Phase 1a: foundation and accounts #2

Manually merged

marvin8 merged 13 commits from feat/issue-1-phase-1a-foundation into main

2026-10-08 07:15:23 +00:00

agent-pi commented

2026-10-08 06:09:56 +00:00

Collaborator

Implements Phase 1a — the foundation and invite-only account system for xique, per issue #1.

What this adds

Python 3.14 package scaffold, tooling (ruff/ty/tryke/prek), and env-driven settings.
SQLite layer (aiosqlite, WAL) with a hand-rolled versioned migration mechanism, per-request web connections, and single-owner migrations (worker migrates, web only verifies).
Auth primitives: argon2 password hashing, session tokens hashed at rest, CSRF tokens.
Users/sessions/invites data access, with DB-enforced foreign keys.
FastAPI app factory, per-request DB dependency, session/CSRF auth dependencies, server-rendered templates (zero JavaScript).
Auth routes: first-run /setup (admin-once, atomic), /login (constant-time unknown-user path, password cap), /logout, /invite/{code} (atomic single-use redemption), with open-redirect-hardened next handling.
Worker skeleton and jobs queue with an atomic claim.

Notes

Design spec: .superpowers/specs/2026-10-08-xique-design.md (local working artifact, not committed per AGENTS.md).
Implementation plan: .superpowers/plans/2026-10-08-xique-01-foundation.md.
Jellyfin sync, Trakt import, the recommendation engine, the browse UI, and containers are later plans, tracked under milestones #8–#11.
SQLite connect sets busy_timeout before switching to WAL and retries the WAL switch on the lock condition (the busy handler is not consulted for the journal-mode switch).

Closes #1

Implements Phase 1a — the foundation and invite-only account system for xique, per issue #1. ## What this adds - Python 3.14 package scaffold, tooling (ruff/ty/tryke/prek), and env-driven settings. - SQLite layer (aiosqlite, WAL) with a hand-rolled versioned migration mechanism, per-request web connections, and single-owner migrations (worker migrates, web only verifies). - Auth primitives: argon2 password hashing, session tokens hashed at rest, CSRF tokens. - Users/sessions/invites data access, with DB-enforced foreign keys. - FastAPI app factory, per-request DB dependency, session/CSRF auth dependencies, server-rendered templates (zero JavaScript). - Auth routes: first-run `/setup` (admin-once, atomic), `/login` (constant-time unknown-user path, password cap), `/logout`, `/invite/{code}` (atomic single-use redemption), with open-redirect-hardened `next` handling. - Worker skeleton and `jobs` queue with an atomic claim. ## Notes - Design spec: `.superpowers/specs/2026-10-08-xique-design.md` (local working artifact, not committed per AGENTS.md). - Implementation plan: `.superpowers/plans/2026-10-08-xique-01-foundation.md`. - Jellyfin sync, Trakt import, the recommendation engine, the browse UI, and containers are later plans, tracked under milestones #8–#11. - SQLite `connect` sets `busy_timeout` before switching to WAL and retries the WAL switch on the lock condition (the busy handler is not consulted for the journal-mode switch). Closes #1

agent-pi added 9 commits

2026-10-08 06:09:56 +00:00

🔧 chore: ignore local agent working artifacts 48811c6895