feat: auth, Fog Lift Kit, AI Readiness Report, and Concierge booking backend by Copilot · Pull Request #4 · erikhinla/flow-as

Copilot · 2026-04-22T02:51:34Z

The product lacked any backend: no auth, no login-gated content, no intake flow, and no concierge booking. The Fog Lift Kit was a static artifact rather than a digital product.

Auth (`/v1/auth`)

POST /register, POST /login — email + password → JWT (PyJWT 2.12.0, bcrypt 4.2.1)
POST /magic-link / POST /magic-link/verify — single-use token, 15-min expiry; currently returns token in body (swap for email delivery in prod)
New User + MagicLinkToken Postgres models; tier field gates access downstream

Three-tier access control

Tier	Gate
`free`	Fog Lift Kit
`mid`	AI Readiness Report
`concierge`	Concierge booking

require_jwt and require_tier(*tiers) FastAPI dependencies added to deps.py.

Fog Lift Kit (`/v1/fog-lift-kit`)

Login-gated (any tier). Three interactive modules (Clarity / Map / Lift) served as structured JSON — not a PDF. Content is in-memory v1; move to DB/CMS as it grows.

AI Readiness Report (`/v1/ai-readiness`)

Mid+ tier. POST /intake accepts a structured form (industry, role, team size, goals, budget, comfort level) and synchronously generates a markdown snapshot via a rule-based generator. Stored in ai_readiness_reports table; retrievable per-user.

Concierge booking (`/v1/concierge`)

Concierge tier only. POST /book creates a pending booking in concierge_bookings; operator confirms manually (automation hook-in point for future).

Infrastructure

PyJWT>=2.12.0, bcrypt>=4.2.1, pydantic[email] added to deps
JWT_SECRET_KEY, JWT_ACCESS_TOKEN_EXPIRE_MINUTES, MAGIC_LINK_EXPIRE_MINUTES added to Settings + .env.example
init_db extended to create all four new tables on startup
tests/conftest.py stubs aioredis (pre-existing Python 3.12 incompatibility); 25 tests passing, 0 CodeQL alerts

…tures - Add PyJWT>=2.12.0 and bcrypt>=4.2.1 to deps; add pydantic[email] - Add JWT/auth settings to Settings and .env.example - New models: User, MagicLinkToken, AIReadinessReport, ConciergeBooking - New service: auth_service (hash, verify, JWT, magic links) - Updated deps.py: require_jwt, require_tier dependencies - New API routers: /v1/auth, /v1/fog-lift-kit, /v1/ai-readiness, /v1/concierge - Wire new routers into main.py; init_db creates all new tables - 23 new tests (25 total, all passing); conftest.py stubs aioredis for Py3.12 Agent-Logs-Url: https://github.com/erikhinla/flow-as/sessions/c25c41c7-8a70-475e-ae23-e7bb38c780ca Co-authored-by: erikhinla <130815778+erikhinla@users.noreply.github.com>

Agent-Logs-Url: https://github.com/erikhinla/flow-as/sessions/c25c41c7-8a70-475e-ae23-e7bb38c780ca Co-authored-by: erikhinla <130815778+erikhinla@users.noreply.github.com>

erikhinla

So what happens now, the changes get implemented once I approve ?

Copilot

Pull request overview

Adds a full backend “product surface” to bizbrain_lite by introducing JWT-based authentication plus tier-gated endpoints for Fog Lift Kit, AI Readiness intake/reports, and Concierge booking, along with supporting models/schemas and tests.

Changes:

Implement /v1/auth (register/login + magic-link) and JWT/tier dependencies.
Add tier-gated product APIs: Fog Lift Kit (JWT), AI Readiness (mid+), Concierge booking (concierge).
Add new SQLAlchemy models/schemas and a broad endpoint test suite; update settings/env/dependencies accordingly.

Reviewed changes

Copilot reviewed 24 out of 24 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
services/bizbrain_lite/tests/test_product_features.py	Adds endpoint-level tests for auth + tier-gated product APIs.
services/bizbrain_lite/tests/conftest.py	Stubs `aioredis` during tests to work around Python 3.12 incompatibility.
services/bizbrain_lite/pyproject.toml	Adds auth-related dependencies (PyJWT, bcrypt, pydantic email extra).
services/bizbrain_lite/bizbrain_lite.egg-info/top_level.txt	Adds packaging artifact content (should not be committed).
services/bizbrain_lite/bizbrain_lite.egg-info/requires.txt	Adds packaging artifact dependency list (should not be committed).
services/bizbrain_lite/bizbrain_lite.egg-info/dependency_links.txt	Adds packaging artifact content (should not be committed).
services/bizbrain_lite/bizbrain_lite.egg-info/SOURCES.txt	Adds packaging artifact file manifest (should not be committed).
services/bizbrain_lite/bizbrain_lite.egg-info/PKG-INFO	Adds packaging artifact metadata (should not be committed).
services/bizbrain_lite/app/services/auth_service.py	Implements password hashing, JWT create/decode, and magic-link token persistence/consumption.
services/bizbrain_lite/app/schemas/auth.py	Adds request/response schemas for auth endpoints.
services/bizbrain_lite/app/schemas/ai_readiness.py	Adds intake/report schemas for AI Readiness feature.
services/bizbrain_lite/app/schemas/concierge.py	Adds request/response schemas for Concierge booking.
services/bizbrain_lite/app/models/user.py	Introduces `User` and `MagicLinkToken` tables and tier constants.
services/bizbrain_lite/app/models/ai_readiness_report.py	Introduces `AIReadinessReport` persistence.
services/bizbrain_lite/app/models/concierge_booking.py	Introduces `ConciergeBooking` persistence.
services/bizbrain_lite/app/api/auth.py	Adds `/v1/auth/*` routes (register/login/magic-link).
services/bizbrain_lite/app/api/deps.py	Adds `require_jwt` and `require_tier` dependencies for access control.
services/bizbrain_lite/app/api/fog_lift_kit.py	Adds JWT-gated Fog Lift Kit endpoints with in-memory module content.
services/bizbrain_lite/app/api/ai_readiness.py	Adds mid+ intake + report list/get endpoints and snapshot generator.
services/bizbrain_lite/app/api/concierge.py	Adds concierge-only booking creation and retrieval endpoints.
services/bizbrain_lite/app/config/settings.py	Adds JWT/magic-link settings to `Settings`.
services/bizbrain_lite/app/config/database.py	Extends `init_db()` to create the new tables at startup.
services/bizbrain_lite/app/main.py	Wires new routers into the FastAPI app.
services/bizbrain_lite/.env.example	Documents new auth/JWT environment variables.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-22T04:14:02Z

+    # JWT / Auth settings
+    jwt_secret_key: str = "change-me-to-a-long-random-secret"
+    jwt_algorithm: str = "HS256"
+    jwt_access_token_expire_minutes: int = 60 * 24  # 24 hours
+    magic_link_expire_minutes: int = 15


jwt_secret_key has a hard-coded default value. If this ever reaches a deployed environment, it makes tokens forgeable across installs that forget to set the env var. Consider failing fast when the default is used outside dev/test (or require the env var with no default).

Copilot · 2026-04-22T04:14:02Z

+    record = MagicLinkToken(
+        user_id=user.user_id,
+        token=raw_token,
+        expires_at=expires_at,
+    )


Magic-link tokens are persisted in plaintext (token=raw_token). If the DB is leaked, active tokens can be used immediately. Store only a one-way hash of the token (and compare hashes on verification), while returning the raw token only to the requester.

Copilot · 2026-04-22T04:14:02Z

+    result = await db.execute(
+        select(MagicLinkToken).where(MagicLinkToken.token == raw_token)
+    )
+    record: Optional[MagicLinkToken] = result.scalar_one_or_none()
+
+    if record is None or record.used:
+        return None
+    # Compare naive/aware carefully — store is naive UTC, now is aware UTC
+    expires_naive = record.expires_at
+    if expires_naive.tzinfo is None:
+        expires_aware = expires_naive.replace(tzinfo=timezone.utc)
+    else:
+        expires_aware = expires_naive
+    if now > expires_aware:
+        return None
+
+    # Mark consumed
+    record.used = True
+    db.add(record)
+    await db.commit()


Token consumption is vulnerable to a race: this query reads the token row without any lock/atomic update, so concurrent verifies can both see used=false before either commit. Make consumption atomic (e.g., SELECT ... FOR UPDATE or conditional UPDATE ... WHERE used=false ... RETURNING ...).

Suggested change

result = await db.execute(

select(MagicLinkToken).where(MagicLinkToken.token == raw_token)

)

record: Optional[MagicLinkToken] = result.scalar_one_or_none()

if record is None or record.used:

return None

# Compare naive/aware carefully — store is naive UTC, now is aware UTC

expires_naive = record.expires_at

if expires_naive.tzinfo is None:

expires_aware = expires_naive.replace(tzinfo=timezone.utc)

else:

expires_aware = expires_naive

if now > expires_aware:

return None

# Mark consumed

record.used = True

db.add(record)

await db.commit()

async with db.begin():

result = await db.execute(

select(MagicLinkToken)

.where(MagicLinkToken.token == raw_token)

.with_for_update()

)

record: Optional[MagicLinkToken] = result.scalar_one_or_none()

if record is None or record.used:

return None

# Compare naive/aware carefully — store is naive UTC, now is aware UTC

expires_naive = record.expires_at

if expires_naive.tzinfo is None:

expires_aware = expires_naive.replace(tzinfo=timezone.utc)

else:

expires_aware = expires_naive

if now > expires_aware:

return None

# Mark consumed while holding the row lock

record.used = True

db.add(record)

Copilot · 2026-04-22T04:14:03Z

+README.md
+pyproject.toml
+app/__init__.py
+app/main.py
+app/api/__init__.py
+app/api/agent_zero_reviews.py


The bizbrain_lite.egg-info/ directory is a build artifact and is already covered by the repo’s .gitignore (.egg-info/). It shouldn’t be committed; remove these files from the PR and rely on build/install steps to generate them.

Copilot · 2026-04-22T04:14:03Z

+These tests use FastAPI's TestClient with a fully mocked database and
+in-memory user store so they run without Postgres or Redis.


The module docstring says these tests run with a “fully mocked database” and “without Postgres or Redis”, but TestClient(app) will still execute app.main startup events (including init_db() and Redis initialization). Either update the docstring to match reality, or override/disable the startup lifecycle in these tests so they truly don’t require external services.

Suggested change

These tests use FastAPI's TestClient with a fully mocked database and

in-memory user store so they run without Postgres or Redis.

These tests patch endpoint-level dependencies where needed, but they still

instantiate ``TestClient(app)`` directly and therefore may execute normal

application startup behavior.

Copilot · 2026-04-22T04:14:03Z

+        with (
+            patch("app.api.auth.auth_service.get_user_by_email", new=AsyncMock(return_value=None)),
+            patch("app.api.auth.auth_service.create_user", new=AsyncMock(return_value=mock_user)),
+            patch("app.config.database.get_db_session", return_value=_noop_session()),
+        ):


Patching app.config.database.get_db_session won’t affect the dependency used by these routes because get_db_session is imported into app.api.auth (from app.config.database import get_db_session) and Depends() holds that reference. Use app.dependency_overrides[get_db_session], or patch app.api.auth.get_db_session, otherwise the endpoint may still open a real DB session during tests.

Copilot · 2026-04-22T04:14:03Z

+        with (
+            patch("app.api.auth.auth_service.get_user_by_email", new=AsyncMock(return_value=mock_user)),
+            patch("app.config.database.get_db_session", return_value=_noop_session()),
+        ):


Same issue here: patching app.config.database.get_db_session does not override the get_db_session function already imported into app.api.auth for Depends(). Switch to app.dependency_overrides or patch app.api.auth.get_db_session so this test doesn’t rely on a real Postgres connection.

Copilot · 2026-04-22T04:14:04Z

+        with (
+            patch("app.api.auth.auth_service.get_user_by_email", new=AsyncMock(return_value=mock_user)),
+            patch("app.api.auth.auth_service.create_magic_link_token", new=AsyncMock(return_value="rawtoken123")),
+            patch("app.config.database.get_db_session", return_value=_noop_session()),
+        ):


Same dependency patching problem: the auth router uses its own imported get_db_session, so patching app.config.database.get_db_session won’t reliably affect this endpoint. Prefer app.dependency_overrides in tests for DB/session dependencies.

@copilot apply changes based on this feedback

erikhinla

approved

erikhinla · 2026-04-22T21:00:44Z

goog

Copilot AI and others added 2 commits April 22, 2026 02:45

fix: remove unused timezone import in concierge.py

1834637

Agent-Logs-Url: https://github.com/erikhinla/flow-as/sessions/c25c41c7-8a70-475e-ae23-e7bb38c780ca Co-authored-by: erikhinla <130815778+erikhinla@users.noreply.github.com>

Copilot AI assigned Copilot and erikhinla Apr 22, 2026

Copilot created this pull request from a session on behalf of erikhinla April 22, 2026 02:51 View session

erikhinla reviewed Apr 22, 2026

View reviewed changes

erikhinla requested a review from Copilot April 22, 2026 04:08

Copilot started reviewing on behalf of erikhinla April 22, 2026 04:09 View session

Copilot AI reviewed Apr 22, 2026

View reviewed changes

erikhinla reviewed Apr 22, 2026

View reviewed changes

Copilot started work on behalf of erikhinla April 22, 2026 21:02 View session

erikhinla closed this Apr 22, 2026

Copilot stopped work on behalf of erikhinla due to an error April 22, 2026 21:03
The session was cancelled by the user.

Copilot AI requested a review from erikhinla April 22, 2026 21:03

		These tests use FastAPI's TestClient with a fully mocked database and
		in-memory user store so they run without Postgres or Redis.

-These tests use FastAPI's TestClient with a fully mocked database and
-in-memory user store so they run without Postgres or Redis.
+These tests patch endpoint-level dependencies where needed, but they still
+instantiate ``TestClient(app)`` directly and therefore may execute normal
+application startup behavior.

Conversation

Copilot AI commented Apr 22, 2026

Auth (/v1/auth)

Three-tier access control

Fog Lift Kit (/v1/fog-lift-kit)

AI Readiness Report (/v1/ai-readiness)

Concierge booking (/v1/concierge)

Infrastructure

Uh oh!

erikhinla left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

erikhinla Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

erikhinla left a comment

Choose a reason for hiding this comment

Uh oh!

erikhinla commented Apr 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Auth (`/v1/auth`)

Fog Lift Kit (`/v1/fog-lift-kit`)

AI Readiness Report (`/v1/ai-readiness`)

Concierge booking (`/v1/concierge`)