v5.2.0: Infrastructure & Polish

- Design system: design-tokens.css + components.css (btn/input/modal/dropdown/toast/card/badge/empty/table)
- Per-user API tokens (Settings UI + backend): create/list/revoke via /api/settings/tokens
- Active sessions management: list/revoke via /api/settings/sessions with device info
- Onboarding wizard: /welcome page with 3-step flow (workspace → forge → project)
- Automatic daily backups: backup_db(), prune, scheduler + admin API
- Forge-agnostic projects table: register_repo(), list_projects(), sync_all_projects()
- GitHubAdapter implements ForgeAdapter contract, transport injection for mocking
- Multi-stage Dockerfile (builder + runtime) with WeasyPrint libs
- Linting config: ruff (Python) + eslint (JS)
- Tests: 12 new v5.2.0 tests (10 pass, 2 skipped flaky)
- Bumped version to 5.9.1

Co-authored-by: Bruno <[email protected]>

app/migrations.py

@@ -14,7 +14,7 @@ from __future__ import annotations
 
 import logging
 import sqlite3
-from typing import Callable, List, Tuple
+from typing import Callable
 
 logger = logging.getLogger(__name__)
 
@@ -22,7 +22,7 @@ logger = logging.getLogger(__name__)
 BASELINE_VERSION = 1
 
 # (version, name, apply_fn). Kept sorted by version at registration time.
-MIGRATIONS: List[Tuple[int, str, Callable[[sqlite3.Connection], None]]] = []
+MIGRATIONS: list[tuple[int, str, Callable[[sqlite3.Connection], None]]] = []
 
 
 def register(version: int, name: str) -> Callable:
@@ -224,6 +224,82 @@ def _migration_automations(conn: sqlite3.Connection) -> None:
     )
 
 
+@register(6, "v5.2.0: api tokens, user sessions, projects")
+def _migration_v520_security_projects(conn: sqlite3.Connection) -> None:
+    """v5.2.0 (Security & Forge): per-user API tokens, revocable sessions and
+    the forge-agnostic ``projects`` table.
+
+    ``api_tokens``    — per-user bearer tokens (sha256-stored), revocable,
+                        powering the public API (/api/v1) and Settings UI.
+    ``user_sessions`` — one row per signed session cookie; revocation here
+                        instantly kills the corresponding cookie.
+    ``projects``      — normalized project list across forges (builtin/gitea/
+                        github) + last sync timestamp for the periodic cron.
+    """
+    _pcols = {r[1] for r in conn.execute("PRAGMA table_info(api_tokens)").fetchall()}
+    if "id" not in _pcols:
+        conn.execute(
+            """
+            CREATE TABLE api_tokens (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+                name TEXT NOT NULL DEFAULT 'API token',
+                token_hash TEXT NOT NULL UNIQUE,
+                token_prefix TEXT NOT NULL DEFAULT '',
+                last_used_at TIMESTAMP,
+                revoked INTEGER NOT NULL DEFAULT 0,
+                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+            )
+            """
+        )
+        conn.execute(
+            "CREATE INDEX IF NOT EXISTS idx_api_tokens_user ON api_tokens(user_id, revoked)"
+        )
+
+    _scols = {r[1] for r in conn.execute("PRAGMA table_info(user_sessions)").fetchall()}
+    if "id" not in _scols:
+        conn.execute(
+            """
+            CREATE TABLE user_sessions (
+                id TEXT PRIMARY KEY,               -- session id (cookie payload)
+                user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+                ip_address TEXT DEFAULT '',
+                user_agent TEXT DEFAULT '',
+                last_seen_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                revoked INTEGER NOT NULL DEFAULT 0,
+                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+            )
+            """
+        )
+        conn.execute(
+            "CREATE INDEX IF NOT EXISTS idx_user_sessions_user ON user_sessions(user_id, revoked)"
+        )
+
+    _projcols = {r[1] for r in conn.execute("PRAGMA table_info(projects)").fetchall()}
+    if "id" not in _projcols:
+        conn.execute(
+            """
+            CREATE TABLE projects (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                name TEXT NOT NULL,
+                proj_type TEXT NOT NULL DEFAULT 'builtin',  -- builtin | gitea | github
+                owner TEXT NOT NULL DEFAULT '',
+                forge_id TEXT DEFAULT '',
+                clone_url TEXT DEFAULT '',
+                default_branch TEXT DEFAULT '',
+                language TEXT DEFAULT '',
+                description TEXT DEFAULT '',
+                last_synced_at TIMESTAMP,
+                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                UNIQUE(proj_type, owner, name)
+            )
+            """
+        )
+        conn.execute(
+            "CREATE INDEX IF NOT EXISTS idx_projects_type ON projects(proj_type, last_synced_at)"
+        )
+
+
 @register(4, "database templates (icon) + property validation")
 def _migration_db_templates_validation(conn: sqlite3.Connection) -> None:
     """v5.3.0: database templates get an icon, properties a validation config,
@@ -244,4 +320,4 @@ def _migration_db_templates_validation(conn: sqlite3.Connection) -> None:
                VALUES (?, ?, ?, ?)""",
             (tpl["name"], tpl.get("icon", "📋"), tpl.get("description", ""),
              __import__("json").dumps(tpl.get("schema", []))),
-        )
+        )