feat: account settings, session-based auth, and onboarding extraction

backend/alembic/versions/013b9d385bd2_add_verification_tokens_table.py

@@ -0,0 +1,41 @@
+"""add verification_tokens table
+
+Revision ID: 013b9d385bd2
+Revises: b92215c62c84
+Create Date: 2026-07-27 06:28:19.504543
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = '013b9d385bd2'
+down_revision: Union[str, None] = 'b92215c62c84'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table('verification_tokens',
+    sa.Column('id', sa.Integer(), nullable=False),
+    sa.Column('user_id', sa.Integer(), nullable=False),
+    sa.Column('token_hash', sa.String(length=255), nullable=False),
+    sa.Column('purpose', sa.String(length=32), nullable=False),
+    sa.Column('new_email', sa.String(length=255), nullable=True),
+    sa.Column('expires_at', sa.DateTime(timezone=True), nullable=False),
+    sa.Column('used_at', sa.DateTime(timezone=True), nullable=True),
+    sa.Column('created_at', sa.DateTime(timezone=True), nullable=True),
+    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ondelete='CASCADE'),
+    sa.PrimaryKeyConstraint('id')
+    )
+    op.create_index(op.f('ix_verification_tokens_id'), 'verification_tokens', ['id'], unique=False)
+    op.create_index(op.f('ix_verification_tokens_token_hash'), 'verification_tokens', ['token_hash'], unique=True)
+
+
+def downgrade() -> None:
+    op.drop_index(op.f('ix_verification_tokens_token_hash'), table_name='verification_tokens')
+    op.drop_index(op.f('ix_verification_tokens_id'), table_name='verification_tokens')
+    op.drop_table('verification_tokens')

backend/alembic/versions/3cb43e5b0a3f_make_first_name_and_last_name_nullable_.py

@@ -0,0 +1,36 @@
+"""make first_name and last_name nullable again
+
+Revision ID: 3cb43e5b0a3f
+Revises: d10cb65643a2
+Create Date: 2026-07-28 16:04:44.299156
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = '3cb43e5b0a3f'
+down_revision: Union[str, None] = 'd10cb65643a2'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.alter_column('users', 'first_name',
+               existing_type=sa.VARCHAR(length=100),
+               nullable=True)
+    op.alter_column('users', 'last_name',
+               existing_type=sa.VARCHAR(length=100),
+               nullable=True)
+
+
+def downgrade() -> None:
+    op.alter_column('users', 'last_name',
+               existing_type=sa.VARCHAR(length=100),
+               nullable=False)
+    op.alter_column('users', 'first_name',
+               existing_type=sa.VARCHAR(length=100),
+               nullable=False)

backend/alembic/versions/8c1053c617c1_add_sessions_table.py

@@ -0,0 +1,42 @@
+"""add sessions table
+
+Revision ID: 8c1053c617c1
+Revises: 013b9d385bd2
+Create Date: 2026-07-27 10:00:13.901096
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = '8c1053c617c1'
+down_revision: Union[str, None] = '013b9d385bd2'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table('sessions',
+    sa.Column('id', sa.Integer(), nullable=False),
+    sa.Column('user_id', sa.Integer(), nullable=False),
+    sa.Column('token_hash', sa.String(length=64), nullable=False),
+    sa.Column('user_agent', sa.String(length=255), nullable=True),
+    sa.Column('ip_address', sa.String(length=45), nullable=True),
+    sa.Column('created_at', sa.DateTime(timezone=True), nullable=True),
+    sa.Column('last_active_at', sa.DateTime(timezone=True), nullable=True),
+    sa.Column('expires_at', sa.DateTime(timezone=True), nullable=False),
+    sa.Column('revoked_at', sa.DateTime(timezone=True), nullable=True),
+    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ondelete='CASCADE'),
+    sa.PrimaryKeyConstraint('id')
+    )
+    op.create_index(op.f('ix_sessions_id'), 'sessions', ['id'], unique=False)
+    op.create_index(op.f('ix_sessions_token_hash'), 'sessions', ['token_hash'], unique=True)
+
+
+def downgrade() -> None:
+    op.drop_index(op.f('ix_sessions_token_hash'), table_name='sessions')
+    op.drop_index(op.f('ix_sessions_id'), table_name='sessions')
+    op.drop_table('sessions')

backend/alembic/versions/d10cb65643a2_replace_user_is_active_with_status.py

@@ -0,0 +1,55 @@
+"""replace user is_active with status
+
+Revision ID: d10cb65643a2
+Revises: 8c1053c617c1
+Create Date: 2026-07-27 10:51:09.714544
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'd10cb65643a2'
+down_revision: Union[str, None] = '8c1053c617c1'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column('users', sa.Column('status', sa.String(length=32), nullable=True))
+
+    conn = op.get_bind()
+
+    # is_active=false with a password set has no producing code path today —
+    # its correct status is ambiguous (deactivated? locked?), so refuse to
+    # guess and halt instead.
+    ambiguous = conn.execute(sa.text(
+        "SELECT id FROM users WHERE is_active = false AND hashed_password IS NOT NULL"
+    )).fetchall()
+    if ambiguous:
+        raise RuntimeError(
+            f"Cannot backfill status: {len(ambiguous)} user(s) have is_active=false "
+            f"with a password set (ids: {[r[0] for r in ambiguous]}). No existing code "
+            "path produces this combination, so the correct status can't be inferred "
+            "automatically — resolve manually before re-running this migration."
+        )
+
+    conn.execute(sa.text("UPDATE users SET status = 'active' WHERE is_active = true"))
+    conn.execute(sa.text("UPDATE users SET status = 'invited' WHERE is_active = false"))
+
+    op.alter_column('users', 'status', nullable=False)
+    op.drop_column('users', 'is_active')
+
+
+def downgrade() -> None:
+    op.add_column('users', sa.Column('is_active', sa.Boolean(), nullable=True))
+
+    conn = op.get_bind()
+    conn.execute(sa.text("UPDATE users SET is_active = true WHERE status = 'active'"))
+    conn.execute(sa.text("UPDATE users SET is_active = false WHERE status != 'active'"))
+
+    op.alter_column('users', 'is_active', nullable=False)
+    op.drop_column('users', 'status')