Replace the walking skeleton's hardcoded dev-token stub with a real,
self-hosted token store — the customs gate's papers check — keeping the dev
token as a documented local-only bootstrap.
WHY: hexa needs a proper 31-day scoped token (#33), and every future engine
endpoint needs per-engine authorization. Self-hosted SQLite (no vendor, same DB
that'll hold jobs/cache/usage) matches the 'self-host all' decision.
WHAT:
- db.py — stdlib sqlite3, WAL mode so the API + worker daemon read/write
concurrently. Tables: accounts, tokens (token_hash, prefix, scopes,
quota_json, expires_at, revoked). The DB is the one thing worth backing up;
the artifact cache is rebuildable (noted in SRE.md).
- auth.py — mint() returns the plaintext ONCE and stores only sha256(token), so
a DB leak isn't replayable. verify() is an indexed hash lookup → a Principal
(account, scopes, expiry); checks revoked + expiry. has_scope() honors the '*'
wildcard. Scope-gated dependency require_scope(scope) in app.py: 401
unknown/expired/revoked, 403 scoped-out; scope=None = any valid token.
- douanier.py — admin CLI (token mint/list/revoke, db init); the only way tokens
are created (no public signup). list masks to a 6-char prefix.
- /v1/me echoes the caller's identity (onboarding smoke test); /v1/analyze/emotion
now requires the 'emotion' scope.
VALIDATION:
- 15/15 tests green (8 auth: mint→verify, wildcard, unknown→None, revoke,
expiry, never-expires, only-hash-stored, dev-bootstrap; 7 smoke incl. /me
guarded). No CLAP/torch needed; DB points at a temp file via conftest.
- CLI smoke end-to-end: mint prints secret once + masks in list, expiry lands
exactly 31 days out (2026-07-26), revoke flips state to REVOKED.
