M0: backend skeleton — Quart factory, async DB, auth, ACL spine, migrations

Foundation & Identity backend for ThoughtSync:
- Quart app factory (create_app) with /api/health + SPA history-fallback
- async SQLAlchemy 2.0 + asyncpg engine/session (lazy; boots without a DB)
- native email+password auth via signed-cookie session (register/login/logout/me
  + login_required guard); bcrypt password hashing (72-byte safe)
- multi-user sharing-ACL spine (rule 47): users, groups, group_members, and a
  polymorphic shares table + visible_to_user() SQL predicate (owner OR direct
  share OR group share) that M1's notes will scope through
- Alembic async env (adapted from family pattern) + 0001 foundation migration
- DB-free unit tests (app/health/auth-guard, password roundtrip, ACL compile)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm

tests/conftest.py

@@ -0,0 +1,13 @@
+import pytest
+
+from thoughtsync.config import Config
+
+
+@pytest.fixture(autouse=True)
+def _isolated_data_dir(tmp_path, monkeypatch):
+    """Point DATA_DIR at a writable temp dir so create_app() can generate its
+    signing key without needing /var/thoughtsync to exist (DB-free unit tests)."""
+    data_dir = tmp_path / "data"
+    monkeypatch.setattr(Config, "DATA_DIR", str(data_dir))
+    monkeypatch.setattr(Config, "MEDIA_ROOT", str(data_dir / "media"))
+    yield

tests/test_acl.py

@@ -0,0 +1,18 @@
+import uuid
+
+from thoughtsync.acl import visible_to_user
+from thoughtsync.models.user import User
+
+
+def test_visible_to_user_builds_owner_or_shared_predicate():
+    """DB-free smoke test: the predicate compiles and references both the direct
+    (shares) and group (group_members) grant paths. Functional row-visibility is
+    verified against a live database in M1, once notes are a real shareable
+    resource (family practice: DB-backed tests run against the dev image, not CI).
+    """
+    uid = uuid.uuid4()
+    # User stands in as a shareable resource purely to exercise the SQL builder.
+    clause = visible_to_user("note", User.id, User.id, uid)
+    sql = str(clause).lower()
+    assert "shares" in sql
+    assert "group_members" in sql

tests/test_app.py

@@ -0,0 +1,29 @@
+import pytest
+
+from thoughtsync.app import create_app
+
+
+@pytest.fixture
+def app():
+    return create_app()
+
+
+async def test_health_ok(app):
+    client = app.test_client()
+    resp = await client.get("/api/health")
+    assert resp.status_code == 200
+    data = await resp.get_json()
+    assert data["status"] == "ok"
+    assert "version" in data
+
+
+async def test_me_requires_auth(app):
+    client = app.test_client()
+    resp = await client.get("/api/auth/me")
+    assert resp.status_code == 401
+
+
+async def test_unknown_api_route_404s(app):
+    client = app.test_client()
+    resp = await client.get("/api/does-not-exist")
+    assert resp.status_code == 404

tests/test_security.py

@@ -0,0 +1,16 @@
+from thoughtsync.security import hash_password, verify_password
+
+
+def test_password_roundtrip():
+    h = hash_password("correct horse battery staple")
+    assert verify_password("correct horse battery staple", h)
+    assert not verify_password("wrong password", h)
+
+
+def test_password_hash_is_salted():
+    # Same input hashes differently each time (random salt).
+    assert hash_password("same-input") != hash_password("same-input")
+
+
+def test_verify_rejects_garbage_hash():
+    assert not verify_password("whatever", "not-a-bcrypt-hash")