first commit

backend/app/auth.py

@@ -0,0 +1,14 @@
+from fastapi import HTTPException, Request
+
+from app.config import get_settings
+
+
+def require_admin(request: Request) -> None:
+    token = request.query_params.get("token")
+    if token is None:
+        auth_header = request.headers.get("authorization", "")
+        if auth_header.startswith("Bearer "):
+            token = auth_header.removeprefix("Bearer ")
+
+    if token is None or token != get_settings().admin_token:
+        raise HTTPException(status_code=401, detail="Invalid or missing token")

backend/app/config.py

@@ -0,0 +1,18 @@
+from functools import lru_cache
+
+from pydantic_settings import BaseSettings
+
+
+class Settings(BaseSettings):
+    admin_token: str
+    site_title: str = "Untitled Site"
+    data_dir: str = "./data"
+    max_upload_bytes: int = 100_000_000
+    allowed_upload_types: str = "pdf,png,jpg,jpeg,gif,mp4,webm,mp3,wav,ogg,webp"
+
+    model_config = {"env_prefix": "HANDIN_"}
+
+
+@lru_cache
+def get_settings() -> Settings:
+    return Settings()

backend/app/database.py

@@ -0,0 +1,41 @@
+import sqlite3
+from pathlib import Path
+
+
+def init_db(db_path: Path) -> None:
+    db_path.parent.mkdir(parents=True, exist_ok=True)
+    conn = sqlite3.connect(db_path)
+    try:
+        conn.execute("PRAGMA journal_mode=WAL")
+        conn.execute("PRAGMA busy_timeout=5000")
+        conn.execute("""
+            CREATE TABLE IF NOT EXISTS site (
+                key   TEXT PRIMARY KEY,
+                value TEXT NOT NULL
+            )
+        """)
+        conn.execute("""
+            CREATE TABLE IF NOT EXISTS segments (
+                id         TEXT PRIMARY KEY,
+                type       TEXT NOT NULL,
+                sort_order INTEGER NOT NULL,
+                title      TEXT NOT NULL,
+                content    TEXT NOT NULL DEFAULT '',
+                metadata   TEXT NOT NULL DEFAULT '{}',
+                created_at TEXT NOT NULL,
+                updated_at TEXT NOT NULL
+            )
+        """)
+        conn.execute(
+            "CREATE INDEX IF NOT EXISTS idx_segments_order ON segments(sort_order)"
+        )
+        conn.commit()
+    finally:
+        conn.close()
+
+
+def get_connection(db_path: Path) -> sqlite3.Connection:
+    conn = sqlite3.connect(db_path)
+    conn.row_factory = sqlite3.Row
+    conn.execute("PRAGMA busy_timeout=5000")
+    return conn

backend/app/main.py

@@ -0,0 +1,41 @@
+from collections.abc import AsyncIterator
+from contextlib import asynccontextmanager
+from pathlib import Path
+
+from fastapi import FastAPI
+from fastapi.staticfiles import StaticFiles
+
+from app.config import get_settings
+from app.database import init_db
+from app.routes.assets import router as assets_router
+from app.routes.auth import router as auth_router
+from app.routes.segments import router as segments_router
+from app.routes.site import router as site_router
+
+
+@asynccontextmanager
+async def lifespan(_app: FastAPI) -> AsyncIterator[None]:
+    data_dir = Path(get_settings().data_dir)
+    init_db(data_dir / "handin.db")
+    assets_path = data_dir / "assets"
+    assets_path.mkdir(parents=True, exist_ok=True)
+    yield
+
+
+app = FastAPI(title="Handin Website", lifespan=lifespan)
+
+app.include_router(auth_router)
+app.include_router(segments_router)
+app.include_router(site_router)
+app.include_router(assets_router)
+
+
+@app.get("/api/health")
+def health_check() -> dict[str, str]:
+    return {"status": "ok"}
+
+
+# Serve built frontend SPA (must be registered last — catch-all)
+_static_dir = Path(__file__).resolve().parent.parent.parent / "static"
+if _static_dir.is_dir():
+    app.mount("/", StaticFiles(directory=str(_static_dir), html=True), name="static")

backend/app/models.py

@@ -0,0 +1,62 @@
+from datetime import datetime
+from enum import StrEnum
+from uuid import UUID
+
+from pydantic import BaseModel, Field
+
+
+class SegmentType(StrEnum):
+    MARKDOWN = "markdown"
+    PDF = "pdf"
+    VIDEO = "video"
+    AUDIO = "audio"
+    IFRAME = "iframe"
+    GALLERY = "gallery"
+    LINK = "link"
+
+
+class Segment(BaseModel):
+    id: UUID
+    type: SegmentType
+    sort_order: int
+    title: str
+    content: str = ""
+    metadata: dict[str, object] = Field(default_factory=dict)
+    created_at: datetime
+    updated_at: datetime
+
+
+class SegmentCreateRequest(BaseModel):
+    type: SegmentType
+    title: str
+    content: str = ""
+    metadata: dict[str, object] = Field(default_factory=dict)
+
+
+class SegmentUpdateRequest(BaseModel):
+    title: str | None = None
+    content: str | None = None
+    metadata: dict[str, object] | None = None
+
+
+class ReorderRequest(BaseModel):
+    segment_ids: list[UUID]
+
+
+class SiteUpdateRequest(BaseModel):
+    title: str
+
+
+class SegmentResponse(BaseModel):
+    id: UUID
+    type: SegmentType
+    sort_order: int
+    title: str
+    content: str
+    metadata: dict[str, object]
+    created_at: datetime
+    updated_at: datetime
+
+
+class SiteResponse(BaseModel):
+    title: str

backend/app/routes/assets.py

@@ -0,0 +1,69 @@
+from pathlib import Path
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, Response, UploadFile
+from fastapi.responses import FileResponse
+
+from app.auth import require_admin
+from app.config import Settings, get_settings
+from app.services import asset_service
+
+router = APIRouter(prefix="/api/assets", tags=["assets"])
+
+
+def get_assets_dir() -> Path:
+    return Path(get_settings().data_dir) / "assets"
+
+
+AssetsDir = Annotated[Path, Depends(get_assets_dir)]
+Admin = Annotated[None, Depends(require_admin)]
+AppSettings = Annotated[Settings, Depends(get_settings)]
+
+
+@router.post("/", status_code=201)
+async def upload_asset(
+    file: UploadFile,
+    _admin: Admin,
+    assets_dir: AssetsDir,
+    settings: AppSettings,
+) -> dict[str, str]:
+    content = await file.read()
+    try:
+        saved = asset_service.save_asset(
+            assets_dir,
+            file.filename or "upload",
+            content,
+            settings.allowed_upload_types,
+            settings.max_upload_bytes,
+        )
+    except ValueError as exc:
+        msg = str(exc)
+        if "File too large" in msg:
+            raise HTTPException(status_code=413, detail=msg) from None
+        raise HTTPException(status_code=415, detail=msg) from None
+    return {"filename": saved}
+
+
+@router.get("/{filename}")
+def serve_asset(
+    filename: str,
+    assets_dir: AssetsDir,
+) -> FileResponse:
+    file_path = (assets_dir / filename).resolve()
+    if not str(file_path).startswith(str(assets_dir.resolve())):
+        raise HTTPException(status_code=404, detail="Asset not found")
+    if not file_path.exists():
+        raise HTTPException(status_code=404, detail="Asset not found")
+    return FileResponse(file_path)
+
+
+@router.delete("/{filename}")
+def delete_asset(
+    filename: str,
+    _admin: Admin,
+    assets_dir: AssetsDir,
+) -> Response:
+    deleted = asset_service.delete_asset(assets_dir, filename)
+    if not deleted:
+        raise HTTPException(status_code=404, detail="Asset not found")
+    return Response(status_code=204)

backend/app/routes/auth.py

@@ -0,0 +1,14 @@
+from typing import Annotated
+
+from fastapi import APIRouter, Depends
+
+from app.auth import require_admin
+
+router = APIRouter(prefix="/api/auth", tags=["auth"])
+
+Admin = Annotated[None, Depends(require_admin)]
+
+
+@router.get("/verify")
+def verify_token(_: Admin) -> dict[str, bool]:
+    return {"valid": True}

backend/app/routes/segments.py

@@ -0,0 +1,93 @@
+import threading
+from pathlib import Path
+from typing import Annotated
+from uuid import UUID
+
+from fastapi import APIRouter, Depends, HTTPException, Response
+
+from app.auth import require_admin
+from app.config import get_settings
+from app.database import init_db
+from app.models import (
+    ReorderRequest,
+    SegmentCreateRequest,
+    SegmentResponse,
+    SegmentUpdateRequest,
+)
+from app.services import segment_service
+
+router = APIRouter(prefix="/api/segments", tags=["segments"])
+
+# Serialize writes to prevent sort_order race conditions in SQLite
+_write_lock = threading.Lock()
+
+
+def get_db_path() -> Path:
+    data_dir = get_settings().data_dir
+    db_path = Path(data_dir) / "handin.db"
+    init_db(db_path)
+    return db_path
+
+
+DbPath = Annotated[Path, Depends(get_db_path)]
+Admin = Annotated[None, Depends(require_admin)]
+
+
+@router.get("/")
+def list_segments(db_path: DbPath) -> list[SegmentResponse]:
+    segments = segment_service.list_segments(db_path)
+    return [SegmentResponse.model_validate(s.model_dump()) for s in segments]
+
+
+@router.post("/", status_code=201)
+def create_segment(
+    request: SegmentCreateRequest,
+    _: Admin,
+    db_path: DbPath,
+) -> SegmentResponse:
+    with _write_lock:
+        segment = segment_service.create_segment(db_path, request)
+    return SegmentResponse.model_validate(segment.model_dump())
+
+
+@router.put("/reorder")
+def reorder_segments(
+    request: ReorderRequest,
+    _: Admin,
+    db_path: DbPath,
+) -> list[SegmentResponse]:
+    with _write_lock:
+        try:
+            segments = segment_service.reorder_segments(db_path, request.segment_ids)
+        except ValueError as e:
+            raise HTTPException(status_code=400, detail=str(e)) from e
+    return [SegmentResponse.model_validate(s.model_dump()) for s in segments]
+
+
+@router.get("/{segment_id}")
+def get_segment(segment_id: UUID, db_path: DbPath) -> SegmentResponse:
+    segment = segment_service.get_segment(db_path, segment_id)
+    if segment is None:
+        raise HTTPException(status_code=404, detail="Segment not found")
+    return SegmentResponse.model_validate(segment.model_dump())
+
+
+@router.patch("/{segment_id}")
+def update_segment(
+    segment_id: UUID,
+    request: SegmentUpdateRequest,
+    _: Admin,
+    db_path: DbPath,
+) -> SegmentResponse:
+    segment = segment_service.update_segment(db_path, segment_id, request)
+    if segment is None:
+        raise HTTPException(status_code=404, detail="Segment not found")
+    return SegmentResponse.model_validate(segment.model_dump())
+
+
+@router.delete("/{segment_id}", status_code=204)
+def delete_segment(segment_id: UUID, _: Admin, db_path: DbPath) -> Response:
+    deleted = segment_service.delete_segment(db_path, segment_id)
+    if not deleted:
+        raise HTTPException(status_code=404, detail="Segment not found")
+    return Response(status_code=204)

backend/app/routes/site.py

@@ -0,0 +1,33 @@
+from pathlib import Path
+from typing import Annotated
+
+from fastapi import APIRouter, Depends
+
+from app.auth import require_admin
+from app.config import get_settings
+from app.models import SiteResponse, SiteUpdateRequest
+from app.routes.segments import get_db_path
+from app.services import site_service
+
+router = APIRouter(prefix="/api/site", tags=["site"])
+
+Admin = Annotated[None, Depends(require_admin)]
+DbPath = Annotated[Path, Depends(get_db_path)]
+
+
+@router.get("/")
+def get_site(db_path: DbPath) -> SiteResponse:
+    title = site_service.get_site_title(
+        db_path, default=get_settings().site_title
+    )
+    return SiteResponse(title=title)
+
+
+@router.put("/")
+def update_site(
+    request: SiteUpdateRequest,
+    _: Admin,
+    db_path: DbPath,
+) -> SiteResponse:
+    title = site_service.update_site_title(db_path, request.title)
+    return SiteResponse(title=title)

backend/app/services/asset_service.py

@@ -0,0 +1,35 @@
+from pathlib import Path
+from uuid import uuid4
+
+
+def save_asset(
+    assets_dir: Path,
+    filename: str,
+    content: bytes,
+    allowed_types: str,
+    max_bytes: int,
+) -> str:
+    ext = filename.rsplit(".", maxsplit=1)[-1].lower() if "." in filename else ""
+    allowed = {t.strip() for t in allowed_types.split(",")}
+    if ext not in allowed:
+        raise ValueError("Unsupported file type")
+
+    if len(content) > max_bytes:
+        raise ValueError("File too large")
+
+    new_filename = f"{uuid4()}.{ext}"
+    assets_dir.mkdir(parents=True, exist_ok=True)
+    (assets_dir / new_filename).write_bytes(content)
+    return new_filename
+
+
+def delete_asset(assets_dir: Path, filename: str) -> bool:
+    file_path = (assets_dir / filename).resolve()
+    if not str(file_path).startswith(str(assets_dir.resolve())):
+        return False
+
+    if not file_path.exists():
+        return False
+
+    file_path.unlink()
+    return True

backend/app/services/segment_service.py

@@ -0,0 +1,147 @@
+import json
+import sqlite3
+from datetime import UTC, datetime
+from pathlib import Path
+from uuid import UUID, uuid4
+
+from app.database import get_connection
+from app.models import Segment, SegmentCreateRequest, SegmentType, SegmentUpdateRequest
+
+
+def _row_to_segment(row: sqlite3.Row) -> Segment:
+    return Segment(
+        id=UUID(row["id"]),
+        type=SegmentType(row["type"]),
+        sort_order=row["sort_order"],
+        title=row["title"],
+        content=row["content"],
+        metadata=json.loads(row["metadata"]),
+        created_at=datetime.fromisoformat(row["created_at"]),
+        updated_at=datetime.fromisoformat(row["updated_at"]),
+    )
+
+
+def create_segment(db_path: Path, request: SegmentCreateRequest) -> Segment:
+    conn = get_connection(db_path)
+    try:
+        row = conn.execute(
+            "SELECT COALESCE(MAX(sort_order) + 1, 0) AS next_order FROM segments"
+        ).fetchone()
+        sort_order: int = row["next_order"] if row else 0
+
+        segment_id = uuid4()
+        now = datetime.now(UTC).isoformat()
+        metadata_json = json.dumps(request.metadata)
+
+        cols = "id, type, sort_order, title, content, metadata, created_at, updated_at"
+        conn.execute(
+            f"INSERT INTO segments ({cols}) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",
+            (str(segment_id), request.type.value, sort_order, request.title,
+             request.content, metadata_json, now, now),
+        )
+        conn.commit()
+
+        return Segment(
+            id=segment_id,
+            type=request.type,
+            sort_order=sort_order,
+            title=request.title,
+            content=request.content,
+            metadata=request.metadata,
+            created_at=datetime.fromisoformat(now),
+            updated_at=datetime.fromisoformat(now),
+        )
+    finally:
+        conn.close()
+
+
+def list_segments(db_path: Path) -> list[Segment]:
+    conn = get_connection(db_path)
+    try:
+        rows = conn.execute(
+            "SELECT * FROM segments ORDER BY sort_order ASC"
+        ).fetchall()
+        return [_row_to_segment(row) for row in rows]
+    finally:
+        conn.close()
+
+
+def get_segment(db_path: Path, segment_id: UUID) -> Segment | None:
+    conn = get_connection(db_path)
+    try:
+        row = conn.execute(
+            "SELECT * FROM segments WHERE id = ?", (str(segment_id),)
+        ).fetchone()
+        if row is None:
+            return None
+        return _row_to_segment(row)
+    finally:
+        conn.close()
+
+
+def update_segment(
+    db_path: Path, segment_id: UUID, request: SegmentUpdateRequest
+) -> Segment | None:
+    conn = get_connection(db_path)
+    try:
+        existing = conn.execute(
+            "SELECT * FROM segments WHERE id = ?", (str(segment_id),)
+        ).fetchone()
+        if existing is None:
+            return None
+
+        now = datetime.now(UTC).isoformat()
+        title = request.title if request.title is not None else existing["title"]
+        content = request.content if request.content is not None else existing["content"]
+        metadata_json = (
+            json.dumps(request.metadata) if request.metadata is not None
+            else existing["metadata"]
+        )
+
+        conn.execute(
+            """UPDATE segments SET title = ?, content = ?, metadata = ?, updated_at = ?
+               WHERE id = ?""",
+            (title, content, metadata_json, now, str(segment_id)),
+        )
+        conn.commit()
+
+        return get_segment(db_path, segment_id)
+    finally:
+        conn.close()
+
+
+def delete_segment(db_path: Path, segment_id: UUID) -> bool:
+    conn = get_connection(db_path)
+    try:
+        cursor = conn.execute(
+            "DELETE FROM segments WHERE id = ?", (str(segment_id),)
+        )
+        conn.commit()
+        return cursor.rowcount > 0
+    finally:
+        conn.close()
+
+
+def reorder_segments(db_path: Path, segment_ids: list[UUID]) -> list[Segment]:
+    conn = get_connection(db_path)
+    try:
+        existing_ids = {
+            row["id"]
+            for row in conn.execute("SELECT id FROM segments").fetchall()
+        }
+        requested_ids = {str(sid) for sid in segment_ids}
+        missing = requested_ids - existing_ids
+        if missing:
+            raise ValueError(f"Segment IDs not found: {missing}")
+
+        now = datetime.now(UTC).isoformat()
+        for index, sid in enumerate(segment_ids):
+            conn.execute(
+                "UPDATE segments SET sort_order = ?, updated_at = ? WHERE id = ?",
+                (index, now, str(sid)),
+            )
+        conn.commit()
+
+        return list_segments(db_path)
+    finally:
+        conn.close()

backend/app/services/site_service.py

@@ -0,0 +1,31 @@
+from pathlib import Path
+
+from app.database import get_connection
+
+DEFAULT_SITE_TITLE = "Untitled Site"
+
+
+def get_site_title(db_path: Path, *, default: str = DEFAULT_SITE_TITLE) -> str:
+    conn = get_connection(db_path)
+    try:
+        row = conn.execute(
+            "SELECT value FROM site WHERE key = ?", ("title",)
+        ).fetchone()
+        if row is None:
+            return default
+        return str(row["value"])
+    finally:
+        conn.close()
+
+
+def update_site_title(db_path: Path, title: str) -> str:
+    conn = get_connection(db_path)
+    try:
+        conn.execute(
+            "INSERT OR REPLACE INTO site (key, value) VALUES (?, ?)",
+            ("title", title),
+        )
+        conn.commit()
+        return title
+    finally:
+        conn.close()