Pablan, as it stands

Self-hosted knowledge management for SMEs: a split-screen Markdown editor
whose sections an LLM refines while you write, and RAG question answering
over the documents that result. FastAPI + Postgres/pgvector on the back,
SvelteKit on the front, everything OpenAI-compatible and self-hostable.

Squashed into a single commit; the development history stays local.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CA43ZJda8Rbp2hKXNy8f6b

backend/app/auth/deps.py

@@ -0,0 +1,40 @@
+import uuid
+from typing import Annotated
+
+from fastapi import Depends, Request
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.auth.sessions import COOKIE_NAME, get_valid_session
+from app.db import get_db
+from app.errors import ApiError
+from app.models import AuthSession, User, UserRole
+
+
+async def get_current_auth_session(
+    request: Request, db: Annotated[AsyncSession, Depends(get_db)]
+) -> AuthSession:
+    raw = request.cookies.get(COOKIE_NAME)
+    if raw is None:
+        raise ApiError(401, "Not authenticated.", "not_authenticated")
+    try:
+        session_id = uuid.UUID(raw)
+    except ValueError:
+        raise ApiError(401, "Not authenticated.", "not_authenticated") from None
+    session = await get_valid_session(db, session_id)
+    if session is None:
+        raise ApiError(401, "Not authenticated.", "not_authenticated")
+    return session
+
+
+async def get_current_user(
+    session: Annotated[AuthSession, Depends(get_current_auth_session)],
+) -> User:
+    return session.user
+
+
+async def require_admin(
+    user: Annotated[User, Depends(get_current_user)],
+) -> User:
+    if user.role != UserRole.admin:
+        raise ApiError(403, "Admin privileges required.", "forbidden")
+    return user

backend/app/auth/passwords.py

@@ -0,0 +1,23 @@
+from argon2 import PasswordHasher
+from argon2.exceptions import InvalidHashError, VerificationError
+
+_hasher = PasswordHasher()
+
+# Verified against when the user does not exist, so login duration does not
+# reveal whether an email address is registered.
+_DUMMY_HASH = _hasher.hash("pablan-dummy-password")
+
+
+def hash_password(password: str) -> str:
+    return _hasher.hash(password)
+
+
+def verify_password(password_hash: str, password: str) -> bool:
+    try:
+        return _hasher.verify(password_hash, password)
+    except (VerificationError, InvalidHashError):
+        return False
+
+
+def burn_verification_time() -> None:
+    verify_password(_DUMMY_HASH, "wrong-password")

backend/app/auth/sessions.py

@@ -0,0 +1,68 @@
+import uuid
+from datetime import UTC, datetime, timedelta
+
+from fastapi import Response
+from sqlalchemy import delete
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.config import get_settings
+from app.models import AuthSession, User
+
+COOKIE_NAME = "pablan_session"
+
+
+async def create_auth_session(db: AsyncSession, user: User) -> AuthSession:
+    settings = get_settings()
+    session = AuthSession(
+        user_id=user.id,
+        expires_at=datetime.now(UTC) + timedelta(days=settings.auth_session_ttl_days),
+    )
+    db.add(session)
+    await db.flush()
+    return session
+
+
+async def get_valid_session(
+    db: AsyncSession, session_id: uuid.UUID
+) -> AuthSession | None:
+    session = await db.get(AuthSession, session_id)
+    if session is None or session.expires_at <= datetime.now(UTC):
+        return None
+    return session
+
+
+async def revoke_user_sessions(
+    db: AsyncSession, user_id: uuid.UUID, *, keep_session_id: uuid.UUID | None = None
+) -> None:
+    """Log a user out everywhere — the session-revocation primitive.
+
+    `keep_session_id` spares the caller's own session, which is what a
+    self-service password change wants: every other device is logged out,
+    the one you are typing on is not.
+    """
+    statement = delete(AuthSession).where(AuthSession.user_id == user_id)
+    if keep_session_id is not None:
+        statement = statement.where(AuthSession.id != keep_session_id)
+    await db.execute(statement)
+
+
+def set_session_cookie(response: Response, session: AuthSession) -> None:
+    settings = get_settings()
+    response.set_cookie(
+        COOKIE_NAME,
+        str(session.id),
+        max_age=settings.auth_session_ttl_days * 24 * 60 * 60,
+        httponly=True,
+        secure=settings.cookie_secure,
+        samesite="lax",
+    )
+
+
+def clear_session_cookie(response: Response) -> None:
+    settings = get_settings()
+    response.delete_cookie(
+        COOKIE_NAME,
+        httponly=True,
+        secure=settings.cookie_secure,
+        samesite="lax",
+    )