P1: identity, roles, RBAC

[sujitd7]

P1 — Identity, roles, RBAC

The auth layer every later phase builds on. Closes the P1 checklist in docs/ROADMAP.md.

Models & migration

• users (email, full_name, password_hash, role, team, is_active) and refresh_tokens (jti, expires_at, revoked_at).
• Alembic migration bd693f8a6bb0 — creates/drops the role and team Postgres enums explicitly, tested downgrade(). Round-trips clean on SQLite; CI runs it on Postgres.

Security

• app/security.py — Argon2 password hashing (with a constant dummy hash so an unknown-email login takes the same time as a real one), HS256 JWT encode/decode. Tokens carry a type claim (access / refresh) that is checked, plus required exp / sub / type.
• app/config.py — the API refuses to boot with the placeholder JWT_SECRET (or anything under 32 chars) unless ENVIRONMENT is dev / test / local.

Auth flows

• POST /auth/login, GET /auth/me.
• POST /auth/refresh — rotating refresh tokens. The row is locked for the transaction; replay of an already-rotated token is detected and burns the whole token family, committed in its own unit of work so the revocation survives the 401 that follows.
• POST /auth/logout — authenticated; only revokes a refresh token the caller owns.
• Login and refresh failures all return one generic 401 (no account-existence leak).

RBAC

• Role / Team enums; require_roles(...) dependency in app/deps.py (declared on the route, never in handler bodies). get_current_user guards a malformed sub and rejects inactive users.
• app/errors.py — AppError hierarchy rendered as {"detail": ...} JSON, wired in create_app().

Tests — 35, ruff + mypy --strict + pytest green

• tests/test_auth.py — login ok/bad/inactive, expired + wrong-type tokens, rotation, reuse-family-burn (incl. a variant using real per-request sessions to prove the burn is committed), logout ownership, and a per-role probe matrix against test-only /_probe/* routes.
• tests/test_config.py — the strong-secret boot check.
• conftest.py — make_user factory, per-role user + auth_* header fixtures.

Notes

• A prior security-review pass drove the fixes above (reuse-detection commit, secret fail-fast, row locking, timing on disabled accounts, claim requirements, authenticated logout).
• Deferred P0 infra items (branch protection, docker compose up verification — Docker is blocked on the dev machine) are marked as such in docs/ROADMAP.md; backend tests run on SQLite locally and the CI Postgres service.

🤖 Generated with Claude Code