user = User.query.filter_by(username=username).first() if not user or not user.check_password(password): return jsonify({"msg": "Invalid credentials"}), 401