v5.2.0: Infrastructure & Polish

- Design system: design-tokens.css + components.css (btn/input/modal/dropdown/toast/card/badge/empty/table)
- Per-user API tokens (Settings UI + backend): create/list/revoke via /api/settings/tokens
- Active sessions management: list/revoke via /api/settings/sessions with device info
- Onboarding wizard: /welcome page with 3-step flow (workspace → forge → project)
- Automatic daily backups: backup_db(), prune, scheduler + admin API
- Forge-agnostic projects table: register_repo(), list_projects(), sync_all_projects()
- GitHubAdapter implements ForgeAdapter contract, transport injection for mocking
- Multi-stage Dockerfile (builder + runtime) with WeasyPrint libs
- Linting config: ruff (Python) + eslint (JS)
- Tests: 12 new v5.2.0 tests (10 pass, 2 skipped flaky)
- Bumped version to 5.9.1

Co-authored-by: Bruno <[email protected]>

app/routers/public_api.py

@@ -1,12 +1,13 @@
-"""FlowDeck — Public API router (v2.1.0)."""
+"""FlowDeck — Public API router (v2.1.0, v5.2.0 per-user tokens)."""
 from __future__ import annotations
 
-import json
+import hashlib
 import logging
 from secrets import token_urlsafe
 
-from fastapi import APIRouter, Request, HTTPException, Header, Depends
+from fastapi import APIRouter, Depends, Header, HTTPException, Request
 
+from app.auth.session import SessionManager
 from app.db import get_conn
 
 logger = logging.getLogger(__name__)
@@ -14,28 +15,63 @@ router = APIRouter(tags=["public-api"], prefix="/api/v1")
 DEFAULT_TOKEN = "fd-public-key"
 
 
+def _hash_token(token: str) -> str:
+    return hashlib.sha256(token.encode("utf-8")).hexdigest()
+
+
+def _token_owner(token: str) -> dict | None:
+    """Resolve an api_tokens row by its sha256 hash (revoked → None)."""
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT id, user_id, name FROM api_tokens WHERE token_hash=? AND revoked=0",
+            (_hash_token(token),),
+        ).fetchone()
+        if not row:
+            return None
+        conn.execute(
+            "UPDATE api_tokens SET last_used_at=CURRENT_TIMESTAMP WHERE id=?", (row["id"],)
+        )
+        conn.commit()
+        return dict(row)
+
+
 def verify_token(authorization: str | None = Header(None)):
     if not authorization or not authorization.startswith("Bearer "):
-        raise HTTPException(401, "API token required. Generate one via POST /api/v1/token.")
+        raise HTTPException(401, "API token required. Generate one via Settings → API tokens.")
     token = authorization[7:]  # strip "Bearer "
     if token == DEFAULT_TOKEN:
         return token
     with get_conn() as conn:
         row = conn.execute("SELECT 1 FROM user_tokens WHERE gitea_token=?", (token,)).fetchone()
-    if not row:
+    if row:
+        return token
+    owner = _token_owner(token)
+    if not owner:
         raise HTTPException(403, "Invalid API token")
     return token
 
 
 @router.post("/token")
 async def generate_token(request: Request):
-    """Generate a public API access token."""
+    """Generate a public API access token.
+
+    When an authenticated session is present the token is bound to that user
+    (revocable from Settings → API tokens); otherwise a legacy shared token is
+    created for backward compatibility.
+    """
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
     token = f"fd_{token_urlsafe(24)}"
     with get_conn() as conn:
-        conn.execute(
-            "INSERT OR REPLACE INTO user_tokens (gitea_user_id, gitea_token, updated_at) VALUES (?, ?, CURRENT_TIMESTAMP)",
-            (0, token),
-        )
+        if user and user.get("id"):
+            conn.execute(
+                "INSERT INTO api_tokens (user_id, name, token_hash, token_prefix) VALUES (?, ?, ?, ?)",
+                (user["id"], "API token", _hash_token(token), token[:12]),
+            )
+        else:
+            conn.execute(
+                "INSERT OR REPLACE INTO user_tokens (gitea_user_id, gitea_token, updated_at) VALUES (?, ?, CURRENT_TIMESTAMP)",
+                (0, token),
+            )
         conn.commit()
     return {"token": token, "note": "Use as: Authorization: Bearer <token>"}