Add auth foundation: sessions/tokens schema, Argon2 hashing, config

Two tables (sessions, user_tokens) + migration; only token *hashes* are stored, so a DB leak yields no usable credential. Argon2id password hashing and token primitives in app/core/security. Config and .env.example gain session/cookie/token TTLs, app base URL, and SMTP settings (twelve-factor). Migration verified reversible (drops the token_purpose enum) and matches the models.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Paul <justin@jpaul.me>

This commit is contained in:

Justin Paul

2026-06-06 10:51:51 -04:00

parent e5a8713293

commit 5123c85397

9 changed files with 278 additions and 0 deletions

									
										backend/pyproject.toml
									
		+1
		
												View File
												
				@@ -11,6 +11,7 @@ dependencies = [

				    "sqlalchemy[asyncio]>=2.0",

				    "asyncpg>=0.30",

				    "alembic>=1.14",

				    "argon2-cffi>=23.1",

				]

				[dependency-groups]