Phase 1 (backend): identity, teams & ownership

[kosminus]

Implements the backend half of Phase 1 from planfull.md — the identity layer that gates the rest of the roadmap.

Decisions (confirmed)

• Login: magic-link + local password; OIDC is a registered (unimplemented) provider seam.
• Session: stateless HS256 JWT delivered as an HTTP-only cookie.
• Build order: backend-first (this PR); frontend in a stacked follow-up.

What's included

• Identity models — Organization, User, Team (= workspace), Membership (admin|editor|viewer), ApiKey. Single-tenant per deployment (isolation by workspace_id); organization_id carried on every core table so a future managed-SaaS fleet needs no migration.
• Auth core — app/core/security.py (PBKDF2 passwords, HS256 JWTs with a purpose claim, API-key gen/hash), app/core/auth.py (get_current_user → API key/Bearer/cookie, get_org_context → AuthContext, require_role, cookie helpers, DISABLE_AUTH dev escape hatch), and the pluggable app/core/auth_providers.py seam.
• Services & endpoints — auth_service, identity_service (incl. bootstrap_default_identity + system_context); routes /auth/*, /teams (+ members), /api-keys.
• AuthZ wired through the stack — connection_service scopes by org+workspace and enforces role; metadata endpoints authorize via the connection cascade root (app/api/v1/deps.py); query/schema services, all endpoints, the MCP server, and startup auto-setup thread AuthContext. created_by/user_id promoted to real User FKs.
• Migration 004 — nullable → seed default org/workspace/admin → backfill → NOT NULL, with (org_id, created_at) indexes and a full downgrade.

Verification

• 98 unit tests pass (29 new: password/JWT/API-key crypto, provider registry, role hierarchy, 401 on protected routes).
• Migration applies and reverses cleanly on a throwaway DB (down restores created_by).
• End-to-end against a real DB: bootstrap, password login (wrong rejected), session-JWT roundtrip, viewer blocked from create, cross-workspace isolation (404), magic-link auto-provisioning a viewer.
• ruff/mypy clean on new files.

Deploy note

Once migration 004 runs, auth is mandatory. The pre-auth frontend would 401, so docker-compose.yml sets DISABLE_AUTH=true as the bridge until the frontend PR lands.

🤖 Generated with Claude Code