app.crud import create_user, get_user, get_user_by_email, update_user
 
 router = APIRouter()
 
@@ -85,7 +85,7 @@ def refresh_token(
         raise e
 
     # Get user
-    user = get_user(db, user_id=token_data["sub"])
+    user = get_user(session=db, user_id=token_data["sub"])
     if not user:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,