feat: sync latest backend with auth, usage tracking, and admin bypass

app/api/auth.py

@@ -0,0 +1,78 @@
+"""Authentication dependencies for FastAPI routes."""
+
+from dataclasses import dataclass
+from typing import Optional
+
+from fastapi import Depends, HTTPException, status
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+
+from jose import JWTError, jwt
+
+from app.core.config import settings
+
+security = HTTPBearer(auto_error=False)
+
+
+@dataclass
+class AuthenticatedUser:
+    """Authenticated user extracted from JWT token."""
+    google_id: str
+    email: str
+    name: str
+    picture: Optional[str] = None
+
+
+def _decode_token(token: str) -> dict:
+    """Decode and validate a JWT token."""
+    try:
+        payload = jwt.decode(
+            token,
+            settings.nextauth_secret,
+            algorithms=["HS256"],
+        )
+        return payload
+    except JWTError:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid or expired token",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+
+
+async def get_current_user(
+    credentials: HTTPAuthorizationCredentials = Depends(security),
+) -> AuthenticatedUser:
+    """Require a valid JWT and return the authenticated user."""
+    if credentials is None:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Authentication required",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+
+    payload = _decode_token(credentials.credentials)
+    return AuthenticatedUser(
+        google_id=payload.get("sub", ""),
+        email=payload.get("email", ""),
+        name=payload.get("name", ""),
+        picture=payload.get("picture"),
+    )
+
+
+async def get_optional_user(
+    credentials: Optional[HTTPAuthorizationCredentials] = Depends(security),
+) -> Optional[AuthenticatedUser]:
+    """Return authenticated user if token is present, otherwise None."""
+    if credentials is None:
+        return None
+
+    try:
+        payload = _decode_token(credentials.credentials)
+        return AuthenticatedUser(
+            google_id=payload.get("sub", ""),
+            email=payload.get("email", ""),
+            name=payload.get("name", ""),
+            picture=payload.get("picture"),
+        )
+    except HTTPException:
+        return None

app/api/routes/auth.py

@@ -0,0 +1,98 @@
+"""Authentication routes for user profile management."""
+
+import json
+import logging
+from datetime import datetime
+
+from fastapi import APIRouter, Depends
+from pydantic import BaseModel
+
+from app.api.auth import AuthenticatedUser, get_current_user
+from app.core.config import settings
+from app.core.redis import get_redis
+from app.models.user import UserProfile
+
+logger = logging.getLogger(__name__)
+router = APIRouter()
+
+REDIS_USER_PREFIX = "user:"
+
+
+class UpdateProfileRequest(BaseModel):
+    """Request body for profile updates."""
+    name: str | None = None
+    preferred_intensity: str | None = None
+
+
+@router.get("/user/me")
+async def get_me(user: AuthenticatedUser = Depends(get_current_user)):
+    """Get current user profile. Auto-creates on first login."""
+    redis = await get_redis()
+    key = f"{REDIS_USER_PREFIX}{user.google_id}"
+
+    existing = await redis.get(key)
+    if existing:
+        profile = UserProfile.model_validate_json(existing)
+        # Update picture/email in case they changed on Google side
+        profile.picture = user.picture or profile.picture
+        profile.email = user.email or profile.email
+        profile.updated_at = datetime.utcnow()
+        await redis.set(
+            key,
+            profile.model_dump_json(),
+            ex=settings.user_profile_ttl_seconds,
+        )
+        return profile.model_dump()
+
+    # First login — create new profile
+    profile = UserProfile(
+        google_id=user.google_id,
+        email=user.email,
+        name=user.name,
+        picture=user.picture,
+    )
+    await redis.set(
+        key,
+        profile.model_dump_json(),
+        ex=settings.user_profile_ttl_seconds,
+    )
+    logger.info(f"Created new user profile for {user.email}")
+    return profile.model_dump()
+
+
+@router.put("/user/profile")
+async def update_profile(
+    body: UpdateProfileRequest,
+    user: AuthenticatedUser = Depends(get_current_user),
+):
+    """Update user profile fields."""
+    redis = await get_redis()
+    key = f"{REDIS_USER_PREFIX}{user.google_id}"
+
+    existing = await redis.get(key)
+    if existing:
+        profile = UserProfile.model_validate_json(existing)
+    else:
+        # Shouldn't happen but handle gracefully
+        profile = UserProfile(
+            google_id=user.google_id,
+            email=user.email,
+            name=user.name,
+            picture=user.picture,
+        )
+
+    if body.name is not None:
+        profile.name = body.name
+    if body.preferred_intensity is not None:
+        if body.preferred_intensity in ("conservative", "moderate", "aggressive"):
+            profile.preferred_intensity = body.preferred_intensity
+
+    profile.updated_at = datetime.utcnow()
+
+    await redis.set(
+        key,
+        profile.model_dump_json(),
+        ex=settings.user_profile_ttl_seconds,
+    )
+
+    return profile.model_dump()

app/api/routes/usage.py

@@ -0,0 +1,72 @@
+"""Usage tracking for freemium gating."""
+
+from datetime import datetime
+
+from fastapi import APIRouter, Depends
+
+from app.api.auth import AuthenticatedUser, get_current_user
+from app.core.config import settings
+from app.core.redis import get_redis
+
+router = APIRouter()
+
+USAGE_PREFIX = "usage:"
+
+
+def _usage_key(google_id: str) -> str:
+    """Return Redis key for current month's usage."""
+    month = datetime.utcnow().strftime("%Y-%m")
+    return f"{USAGE_PREFIX}{google_id}:{month}"
+
+
+def _resets_at() -> str:
+    """Return ISO date of first day of next month."""
+    now = datetime.utcnow()
+    if now.month == 12:
+        first_next = datetime(now.year + 1, 1, 1)
+    else:
+        first_next = datetime(now.year, now.month + 1, 1)
+    return first_next.strftime("%Y-%m-%d")
+
+
+def _is_admin(user: AuthenticatedUser) -> bool:
+    """Check if the user is an admin (unlimited usage)."""
+    return user.email.lower() in settings.admin_email_set
+
+
+@router.get("/usage")
+async def get_usage(user: AuthenticatedUser = Depends(get_current_user)):
+    """Get current month's usage for authenticated user."""
+    # Admins get unlimited usage
+    if _is_admin(user):
+        return {"used": 0, "limit": 999999, "resets_at": _resets_at(), "is_admin": True}
+
+    redis = await get_redis()
+    key = _usage_key(user.google_id)
+    raw = await redis.get(key)
+    used = int(raw) if raw else 0
+    return {
+        "used": used,
+        "limit": settings.free_tier_limit,
+        "resets_at": _resets_at(),
+    }
+
+
+@router.post("/usage/increment")
+async def increment_usage(user: AuthenticatedUser = Depends(get_current_user)):
+    """Increment usage counter. Called when a customization completes."""
+    # Admins skip counting entirely
+    if _is_admin(user):
+        return {"used": 0, "limit": 999999, "resets_at": _resets_at(), "is_admin": True}
+
+    redis = await get_redis()
+    key = _usage_key(user.google_id)
+    new_count = await redis.incr(key)
+    # Set TTL only on first increment (when count is 1)
+    if new_count == 1:
+        await redis.expire(key, settings.usage_ttl_seconds)
+    return {
+        "used": new_count,
+        "limit": settings.free_tier_limit,
+        "resets_at": _resets_at(),
+    }

app/core/config.py

@@ -1,4 +1,3 @@
-from pydantic import field_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 
@@ -22,10 +21,24 @@ class Settings(BaseSettings):
     # Session
     session_ttl_seconds: int = 7200
 
-    @field_validator("redis_url")
-    @classmethod
-    def strip_redis_url(cls, v: str) -> str:
-        return v.strip()
+    # Auth
+    nextauth_secret: str = ""
+    frontend_url: str = "http://localhost:3000"
+    user_profile_ttl_seconds: int = 30 * 24 * 60 * 60  # 30 days
+
+    # Usage limits
+    free_tier_limit: int = 3
+    usage_ttl_seconds: int = 35 * 24 * 60 * 60  # 35 days
+
+    # Admin emails (comma-separated) — unlimited usage, no gating
+    admin_emails: str = ""
+
+    @property
+    def admin_email_set(self) -> set[str]:
+        """Parse comma-separated admin emails into a set for fast lookup."""
+        if not self.admin_emails:
+            return set()
+        return {e.strip().lower() for e in self.admin_emails.split(",") if e.strip()}
 
 
 settings = Settings()

app/core/redis.py

@@ -1,5 +1,4 @@
 from __future__ import annotations
-import ssl
 from contextlib import asynccontextmanager
 from typing import Optional
 
@@ -10,20 +9,11 @@ from app.core.config import settings
 _fastapi_client: Optional[redis.Redis] = None
 
 
-def _redis_kwargs() -> dict:
-    """Extra kwargs for rediss:// (TLS) connections like Upstash."""
-    if settings.redis_url.startswith("rediss://"):
-        return {"ssl_cert_reqs": None}
-    return {}
-
-
 async def get_redis() -> redis.Redis:
     """Get Redis client for FastAPI (reuses connection)."""
     global _fastapi_client
     if _fastapi_client is None:
-        _fastapi_client = redis.from_url(
-            settings.redis_url, decode_responses=True, **_redis_kwargs()
-        )
+        _fastapi_client = redis.from_url(settings.redis_url, decode_responses=True)
     return _fastapi_client
 
 
@@ -38,9 +28,7 @@ async def close_redis():
 @asynccontextmanager
 async def get_redis_for_worker():
     """Get fresh Redis client for Celery workers (new connection per task)."""
-    client = redis.from_url(
-        settings.redis_url, decode_responses=True, **_redis_kwargs()
-    )
+    client = redis.from_url(settings.redis_url, decode_responses=True)
     try:
         yield client
     finally:

app/llm/factory.py

@@ -5,8 +5,6 @@ from typing import Dict, List, Tuple, Type
 from app.llm.base import LLMProvider
 from app.llm.openai_provider import OpenAIProvider
 from app.llm.google_provider import GoogleProvider
-from app.llm.zai_provider import ZAIProvider
-from app.llm.groq_provider import GroqProvider
 from app.llm.fallback_provider import FallbackLLMProvider
 from app.core.config import settings
 
@@ -17,15 +15,11 @@ class LLMFactory:
     _providers: Dict[str, Type[LLMProvider]] = {
         "openai": OpenAIProvider,
         "google": GoogleProvider,
-        "zai": ZAIProvider,
-        "groq": GroqProvider,
     }
 
     _default_models: Dict[str, Tuple[str, str]] = {
         "openai": ("gpt-4o-mini", "gpt-4o"),
         "google": ("gemini-3-flash-preview", "gemini-3-flash-preview"),
-        "zai": ("glm-4.7", "glm-4.7"),
-        "groq": ("llama-3.1-8b-instant", "llama-3.1-8b-instant"),
     }
 
     @classmethod
@@ -43,8 +37,6 @@ class LLMFactory:
         api_keys = {
             "openai": settings.openai_api_key,
             "google": settings.google_api_key,
-            "zai": settings.zai_api_key,
-            "groq": settings.groq_api_key,
         }
 
         # Get primary provider's model
@@ -89,7 +81,5 @@ class LLMFactory:
         keys = {
             "openai": settings.openai_api_key,
             "google": settings.google_api_key,
-            "zai": settings.zai_api_key,
-            "groq": settings.groq_api_key,
         }
         return keys.get(settings.llm_provider, "")

app/llm/fallback_provider.py

@@ -2,7 +2,6 @@ from __future__ import annotations
 import asyncio
 import logging
 import re
-import time
 from typing import Any, Dict, List, Optional
 
 from app.llm.base import LLMProvider
@@ -19,9 +18,9 @@ class FallbackLLMProvider(LLMProvider):
     """LLM provider with automatic fallback and retry with exponential backoff."""
 
     # Retry configuration
-    MAX_RETRIES_PER_PROVIDER = 3
-    INITIAL_BACKOFF_SECONDS = 5
-    MAX_BACKOFF_SECONDS = 65
+    MAX_RETRIES_PER_PROVIDER = 2
+    INITIAL_BACKOFF_SECONDS = 2
+    MAX_BACKOFF_SECONDS = 30
 
     def __init__(self, providers: List[LLMProvider]):
         if not providers:
@@ -74,12 +73,7 @@ class FallbackLLMProvider(LLMProvider):
 
         for attempt in range(self.MAX_RETRIES_PER_PROVIDER):
             try:
-                # Track time to first token (TTFT)
-                start_time = time.time()
-                result = await call_func(*args, **kwargs)
-                ttft = (time.time() - start_time) * 1000  # Convert to milliseconds
-                logger.info(f"⏱️  {provider.__class__.__name__} TTFT: {ttft:.2f}ms ({ttft/1000:.3f}s)")
-                return result
+                return await call_func(*args, **kwargs)
             except Exception as e:
                 last_error = e
 

app/main.py

@@ -4,7 +4,8 @@ from fastapi import FastAPI, Request
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse
 from app.core.redis import close_redis
-from app.api.routes import upload, analyze, progress, result, export, compare
+from app.api.routes import upload, analyze, progress, result, export, auth, usage
+from app.core.config import settings
 
 logger = logging.getLogger(__name__)
 
@@ -22,19 +23,17 @@ app = FastAPI(
     lifespan=lifespan,
 )
 
-import os
-
-allowed_origins = [
-    "http://localhost:3000",
-]
-# Add production Vercel URL if set
-vercel_url = os.environ.get("FRONTEND_URL")
-if vercel_url:
-    allowed_origins.append(vercel_url)
+# Build CORS origins list: always include localhost for dev, plus production URL
+cors_origins = ["http://localhost:3000"]
+if settings.frontend_url and settings.frontend_url != "http://localhost:3000":
+    cors_origins.append(settings.frontend_url)
+# Also accept any Vercel preview deployments
+if settings.frontend_url and "vercel.app" in settings.frontend_url:
+    cors_origins.append("https://mycv-buddy.vercel.app")
 
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=allowed_origins,
+    allow_origins=cors_origins,
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],
@@ -86,7 +85,8 @@ app.include_router(analyze.router, prefix="/api", tags=["analyze"])
 app.include_router(progress.router, prefix="/api", tags=["progress"])
 app.include_router(result.router, prefix="/api", tags=["result"])
 app.include_router(export.router, prefix="/api", tags=["export"])
-app.include_router(compare.router, prefix="/api", tags=["compare"])
+app.include_router(auth.router, prefix="/api", tags=["auth"])
+app.include_router(usage.router, prefix="/api", tags=["usage"])
 
 
 @app.get("/health")

app/models/user.py

@@ -0,0 +1,29 @@
+"""User profile model stored in Redis."""
+
+from typing import List, Optional
+from pydantic import BaseModel, Field
+from datetime import datetime
+
+
+class UserProfile(BaseModel):
+    """User profile stored as JSON in Redis with key user:{google_id}."""
+
+    google_id: str
+    email: str
+    name: str
+    picture: Optional[str] = None
+
+    # Preferences
+    preferred_intensity: str = "moderate"  # conservative | moderate | aggressive
+
+    # Session linking
+    linked_sessions: List[str] = Field(default_factory=list)
+
+    # Timestamps
+    created_at: datetime = Field(default_factory=datetime.utcnow)
+    updated_at: datetime = Field(default_factory=datetime.utcnow)
+
+    class Config:
+        json_encoders = {
+            datetime: lambda v: v.isoformat(),
+        }

app/workers/celery_app.py

@@ -1,16 +1,10 @@
 from celery import Celery
 from app.core.config import settings
 
-# Celery requires explicit ssl_cert_reqs param for rediss:// URLs
-_redis_url = settings.redis_url
-if _redis_url.startswith("rediss://") and "ssl_cert_reqs" not in _redis_url:
-    sep = "&" if "?" in _redis_url else "?"
-    _redis_url = f"{_redis_url}{sep}ssl_cert_reqs=CERT_NONE"
-
 celery_app = Celery(
     "cv_buddy",
-    broker=_redis_url,
-    backend=_redis_url,
+    broker=settings.redis_url,
+    backend=settings.redis_url,
     include=["app.workers.tasks"],
 )
 

requirements.txt

@@ -23,6 +23,9 @@ beautifulsoup4>=4.12.0
 openai>=1.10.0
 google-generativeai>=0.4.0
 
+# Auth
+python-jose[cryptography]>=3.3.0
+
 # Utilities
 pydantic>=2.5.0
 pydantic-settings>=2.1.0