feat: complete CAR-723 api migration

This commit completes the migration of api/ service from the monorepo
to the standalone cartsnitch/api repo with git history preserved.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.gitea/workflows/ci.yml

@@ -1,177 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main, dev, uat]
-  pull_request:
-    branches: [main, dev, uat]
-
-concurrency:
-  group: ci-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: write
-  packages: write
-
-env:
-  REGISTRY: git.farh.net
-  IMAGE_NAME: cartsnitch/api
-
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.12"
-      - run: pip install ruff
-      - name: Ruff lint
-        run: ruff check .
-      - name: Ruff format check
-        run: ruff format --check .
-
-  typecheck:
-    runs-on: ubuntu-latest
-    continue-on-error: true
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.12"
-      - name: Install system dependencies
-        run: sudo apt-get update && sudo apt-get install -y libpq-dev build-essential
-      - run: pip install -e ".[dev]" mypy
-      - name: Type check
-        run: mypy src/cartsnitch_api
-
-  test:
-    runs-on: ubuntu-latest
-    services:
-      postgres:
-        image: postgres:15-alpine
-        env:
-          POSTGRES_USER: cartsnitch
-          POSTGRES_PASSWORD: cartsnitch_test
-          POSTGRES_DB: cartsnitch_test
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-      redis:
-        image: redis:7-alpine
-        ports:
-          - 6379:6379
-        options: >-
-          --health-cmd "redis-cli ping"
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-    env:
-      CARTSNITCH_DATABASE_URL: postgresql+asyncpg://cartsnitch:cartsnitch_test@localhost:5432/cartsnitch_test
-      CARTSNITCH_REDIS_URL: redis://localhost:6379/0
-      CARTSNITCH_JWT_SECRET_KEY: test-secret-do-not-use-in-prod
-      CARTSNITCH_SERVICE_KEY: test-service-key-do-not-use-in-prod
-      CARTSNITCH_FERNET_KEY: wXWQsC0FZlhSz2t_tfVQjNUSP8vgAGG3o3pkjrX8Bw0=
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.12"
-      - name: Install system dependencies
-        run: sudo apt-get update && sudo apt-get install -y libpq-dev build-essential
-      - run: pip install -e ".[dev]"
-      - name: Run tests
-        run: pytest --tb=short -q
-
-  build-and-push:
-    runs-on: ubuntu-latest
-    needs: [lint, test]
-    outputs:
-      calver_tag: ${{ steps.calver.outputs.version }}
-      sha_tag: sha-${{ github.sha }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Generate CalVer tag
-        id: calver
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        run: |
-          DATE_TAG=$(date -u +%Y.%m.%d)
-          EXISTING=$(git tag -l "v${DATE_TAG}*" | sort -V | tail -1)
-          if [ -z "$EXISTING" ]; then
-            VERSION="$DATE_TAG"
-          elif [ "$EXISTING" = "v${DATE_TAG}" ]; then
-            VERSION="${DATE_TAG}.2"
-          else
-            BUILD_NUM=$(echo "$EXISTING" | sed "s/v${DATE_TAG}\.//")
-            VERSION="${DATE_TAG}.$((BUILD_NUM + 1))"
-          fi
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          echo "CalVer tag: $VERSION"
-
-      - name: Log in to Gitea Container Registry
-        run: echo "${{ github.token }}" | docker login git.farh.net -u ${{ github.actor }} --password-stdin
-
-      - name: Extract metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: |
-            type=sha,prefix=sha-,format=long
-            type=raw,value=${{ steps.calver.outputs.version }},enable=${{ github.ref == 'refs/heads/main' }}
-            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
-
-      - name: Build Docker image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./Dockerfile
-          load: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          build-args: |
-            APT_CACHE_BUST=${{ github.run_id }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-      - name: Scan api image for vulnerabilities
-        uses: anchore/scan-action@v5
-        id: scan
-        env:
-          GRYPE_CONFIG: .grype.yaml
-        with:
-          image: "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ github.sha }}"
-          fail-build: true
-          severity-cutoff: high
-          only-fixed: "true"
-          output-format: sarif
-
-
-
-      - name: Push Docker image
-        if: github.event_name == 'push'
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./Dockerfile
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          build-args: |
-            APT_CACHE_BUST=${{ github.run_id }}
-          cache-from: type=gha
-
-      - name: Create git tag
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        run: |
-          git tag "v${{ steps.calver.outputs.version }}"
-          git push origin "v${{ steps.calver.outputs.version }}"
-

.github/workflows/ci.yml

@@ -0,0 +1,304 @@
+name: CI
+
+on:
+  push:
+    branches: [main, dev]
+  pull_request:
+    branches: [main, dev]
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+  packages: write
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: cartsnitch/api
+
+jobs:
+  lint:
+    runs-on: runners-cartsnitch
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+      - run: pip install ruff
+      - name: Ruff lint
+        run: ruff check .
+      - name: Ruff format check
+        run: ruff format --check .
+
+  typecheck:
+    runs-on: runners-cartsnitch
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y libpq-dev build-essential
+      - run: pip install -e ".[dev]" mypy
+      - name: Type check
+        run: mypy src/cartsnitch_api
+
+  test:
+    runs-on: runners-cartsnitch
+    services:
+      postgres:
+        image: postgres:15-alpine
+        credentials:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+        env:
+          POSTGRES_USER: cartsnitch
+          POSTGRES_PASSWORD: cartsnitch_test
+          POSTGRES_DB: cartsnitch_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+      redis:
+        image: redis:7-alpine
+        credentials:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+        ports:
+          - 6379:6379
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    env:
+      CARTSNITCH_DATABASE_URL: postgresql+asyncpg://cartsnitch:cartsnitch_test@localhost:5432/cartsnitch_test
+      CARTSNITCH_REDIS_URL: redis://localhost:6379/0
+      CARTSNITCH_JWT_SECRET_KEY: test-secret-do-not-use-in-prod
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y libpq-dev build-essential
+      - run: pip install -e ".[dev]"
+      - name: Run tests
+        run: pytest --tb=short -q
+
+  build-and-push:
+    runs-on: runners-cartsnitch
+    needs: [lint, test]
+    outputs:
+      calver_tag: ${{ steps.calver.outputs.version }}
+      sha_tag: sha-${{ github.sha }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Generate CalVer tag
+        id: calver
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        run: |
+          DATE_TAG=$(date -u +%Y.%m.%d)
+          EXISTING=$(git tag -l "v${DATE_TAG}*" | sort -V | tail -1)
+          if [ -z "$EXISTING" ]; then
+            VERSION="$DATE_TAG"
+          elif [ "$EXISTING" = "v${DATE_TAG}" ]; then
+            VERSION="${DATE_TAG}.2"
+          else
+            BUILD_NUM=$(echo "$EXISTING" | sed "s/v${DATE_TAG}\.//")
+            VERSION="${DATE_TAG}.$((BUILD_NUM + 1))"
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "CalVer tag: $VERSION"
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Log in to GHCR
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=sha,prefix=sha-,format=long
+            type=raw,value=${{ steps.calver.outputs.version }},enable=${{ github.ref == 'refs/heads/main' }}
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
+
+      - name: Build Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          load: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            APT_CACHE_BUST=${{ github.run_id }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Scan api image for vulnerabilities
+        uses: anchore/scan-action@v5
+        id: scan
+        env:
+          GRYPE_CONFIG: .grype.yaml
+        with:
+          image: "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ github.sha }}"
+          fail-build: true
+          severity-cutoff: high
+          only-fixed: "true"
+          output-format: sarif
+
+      - name: Upload api scan results to GitHub Security
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: ${{ steps.scan.outputs.sarif }}
+
+      - name: Push Docker image
+        if: github.event_name == 'push'
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            APT_CACHE_BUST=${{ github.run_id }}
+          cache-from: type=gha
+
+      - name: Create git tag
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        run: |
+          git tag "v${{ steps.calver.outputs.version }}"
+          git push origin "v${{ steps.calver.outputs.version }}"
+
+  deploy-dev:
+    runs-on: runners-cartsnitch
+    needs: [build-and-push]
+    if: always() && !cancelled() && github.event_name == 'push' && (github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main')
+    steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.CARTSNITCH_APP_ID }}
+          private-key: ${{ secrets.CARTSNITCH_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: infra
+
+      - name: Checkout infra repo
+        uses: actions/checkout@v4
+        with:
+          repository: cartsnitch/infra
+          token: ${{ steps.app-token.outputs.token }}
+          ref: main
+          path: infra
+
+      - name: Install kubectl
+        uses: azure/setup-kubectl@v4
+
+      - name: Install kustomize
+        uses: imranismail/setup-kustomize@v2
+
+      - name: Determine image tag
+        id: api_tag
+        run: |
+          if [ "${{ github.ref }}" == "refs/heads/main" ]; then
+            echo "tag=${{ needs.build-and-push.outputs.calver_tag }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "tag=${{ needs.build-and-push.outputs.sha_tag }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Update api image tag
+        if: needs.build-and-push.result == 'success'
+        run: |
+          cd infra/apps/overlays/dev
+          kustomize edit set image ghcr.io/cartsnitch/api:${{ steps.api_tag.outputs.tag }}
+
+      - name: Commit and push to infra
+        run: |
+          cd infra
+          git config user.name "cartsnitch-ci[bot]"
+          git config user.email "cartsnitch-ci[bot]@users.noreply.github.com"
+          git add apps/overlays/dev/kustomization.yaml
+          git commit -m "ci(dev): update api image"
+          git pull --rebase origin main
+          git push origin main
+
+  deploy-uat:
+    runs-on: runners-cartsnitch
+    needs: [build-and-push]
+    if: always() && !cancelled() && github.event_name == 'push' && (github.ref == 'refs/heads/uat' || github.ref == 'refs/heads/main')
+    steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.CARTSNITCH_APP_ID }}
+          private-key: ${{ secrets.CARTSNITCH_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: infra
+
+      - name: Checkout infra repo
+        uses: actions/checkout@v4
+        with:
+          repository: cartsnitch/infra
+          token: ${{ steps.app-token.outputs.token }}
+          ref: main
+          path: infra
+
+      - name: Install kubectl
+        uses: azure/setup-kubectl@v4
+
+      - name: Install kustomize
+        uses: imranismail/setup-kustomize@v2
+
+      - name: Determine image tag
+        id: api_tag
+        run: |
+          if [ "${{ github.ref }}" == "refs/heads/main" ]; then
+            echo "tag=${{ needs.build-and-push.outputs.calver_tag }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "tag=${{ needs.build-and-push.outputs.sha_tag }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Update api image tag
+        if: needs.build-and-push.result == 'success'
+        run: |
+          cd infra/apps/overlays/uat
+          kustomize edit set image ghcr.io/cartsnitch/api:${{ steps.api_tag.outputs.tag }}
+
+      - name: Commit and push to infra
+        run: |
+          cd infra
+          git config user.name "cartsnitch-ci[bot]"
+          git config user.email "cartsnitch-ci[bot]@users.noreply.github.com"
+          git add apps/overlays/uat/kustomization.yaml
+          git commit -m "ci(uat): update api image"
+          git pull --rebase origin main
+          git push origin main

.mcp.json

@@ -1,11 +0,0 @@
-{
-  "mcpServers": {
-    "gitea": {
-      "type": "http",
-      "url": "https://git-mcp.farh.net/mcp",
-      "headers": {
-        "Authorization": "Bearer ${GITEA_TOKEN}"
-      }
-    }
-  }
-}

SAGENT_HOME/.config/gh/config.yml

@@ -0,0 +1,27 @@
+# The current version of the config schema
+version: 1
+# What protocol to use when performing git operations. Supported values: ssh, https
+git_protocol: https
+# What editor gh should run when creating issues, pull requests, etc. If blank, will refer to environment.
+editor:
+# When to interactively prompt. This is a global config that cannot be overridden by hostname. Supported values: enabled, disabled
+prompt: enabled
+# Preference for editor-based interactive prompting. This is a global config that cannot be overridden by hostname. Supported values: enabled, disabled
+prefer_editor_prompt: disabled
+# A pager program to send command output to, e.g. "less". If blank, will refer to environment. Set the value to "cat" to disable the pager.
+pager:
+# Aliases allow you to create nicknames for gh commands
+aliases:
+    co: pr checkout
+# The path to a unix socket through which to send HTTP connections. If blank, HTTP traffic will be handled by net/http.DefaultTransport.
+http_unix_socket:
+# What web browser gh should use when opening URLs. If blank, will refer to environment.
+browser:
+# Whether to display labels using their RGB hex color codes in terminals that support truecolor. Supported values: enabled, disabled
+color_labels: disabled
+# Whether customizable, 4-bit accessible colors should be used. Supported values: enabled, disabled
+accessible_colors: disabled
+# Whether an accessible prompter should be used. Supported values: enabled, disabled
+accessible_prompter: disabled
+# Whether to use a animated spinner as a progress indicator. If disabled, a textual progress indicator is used instead. Supported values: enabled, disabled
+spinner: enabled

SAGENT_HOME/.config/gh/hosts.yml

@@ -0,0 +1,6 @@
+github.com:
+    users:
+        cartsnitch-qa[bot]:
+            oauth_token: ghs_kyu7ex7DQ2h0OJjbRtceCVhp5IeQQz3E8Cl3
+    oauth_token: ghs_kyu7ex7DQ2h0OJjbRtceCVhp5IeQQz3E8Cl3
+    user: cartsnitch-qa[bot]

alembic/env.py

@@ -45,11 +45,7 @@ def run_migrations_online() -> None:
         poolclass=pool.NullPool,
     )
     with connectable.connect() as connection:
-        context.configure(
-            connection=connection,
-            target_metadata=target_metadata,
-            version_table_column_width=128,
-        )
+        context.configure(connection=connection, target_metadata=target_metadata, version_table_column_width=128)
         with context.begin_transaction():
             context.run_migrations()
         # Create any tables defined in models but not yet created by migrations.
@@ -60,7 +56,6 @@ def run_migrations_online() -> None:
             connection.commit()
         except Exception as exc:
             import logging
-
             logging.getLogger("alembic.env").warning(
                 "create_all failed (non-fatal, migrations should handle table creation): %s", exc
             )

alembic/versions/002_better_auth_tables.py

@@ -30,10 +30,7 @@ def upgrade() -> None:
     if inspector.has_table("users"):
         existing_user_cols = [c["name"] for c in inspector.get_columns("users")]
         if "email_verified" not in existing_user_cols:
-            op.add_column(
-                "users",
-                sa.Column("email_verified", sa.Boolean(), nullable=False, server_default="false"),
-            )
+            op.add_column("users", sa.Column("email_verified", sa.Boolean(), nullable=False, server_default="false"))
         if "image" not in existing_user_cols:
             op.add_column("users", sa.Column("image", sa.Text(), nullable=True))
 
@@ -47,18 +44,8 @@ def upgrade() -> None:
             sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
             sa.Column("ip_address", sa.Text(), nullable=True),
             sa.Column("user_agent", sa.Text(), nullable=True),
-            sa.Column(
-                "created_at",
-                sa.DateTime(timezone=True),
-                server_default=sa.func.now(),
-                nullable=False,
-            ),
-            sa.Column(
-                "updated_at",
-                sa.DateTime(timezone=True),
-                server_default=sa.func.now(),
-                nullable=False,
-            ),
+            sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+            sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
             sa.PrimaryKeyConstraint("id"),
         )
         op.create_index("ix_sessions_token", "sessions", ["token"], unique=True)
@@ -79,18 +66,8 @@ def upgrade() -> None:
             sa.Column("scope", sa.Text(), nullable=True),
             sa.Column("id_token", sa.Text(), nullable=True),
             sa.Column("password", sa.Text(), nullable=True),
-            sa.Column(
-                "created_at",
-                sa.DateTime(timezone=True),
-                server_default=sa.func.now(),
-                nullable=False,
-            ),
-            sa.Column(
-                "updated_at",
-                sa.DateTime(timezone=True),
-                server_default=sa.func.now(),
-                nullable=False,
-            ),
+            sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+            sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
             sa.PrimaryKeyConstraint("id"),
         )
         op.create_index("ix_accounts_user_id", "accounts", ["user_id"])
@@ -103,18 +80,8 @@ def upgrade() -> None:
             sa.Column("identifier", sa.Text(), nullable=False),
             sa.Column("value", sa.Text(), nullable=False),
             sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
-            sa.Column(
-                "created_at",
-                sa.DateTime(timezone=True),
-                server_default=sa.func.now(),
-                nullable=False,
-            ),
-            sa.Column(
-                "updated_at",
-                sa.DateTime(timezone=True),
-                server_default=sa.func.now(),
-                nullable=False,
-            ),
+            sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+            sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
             sa.PrimaryKeyConstraint("id"),
         )
 
@@ -129,10 +96,8 @@ def upgrade() -> None:
             user_id_str = str(user_id)
             conn.execute(
                 text(
-                    "INSERT INTO accounts "
-                    "(id, user_id, account_id, provider_id, password, created_at, updated_at) "
-                    "VALUES (gen_random_uuid()::text, :user_id, :account_id, "
-                    "'credential', :password, now(), now())"
+                    "INSERT INTO accounts (id, user_id, account_id, provider_id, password, created_at, updated_at) "
+                    "VALUES (gen_random_uuid()::text, :user_id, :account_id, 'credential', :password, now(), now())"
                 ),
                 {"user_id": user_id_str, "account_id": user_id_str, "password": hashed_password},
             )

alembic/versions/004_fix_user_id_text.py

@@ -40,12 +40,7 @@ def upgrade() -> None:
             return  # already TEXT — nothing to do
 
     # Step 1: Drop existing FK constraints (ignore if they don't exist)
-    op.execute(
-        text(
-            "ALTER TABLE user_store_accounts "
-            "DROP CONSTRAINT IF EXISTS user_store_accounts_user_id_fkey"
-        )
-    )
+    op.execute(text("ALTER TABLE user_store_accounts DROP CONSTRAINT IF EXISTS user_store_accounts_user_id_fkey"))
     op.execute(text("ALTER TABLE purchases DROP CONSTRAINT IF EXISTS purchases_user_id_fkey"))
 
     # Step 2: Alter users.id from uuid to text
@@ -94,12 +89,7 @@ def upgrade() -> None:
 
 def downgrade() -> None:
     # Drop FK constraints
-    op.execute(
-        text(
-            "ALTER TABLE user_store_accounts "
-            "DROP CONSTRAINT IF EXISTS user_store_accounts_user_id_fkey"
-        )
-    )
+    op.execute(text("ALTER TABLE user_store_accounts DROP CONSTRAINT IF EXISTS user_store_accounts_user_id_fkey"))
     op.execute(text("ALTER TABLE purchases DROP CONSTRAINT IF EXISTS purchases_user_id_fkey"))
 
     # Revert users.id from text to uuid

alembic/versions/005_add_email_inbound_token.py

@@ -20,7 +20,7 @@ depends_on = None
 def upgrade() -> None:
     conn = op.get_bind()
     inspector = sa.inspect(conn)
-    # Guard: on fresh DB, Base.metadata.create_all already has the column
+    # Guard: on a fresh DB Base.metadata.create_all creates users table with the column already present
     if not inspector.has_table("users"):
         return
     existing_cols = [c["name"] for c in inspector.get_columns("users")]

alembic/versions/006_email_inbound_token_server_default.py

@@ -6,7 +6,6 @@ Create Date: 2026-04-04
 """
 
 import sqlalchemy as sa
-
 from alembic import op
 
 revision = "006_email_inbound_token_server_default"
@@ -30,8 +29,7 @@ def upgrade() -> None:
         "users",
         "email_inbound_token",
         server_default=sa.text(
-            "replace(replace(trim(trailing '=' from "
-            "encode(gen_random_bytes(16), 'base64')), '+', '-'), '/', '_')"
+            "replace(replace(trim(trailing '=' from encode(gen_random_bytes(16), 'base64')), '+', '-'), '/', '_')"
         ),
     )
 

alembic/versions/007_bootstrap_users_table.py

@@ -27,8 +27,7 @@ def upgrade() -> None:
     if inspector.has_table("users"):
         return  # Table already exists (non-fresh DB or create_all already ran)
 
-    conn.execute(
-        text("""
+    conn.execute(text("""
         CREATE TABLE users (
             id TEXT PRIMARY KEY,
             email VARCHAR(255) NOT NULL UNIQUE,
@@ -37,20 +36,11 @@ def upgrade() -> None:
             email_verified BOOLEAN NOT NULL DEFAULT false,
             image TEXT,
             email_inbound_token VARCHAR(22) NOT NULL UNIQUE
-                DEFAULT (
-                    replace(
-                        replace(
-                            trim(trailing '=' from encode(gen_random_bytes(16), 'base64')),
-                            '+', '-'
-                        ),
-                        '/', '_'
-                    )
-                ),
+                DEFAULT replace(replace(trim(trailing '=' from encode(gen_random_bytes(16), 'base64')), '+', '-'), '/', '_'),
             created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
             updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
         )
-    """)
-    )
+    """))
 
 
 def downgrade() -> None:

alembic/versions/008_create_domain_tables.py

@@ -29,18 +29,8 @@ def upgrade() -> None:
             sa.Column("slug", sa.String(20), nullable=False, unique=True),
             sa.Column("logo_url", sa.String(500), nullable=True),
             sa.Column("website_url", sa.String(500), nullable=True),
-            sa.Column(
-                "created_at",
-                sa.DateTime(timezone=True),
-                server_default=sa.func.now(),
-                nullable=False,
-            ),
-            sa.Column(
-                "updated_at",
-                sa.DateTime(timezone=True),
-                server_default=sa.func.now(),
-                nullable=False,
-            ),
+            sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+            sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
         )
 
     # 2. store_locations
@@ -55,18 +45,8 @@ def upgrade() -> None:
             sa.Column("zip", sa.String(10), nullable=False),
             sa.Column("lat", sa.Float(), nullable=True),
             sa.Column("lng", sa.Float(), nullable=True),
-            sa.Column(
-                "created_at",
-                sa.DateTime(timezone=True),
-                server_default=sa.func.now(),
-                nullable=False,
-            ),
-            sa.Column(
-                "updated_at",
-                sa.DateTime(timezone=True),
-                server_default=sa.func.now(),
-                nullable=False,
-            ),
+            sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+            sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
         )
 
     # 3. normalized_products
@@ -81,18 +61,8 @@ def upgrade() -> None:
             sa.Column("size", sa.String(50), nullable=True),
             sa.Column("size_unit", sa.String(10), nullable=True),
             sa.Column("upc_variants", sa.JSON(), nullable=True),
-            sa.Column(
-                "created_at",
-                sa.DateTime(timezone=True),
-                server_default=sa.func.now(),
-                nullable=False,
-            ),
-            sa.Column(
-                "updated_at",
-                sa.DateTime(timezone=True),
-                server_default=sa.func.now(),
-                nullable=False,
-            ),
+            sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+            sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
         )
 
     # 4. purchases
@@ -102,9 +72,7 @@ def upgrade() -> None:
             sa.Column("id", sa.Uuid(), server_default=text("gen_random_uuid()"), primary_key=True),
             sa.Column("user_id", sa.Text(), sa.ForeignKey("users.id"), nullable=False),
             sa.Column("store_id", sa.Uuid(), sa.ForeignKey("stores.id"), nullable=False),
-            sa.Column(
-                "store_location_id", sa.Uuid(), sa.ForeignKey("store_locations.id"), nullable=True
-            ),
+            sa.Column("store_location_id", sa.Uuid(), sa.ForeignKey("store_locations.id"), nullable=True),
             sa.Column("receipt_id", sa.String(200), nullable=False),
             sa.Column("purchase_date", sa.Date(), nullable=False),
             sa.Column("total", sa.Numeric(10, 2), nullable=False),
@@ -113,24 +81,9 @@ def upgrade() -> None:
             sa.Column("savings_total", sa.Numeric(10, 2), nullable=True),
             sa.Column("source_url", sa.String(500), nullable=True),
             sa.Column("raw_data", sa.JSON(), nullable=True),
-            sa.Column(
-                "ingested_at",
-                sa.DateTime(timezone=True),
-                server_default=sa.func.now(),
-                nullable=False,
-            ),
-            sa.Column(
-                "created_at",
-                sa.DateTime(timezone=True),
-                server_default=sa.func.now(),
-                nullable=False,
-            ),
-            sa.Column(
-                "updated_at",
-                sa.DateTime(timezone=True),
-                server_default=sa.func.now(),
-                nullable=False,
-            ),
+            sa.Column("ingested_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+            sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+            sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
             sa.UniqueConstraint("user_id", "store_id", "receipt_id", name="uq_purchase_receipt"),
             sa.Index("ix_purchases_user_store", "user_id", "store_id"),
         )
@@ -151,24 +104,9 @@ def upgrade() -> None:
             sa.Column("coupon_discount", sa.Numeric(10, 2), nullable=True),
             sa.Column("loyalty_discount", sa.Numeric(10, 2), nullable=True),
             sa.Column("category_raw", sa.String(100), nullable=True),
-            sa.Column(
-                "normalized_product_id",
-                sa.Uuid(),
-                sa.ForeignKey("normalized_products.id"),
-                nullable=True,
-            ),
-            sa.Column(
-                "created_at",
-                sa.DateTime(timezone=True),
-                server_default=sa.func.now(),
-                nullable=False,
-            ),
-            sa.Column(
-                "updated_at",
-                sa.DateTime(timezone=True),
-                server_default=sa.func.now(),
-                nullable=False,
-            ),
+            sa.Column("normalized_product_id", sa.Uuid(), sa.ForeignKey("normalized_products.id"), nullable=True),
+            sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+            sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
         )
 
     # 6. coupons
@@ -177,12 +115,7 @@ def upgrade() -> None:
             "coupons",
             sa.Column("id", sa.Uuid(), server_default=text("gen_random_uuid()"), primary_key=True),
             sa.Column("store_id", sa.Uuid(), sa.ForeignKey("stores.id"), nullable=False),
-            sa.Column(
-                "normalized_product_id",
-                sa.Uuid(),
-                sa.ForeignKey("normalized_products.id"),
-                nullable=True,
-            ),
+            sa.Column("normalized_product_id", sa.Uuid(), sa.ForeignKey("normalized_products.id"), nullable=True),
             sa.Column("title", sa.String(300), nullable=False),
             sa.Column("description", sa.String(1000), nullable=True),
             sa.Column("discount_type", sa.String(20), nullable=False),
@@ -194,18 +127,8 @@ def upgrade() -> None:
             sa.Column("coupon_code", sa.String(100), nullable=True),
             sa.Column("source_url", sa.String(500), nullable=True),
             sa.Column("scraped_at", sa.DateTime(timezone=True), nullable=True),
-            sa.Column(
-                "created_at",
-                sa.DateTime(timezone=True),
-                server_default=sa.func.now(),
-                nullable=False,
-            ),
-            sa.Column(
-                "updated_at",
-                sa.DateTime(timezone=True),
-                server_default=sa.func.now(),
-                nullable=False,
-            ),
+            sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+            sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
         )
 
     # 7. price_history
@@ -213,12 +136,7 @@ def upgrade() -> None:
         op.create_table(
             "price_history",
             sa.Column("id", sa.Uuid(), server_default=text("gen_random_uuid()"), primary_key=True),
-            sa.Column(
-                "normalized_product_id",
-                sa.Uuid(),
-                sa.ForeignKey("normalized_products.id"),
-                nullable=False,
-            ),
+            sa.Column("normalized_product_id", sa.Uuid(), sa.ForeignKey("normalized_products.id"), nullable=False),
             sa.Column("store_id", sa.Uuid(), sa.ForeignKey("stores.id"), nullable=False),
             sa.Column("observed_date", sa.Date(), nullable=False),
             sa.Column("regular_price", sa.Numeric(10, 2), nullable=False),
@@ -226,27 +144,10 @@ def upgrade() -> None:
             sa.Column("loyalty_price", sa.Numeric(10, 2), nullable=True),
             sa.Column("coupon_price", sa.Numeric(10, 2), nullable=True),
             sa.Column("source", sa.String(20), nullable=False),
-            sa.Column(
-                "purchase_item_id", sa.Uuid(), sa.ForeignKey("purchase_items.id"), nullable=True
-            ),
-            sa.Column(
-                "created_at",
-                sa.DateTime(timezone=True),
-                server_default=sa.func.now(),
-                nullable=False,
-            ),
-            sa.Column(
-                "updated_at",
-                sa.DateTime(timezone=True),
-                server_default=sa.func.now(),
-                nullable=False,
-            ),
-            sa.Index(
-                "ix_price_history_product_store_date",
-                "normalized_product_id",
-                "store_id",
-                "observed_date",
-            ),
+            sa.Column("purchase_item_id", sa.Uuid(), sa.ForeignKey("purchase_items.id"), nullable=True),
+            sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+            sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+            sa.Index("ix_price_history_product_store_date", "normalized_product_id", "store_id", "observed_date"),
         )
 
     # 8. shrinkflation_events
@@ -254,12 +155,7 @@ def upgrade() -> None:
         op.create_table(
             "shrinkflation_events",
             sa.Column("id", sa.Uuid(), server_default=text("gen_random_uuid()"), primary_key=True),
-            sa.Column(
-                "normalized_product_id",
-                sa.Uuid(),
-                sa.ForeignKey("normalized_products.id"),
-                nullable=False,
-            ),
+            sa.Column("normalized_product_id", sa.Uuid(), sa.ForeignKey("normalized_products.id"), nullable=False),
             sa.Column("detected_date", sa.Date(), nullable=False),
             sa.Column("old_size", sa.String(50), nullable=False),
             sa.Column("new_size", sa.String(50), nullable=False),
@@ -269,18 +165,8 @@ def upgrade() -> None:
             sa.Column("price_at_new_size", sa.Numeric(10, 2), nullable=True),
             sa.Column("confidence", sa.Numeric(3, 2), server_default=text("1.00"), nullable=False),
             sa.Column("notes", sa.String(1000), nullable=True),
-            sa.Column(
-                "created_at",
-                sa.DateTime(timezone=True),
-                server_default=sa.func.now(),
-                nullable=False,
-            ),
-            sa.Column(
-                "updated_at",
-                sa.DateTime(timezone=True),
-                server_default=sa.func.now(),
-                nullable=False,
-            ),
+            sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+            sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
         )
 
     # 9. user_store_accounts
@@ -294,18 +180,8 @@ def upgrade() -> None:
             sa.Column("session_expires_at", sa.DateTime(timezone=True), nullable=True),
             sa.Column("last_sync_at", sa.DateTime(timezone=True), nullable=True),
             sa.Column("status", sa.String(20), server_default=text("'active'"), nullable=False),
-            sa.Column(
-                "created_at",
-                sa.DateTime(timezone=True),
-                server_default=sa.func.now(),
-                nullable=False,
-            ),
-            sa.Column(
-                "updated_at",
-                sa.DateTime(timezone=True),
-                server_default=sa.func.now(),
-                nullable=False,
-            ),
+            sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+            sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
             sa.UniqueConstraint("user_id", "store_id", name="uq_user_store_account"),
         )
 

alembic/versions/009_add_gin_index_upc_variants.py

@@ -6,7 +6,6 @@ Create Date: 2026-04-14
 """
 
 import sqlalchemy as sa
-
 from alembic import op
 
 revision = "009_add_gin_index_upc_variants"

pyproject.toml

@@ -15,17 +15,12 @@ dependencies = [
     "sqlalchemy[asyncio]>=2.0.35",
     "asyncpg>=0.30.0",
     "alembic>=1.13,<2.0",
-    "psycopg2-binary>=2.9,<3.0",
+    "psycopg2>=2.9,<3.0",
     "python-jose[cryptography]>=3.3.0",
     "passlib[bcrypt]>=1.7.4",
     "httpx>=0.27.0",
     "redis[hiredis]>=5.2.0",
     "cryptography>=43.0.0",
-    "pytest[dev]>=9.0.3",
-    "pytest-asyncio[dev]>=1.3.0",
-    "aiosqlite[dev]>=0.22.1",
-    "ruff[dev]>=0.15.14",
-    "mypy[dev]>=1.19.0",
 ]
 
 [project.optional-dependencies]

src/cartsnitch_api/auth/dependencies.py

@@ -5,8 +5,7 @@ Sessions are verified by querying the shared sessions table directly.
 """
 
 from datetime import UTC, datetime
-
-from fastapi import Depends, Header, HTTPException, Request, status
+from fastapi import Cookie, Depends, Header, HTTPException, Request, status
 from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
 from sqlalchemy import text
 from sqlalchemy.ext.asyncio import AsyncSession

src/cartsnitch_api/auth/routes.py

@@ -6,10 +6,13 @@ endpoints that query our own user data from the shared database.
 """
 
 from fastapi import APIRouter, Depends, HTTPException, status
+from pydantic import BaseModel
+from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from cartsnitch_api.auth.dependencies import get_current_user
 from cartsnitch_api.database import get_db
+from cartsnitch_api.models import User
 from cartsnitch_api.schemas import (
     UpdateUserRequest,
     UserResponse,

src/cartsnitch_api/config.py

@@ -23,12 +23,7 @@ class Settings(BaseSettings):
 
     auth_service_url: str = "http://auth:3001"
 
-    cors_origins: list[str] = [
-        "http://localhost:3000",
-        "https://cartsnitch.com",
-        "https://dev.cartsnitch.com",
-        "https://uat.cartsnitch.com",
-    ]
+    cors_origins: list[str] = ["http://localhost:3000", "https://cartsnitch.com"]
 
     receiptwitness_url: str = "http://receiptwitness:8001"
     stickershock_url: str = "http://stickershock:8002"

src/cartsnitch_api/main.py

@@ -6,10 +6,11 @@ from fastapi import APIRouter, FastAPI
 
 from cartsnitch_api.auth.routes import router as auth_router
 from cartsnitch_api.cache import cache_client
-from cartsnitch_api.middleware.audit import add_audit_middleware
+from cartsnitch_api.database import dispose_engine
 from cartsnitch_api.middleware.cors import add_cors_middleware
 from cartsnitch_api.middleware.error_handler import add_error_handlers, add_error_monitor_middleware
 from cartsnitch_api.middleware.rate_limit import add_rate_limit_middleware
+from cartsnitch_api.middleware.audit import add_audit_middleware
 from cartsnitch_api.routes.alerts import router as alerts_router
 from cartsnitch_api.routes.coupons import router as coupons_router
 from cartsnitch_api.routes.health import router as health_router
@@ -25,8 +26,6 @@ from cartsnitch_api.routes.user import router as user_router
 
 @asynccontextmanager
 async def lifespan(app: FastAPI):
-    from cartsnitch_api.database import dispose_engine
-
     await cache_client.initialize()
     yield
     await cache_client.close()

src/cartsnitch_api/models/user.py

@@ -26,7 +26,9 @@ class User(TimestampMixin, Base):
     email: Mapped[str] = mapped_column(String(255), nullable=False, unique=True)
     hashed_password: Mapped[str | None] = mapped_column(String(255), nullable=True)
     display_name: Mapped[str | None] = mapped_column(String(100))
-    email_verified: Mapped[bool] = mapped_column(Boolean, nullable=False, server_default="false")
+    email_verified: Mapped[bool] = mapped_column(
+        Boolean, nullable=False, server_default="false"
+    )
     image: Mapped[str | None] = mapped_column(Text, nullable=True)
     email_inbound_token: Mapped[str] = mapped_column(
         String(22),
@@ -34,8 +36,7 @@ class User(TimestampMixin, Base):
         unique=True,
         default=lambda: secrets.token_urlsafe(16),
         server_default=sa.text(
-            "replace(replace(trim(trailing '=' from "
-            "encode(gen_random_bytes(16), 'base64')), '+', '-'), '/', '_')"
+            "replace(replace(trim(trailing '=' from encode(gen_random_bytes(16), 'base64')), '+', '-'), '/', '_')"
         ),
     )
 

tests/conftest.py

@@ -5,133 +5,20 @@ matching the Better-Auth session validation flow.
 """
 
 import secrets
-import uuid as uuid_lib
+import uuid
 from datetime import UTC, datetime, timedelta
 
 import pytest
 from httpx import ASGITransport, AsyncClient
-from sqlalchemy import create_engine, event, text, TypeDecorator, String
-import sqlalchemy as sa
-from sqlalchemy.dialects.postgresql import UUID as PostgresUUID
+from sqlalchemy import create_engine, event, text
 from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
 from sqlalchemy.orm import sessionmaker
-from sqlalchemy.types import CHAR, TypeEngine
 
+from cartsnitch_api.config import settings as cartsnitch_settings
 from cartsnitch_api.database import get_db
 from cartsnitch_api.main import create_app
 from cartsnitch_api.models import Base
 
-cartsnitch_settings = None
-
-
-class SQLiteCompatibleUUID(TypeDecorator):
-    """Adapts PostgreSQL UUID for use with SQLite at test runtime.
-
-    Stores as CHAR(32) hex string, converts to Python uuid.UUID on read.
-    """
-
-    impl = CHAR(32)
-    cache_ok = True
-
-    def process_bind_param(self, value, dialect):
-        if value is None:
-            return None
-        if isinstance(value, uuid_lib.UUID):
-            return value.hex
-        return str(value)
-
-    def process_result_value(self, value, dialect):
-        if value is None:
-            return None
-        return uuid_lib.UUID(hex=value)
-
-
-class _StringUUID(TypeDecorator):
-    """Fallback TypeDecorator that accepts both UUID objects and strings.
-
-    Used when the model uses Text but tests pass uuid.UUID values.
-    Stores as native string, returns uuid.UUID on read.
-    """
-
-    impl = String(36)
-    cache_ok = True
-
-    def process_bind_param(self, value, dialect):
-        if value is None:
-            return None
-        if isinstance(value, uuid_lib.UUID):
-            return value.hex
-        return str(value)
-
-    def process_result_value(self, value, dialect):
-        if value is None:
-            return None
-        try:
-            return uuid_lib.UUID(hex=value)
-        except Exception:
-            return value
-
-
-def _adapt_uuid_columns_for_sqlite(googol=None):
-    """Replace PostgreSQL UUID column types with SQLiteCompatibleUUID.
-
-    PostgreSQL UUID columns generate DDL using gen_random_uuid() which SQLite
-    doesn't support. This replaces those column types so SQLite can bind UUIDs
-    as hex strings. Also sets a Python-side default so INSERTs without explicit
-    id succeed. Accepts an optional connection arg from run_sync.
-    """
-    for table in Base.metadata.tables.values():
-        for column in table.columns.values():
-            if isinstance(column.type, PostgresUUID):
-                column.type = SQLiteCompatibleUUID()
-                if column.server_default is None and column.default is None:
-                    column.default = uuid_lib.uuid4
-
-
-def _adapt_text_pk_columns_for_uuid(googol=None):
-    """Replace Text primary key columns that tests bind uuid.UUID values into.
-
-    User.id is a Text column but tests pass uuid.UUID objects. SQLite can't
-    bind UUID directly so we swap these to a compatible type. Accepts an
-    optional connection arg from run_sync.
-    """
-    for table in Base.metadata.tables.values():
-        for column in table.columns.values():
-            if column.primary_key and isinstance(column.type, sa.Text):
-                column.type = _StringUUID()
-
-
-def _adapt_fk_columns_for_uuid(googol=None):
-    """Replace FK columns that reference UUID PKs but are typed as Text.
-
-    purchase.user_id, user_store_accounts.user_id/store_id, etc. are typed as str
-    but tests pass uuid.UUID objects for them. Accepts an optional connection arg
-    from run_sync.
-    """
-    for table in Base.metadata.tables.values():
-        for column in table.columns.values():
-            if column.foreign_keys:
-                for fk in column.foreign_keys:
-                    if isinstance(column.type, (sa.Text, sa.String)) and column.type.length in (None, 255):
-                        column.type = _StringUUID()
-
-
-def _strip_postgres_server_defaults(googol=None):
-    """Remove PostgreSQL-specific server_default expressions for SQLite compatibility.
-
-    PostgreSQL functions like gen_random_uuid() and the base64 encoding expression
-    in email_inbound_token are not valid in SQLite. Accepts an optional connection
-    arg from run_sync.
-    """
-    for table in Base.metadata.tables.values():
-        for column in table.columns.values():
-            if column.server_default is not None:
-                sd = str(column.server_default.arg)
-                if "gen_random_uuid" in sd or "gen_random_bytes" in sd:
-                    column.server_default = None
-
-TEST_DATABASE_URL = "sqlite+aiosqlite:///:memory:"
-
 TEST_JWT_SECRET = secrets.token_urlsafe(32)
 TEST_SERVICE_KEY = secrets.token_urlsafe(32)
 TEST_FERNET_KEY = "7reF42nmTwbdN21PBoubGp7h_FU8qSimstmlaMLoRK8="
@@ -139,35 +26,33 @@ TEST_FERNET_KEY = "7reF42nmTwbdN21PBoubGp7h_FU8qSimstmlaMLoRK8="
 
 @pytest.fixture(autouse=True)
 def setup_test_settings():
-    from cartsnitch_api.config import settings as real_settings
-    original_jwt = real_settings.jwt_secret_key
-    original_service = real_settings.service_key
-    original_fernet = real_settings.fernet_key
-    real_settings.jwt_secret_key = TEST_JWT_SECRET
-    real_settings.service_key = TEST_SERVICE_KEY
-    real_settings.fernet_key = TEST_FERNET_KEY
+    original_jwt = cartsnitch_settings.jwt_secret_key
+    original_service = cartsnitch_settings.service_key
+    original_fernet = cartsnitch_settings.fernet_key
+    cartsnitch_settings.jwt_secret_key = TEST_JWT_SECRET
+    cartsnitch_settings.service_key = TEST_SERVICE_KEY
+    cartsnitch_settings.fernet_key = TEST_FERNET_KEY
     yield
-    real_settings.jwt_secret_key = original_jwt
-    real_settings.service_key = original_service
-    real_settings.fernet_key = original_fernet
+    cartsnitch_settings.jwt_secret_key = original_jwt
+    cartsnitch_settings.service_key = original_service
+    cartsnitch_settings.fernet_key = original_fernet
+
+
+TEST_DATABASE_URL = "sqlite+aiosqlite:///:memory:"
 
 
 @pytest.fixture(autouse=True)
 def disable_rate_limiting():
-    from cartsnitch_api.config import settings as real_settings
-    real_settings.rate_limit_enabled = False
+    """Disable rate limiting for all tests to prevent 429 interference."""
+    cartsnitch_settings.rate_limit_enabled = False
     yield
-    real_settings.rate_limit_enabled = True
+    cartsnitch_settings.rate_limit_enabled = True
 
 
 @pytest.fixture
 def engine():
     """Sync in-memory SQLite engine for model unit tests."""
     eng = create_engine("sqlite:///:memory:")
-    _adapt_uuid_columns_for_sqlite()
-    _adapt_text_pk_columns_for_uuid()
-    _adapt_fk_columns_for_uuid()
-    _strip_postgres_server_defaults()
     Base.metadata.create_all(eng)
     yield eng
     eng.dispose()
@@ -192,10 +77,6 @@ async def db_engine():
         cursor.close()
 
     async with engine.begin() as conn:
-        await conn.run_sync(_adapt_uuid_columns_for_sqlite)
-        await conn.run_sync(_adapt_text_pk_columns_for_uuid)
-        await conn.run_sync(_adapt_fk_columns_for_uuid)
-        await conn.run_sync(_strip_postgres_server_defaults)
         await conn.run_sync(Base.metadata.create_all)
         # Create Better-Auth tables (not managed by SQLAlchemy models)
         await conn.execute(
@@ -285,21 +166,19 @@ async def _create_test_user_and_session(
     Returns (user_dict, session_token).  Better-Auth stores the raw token
     in the DB, so we insert it as-is.
     """
-    user_id = str(uuid_lib.uuid4())
+    user_id = str(uuid.uuid4())
     email = user_overrides.get("email", "test@example.com")
     display_name = user_overrides.get("display_name", "Test User")
     session_token = secrets.token_urlsafe(32)
-    session_id = str(uuid_lib.uuid4())
+    session_id = str(uuid.uuid4())
     now = datetime.now(UTC).isoformat()
     expires = (datetime.now(UTC) + timedelta(days=7)).isoformat()
 
     async with db_engine.begin() as conn:
         await conn.execute(
             text(
-                "INSERT INTO users (id, email, hashed_password, display_name, "
-                "email_verified, email_inbound_token, created_at, updated_at) "
-                "VALUES (:id, :email, :hashed_password, :display_name, "
-                ":email_verified, :email_inbound_token, :created_at, :updated_at)"
+                "INSERT INTO users (id, email, hashed_password, display_name, email_verified, created_at, updated_at) "
+                "VALUES (:id, :email, :hashed_password, :display_name, :email_verified, :created_at, :updated_at)"
             ),
             {
                 "id": user_id,
@@ -307,7 +186,6 @@ async def _create_test_user_and_session(
                 "hashed_password": "not-used-with-better-auth",
                 "display_name": display_name,
                 "email_verified": False,
-                "email_inbound_token": secrets.token_urlsafe(16),
                 "created_at": now,
                 "updated_at": now,
             },

tests/test_auth/test_auth_endpoints.py

@@ -138,9 +138,8 @@ async def test_expired_session_rejected(client, db_engine):
     async with db_engine.begin() as conn:
         await conn.execute(
             text(
-                "INSERT INTO users (id, email, hashed_password, display_name, "
-                "email_verified, email_inbound_token, created_at, updated_at) "
-                "VALUES (:id, :email, :hp, :dn, :ev, :token, :ca, :ua)"
+                "INSERT INTO users (id, email, hashed_password, display_name, email_verified, created_at, updated_at) "
+                "VALUES (:id, :email, :hp, :dn, :ev, :ca, :ua)"
             ),
             {
                 "id": user_id,
@@ -148,7 +147,6 @@ async def test_expired_session_rejected(client, db_engine):
                 "hp": "unused",
                 "dn": "Expired User",
                 "ev": False,
-                "token": secrets.token_urlsafe(16),
                 "ca": now,
                 "ua": now,
             },

tests/test_config.py

@@ -1,5 +1,7 @@
 """Tests for Settings config, specifically the database_url env var fallback."""
 
+import os
+
 from cartsnitch_api.config import Settings
 
 
@@ -28,10 +30,7 @@ def test_database_url_normalizes_plain_postgresql_prefix():
         "DATABASE_URL": "postgresql://cartsnitch:cartsnitch@localhost:5432/cartsnitch",
     }
     settings = Settings(**env)
-    assert (
-        settings.database_url
-        == "postgresql+asyncpg://cartsnitch:cartsnitch@localhost:5432/cartsnitch"
-    )
+    assert settings.database_url == "postgresql+asyncpg://cartsnitch:cartsnitch@localhost:5432/cartsnitch"
 
 
 def test_database_url_preserves_asyncpg_prefix():
@@ -40,16 +39,10 @@ def test_database_url_preserves_asyncpg_prefix():
         "CARTSNITCH_DATABASE_URL": "postgresql+asyncpg://cartsnitch:cartsnitch@localhost:5432/cartsnitch",
     }
     settings = Settings(**env)
-    assert (
-        settings.database_url
-        == "postgresql+asyncpg://cartsnitch:cartsnitch@localhost:5432/cartsnitch"
-    )
+    assert settings.database_url == "postgresql+asyncpg://cartsnitch:cartsnitch@localhost:5432/cartsnitch"
 
 
 def test_database_url_default():
     """When neither env var is set, the hardcoded default is used."""
     settings = Settings()
-    assert (
-        settings.database_url
-        == "postgresql+asyncpg://cartsnitch:cartsnitch@localhost:5432/cartsnitch"
-    )
+    assert settings.database_url == "postgresql+asyncpg://cartsnitch:cartsnitch@localhost:5432/cartsnitch"

tests/test_e2e/test_auth_validation.py

@@ -65,9 +65,8 @@ class TestSessionValidation:
         async with db_engine.begin() as conn:
             await conn.execute(
                 text(
-                    "INSERT INTO users (id, email, hashed_password, display_name, "
-                    "email_verified, email_inbound_token, created_at, updated_at) "
-                    "VALUES (:id, :email, :hp, :dn, :ev, :token, :ca, :ua)"
+                    "INSERT INTO users (id, email, hashed_password, display_name, email_verified, created_at, updated_at) "
+                    "VALUES (:id, :email, :hp, :dn, :ev, :ca, :ua)"
                 ),
                 {
                     "id": user_id,
@@ -75,7 +74,6 @@ class TestSessionValidation:
                     "hp": "unused",
                     "dn": "Expired User",
                     "ev": False,
-                    "token": secrets.token_urlsafe(16),
                     "ca": now,
                     "ua": now,
                 },

tests/test_encrypted_json.py

@@ -1,12 +1,11 @@
 """Tests for EncryptedJSON TypeDecorator and session_data encryption."""
 
 import json
-import uuid as uuid_lib
 
 import pytest
 from cryptography.fernet import Fernet
 from pydantic import ValidationError
-from sqlalchemy import column, table, text
+from sqlalchemy import column, create_engine, table, text
 from sqlalchemy.orm import sessionmaker
 
 from cartsnitch_api.config import settings
@@ -16,13 +15,18 @@ from cartsnitch_api.models.user import User, UserStoreAccount
 
 
 @pytest.fixture
-def engine(engine):
-    yield engine
+def engine():
+    eng = create_engine("sqlite:///:memory:")
+    Base.metadata.create_all(eng)
+    yield eng
+    eng.dispose()
 
 
 @pytest.fixture
-def session(session):
-    yield session
+def session(engine):
+    factory = sessionmaker(bind=engine)
+    with factory() as sess:
+        yield sess
 
 
 @pytest.fixture
@@ -36,7 +40,7 @@ def store(session):
 
 @pytest.fixture
 def user(session):
-    u = User(id=uuid_lib.uuid4(), email="alice@example.com", hashed_password="fakehash")
+    u = User(email="alice@example.com", hashed_password="fakehash")
     session.add(u)
     session.commit()
     session.refresh(u)

tests/test_middleware/test_rate_limit.py

@@ -1,7 +1,7 @@
 """Tests for rate limiting middleware."""
 
 import time
-from unittest.mock import AsyncMock, MagicMock
+from unittest.mock import AsyncMock, MagicMock, patch
 
 import pytest