feat(hubs): tenant-safe list, get, and delete (#5)

* feat(models): add relationships and hub response schemas

* feat(hubs): add tenant-safe list, get, and delete endpoints

* test(isolation): prove cross-tenant read, list, and delete are cloaked

app/main.py

@@ -4,7 +4,7 @@ from fastapi import FastAPI, Request, Depends
 from fastapi.exceptions import RequestValidationError
 from starlette.exceptions import HTTPException as StarletteHTTPException
 from app.errors import AppError, error_response
-from app.routers import auth
+from app.routers import auth,hubs
 from app.deps import get_current_user
 from app.models import User
 
@@ -19,6 +19,7 @@ def create_app() -> FastAPI:
     )
 
     app.include_router(auth.router, prefix="/api/v1")
+    app.include_router(hubs.router, prefix="/api/v1")
 
     @app.middleware("http")
     async def catch_unhandled(request: Request, call_next):

app/models.py

@@ -2,6 +2,7 @@ import uuid
 from datetime import datetime
 from sqlalchemy import Column, String, Boolean, Integer, DateTime, ForeignKey, UniqueConstraint, LargeBinary
 from sqlalchemy.dialects.postgresql import UUID, JSONB
+from sqlalchemy.orm import relationship
 from pgvector.sqlalchemy import Vector
 from app.db import Base
 
@@ -24,6 +25,10 @@ class Hub(Base):
     suggested_questions = Column(JSONB, nullable=False, default=list)
     created_at = Column(DateTime(timezone=True), nullable=False, default=datetime.utcnow)
     updated_at = Column(DateTime(timezone=True), nullable=False, default=datetime.utcnow)
+
+    # These relationships belong in Hub, not User!
+    documents = relationship("Document", back_populates="hub", cascade="all, delete-orphan")
+    chunks = relationship("Chunk", back_populates="hub", cascade="all, delete-orphan")
     
     __table_args__ = (
         UniqueConstraint("owner_id", "name", name="uq_hub_name_per_owner"),
@@ -46,6 +51,8 @@ class Document(Base):
     created_at = Column(DateTime(timezone=True), nullable=False, default=datetime.utcnow)
     updated_at = Column(DateTime(timezone=True), nullable=False, default=datetime.utcnow)
 
+    hub = relationship("Hub", back_populates="documents")
+
     __table_args__ = (
         UniqueConstraint("hub_id", "checksum_sha256", name="uq_doc_checksum_per_hub"),
     )
@@ -62,6 +69,8 @@ class Chunk(Base):
     embedding = Column(Vector(768), nullable=False)
     created_at = Column(DateTime(timezone=True), nullable=False, default=datetime.utcnow)
 
+    hub = relationship("Hub", back_populates="chunks")
+
 class IdempotencyKey(Base):
     __tablename__ = "idempotency_keys"
     user_id = Column(UUID(as_uuid=True), ForeignKey("users.id", ondelete="CASCADE"), primary_key=True)

app/repo.py

@@ -0,0 +1,16 @@
+from uuid import UUID
+from sqlalchemy.orm import Session
+from app.models import Hub
+
+def list_hubs_for_owner(db: Session, owner_id: UUID, limit: int, offset: int):
+    query = db.query(Hub).filter(Hub.owner_id == owner_id).order_by(Hub.created_at.desc())
+    total = query.count()
+    hubs = query.offset(offset).limit(limit).all()
+    return hubs, total
+
+def get_hub_for_owner(db: Session, hub_id: UUID, owner_id: UUID) -> Hub | None:
+    return db.query(Hub).filter(Hub.id == hub_id, Hub.owner_id == owner_id).first()
+
+def delete_hub_for_owner(db: Session, hub_id: UUID, owner_id: UUID) -> int:
+    # Returns the number of rows deleted (0 or 1)
+    return db.query(Hub).filter(Hub.id == hub_id, Hub.owner_id == owner_id).delete()

app/routers/hubs.py

@@ -0,0 +1,59 @@
+from uuid import UUID
+from fastapi import APIRouter, Depends, status, Query, Response
+from sqlalchemy.orm import Session
+from app.db import get_db
+from app.deps import get_current_user
+from app.models import User
+from app.schemas import HubResponse, HubDetail
+from app.errors import AppError
+from app import repo
+
+router = APIRouter(prefix="/hubs", tags=["hubs"])
+
+@router.get("", response_model=dict)
+def list_hubs(
+    limit: int = Query(20, ge=1, le=100),
+    offset: int = Query(0, ge=0),
+    current_user: User = Depends(get_current_user),
+    db: Session = Depends(get_db)
+):
+    hubs, total = repo.list_hubs_for_owner(db, current_user.id, limit, offset)
+    
+    # Convert ORM models to Pydantic models to include counts
+    items = []
+    for hub in hubs:
+        hub_data = HubResponse.model_validate(hub)
+        hub_data.document_count = len(hub.documents)
+        hub_data.chunk_count = len(hub.chunks)
+        items.append(hub_data)
+        
+    return {"items": items, "total": total, "limit": limit, "offset": offset}
+
+@router.get("/{hub_id}", response_model=HubDetail)
+def get_hub(
+    hub_id: UUID,
+    current_user: User = Depends(get_current_user),
+    db: Session = Depends(get_db)
+):
+    hub = repo.get_hub_for_owner(db, hub_id, current_user.id)
+    if not hub:
+        # Cloaked 404
+        raise AppError(404, "HUB_NOT_FOUND", "Hub not found.")
+    
+    hub_data = HubDetail.model_validate(hub)
+    hub_data.document_count = len(hub.documents)
+    hub_data.chunk_count = len(hub.chunks)
+    return hub_data
+
+@router.delete("/{hub_id}", status_code=status.HTTP_204_NO_CONTENT)
+def delete_hub(
+    hub_id: UUID,
+    current_user: User = Depends(get_current_user),
+    db: Session = Depends(get_db)
+):
+    deleted_count = repo.delete_hub_for_owner(db, hub_id, current_user.id)
+    if deleted_count == 0:
+        raise AppError(404, "HUB_NOT_FOUND", "Hub not found.")
+    
+    db.commit()
+    return Response(status_code=status.HTTP_204_NO_CONTENT)

app/schemas.py

@@ -44,4 +44,30 @@ class ChangePasswordRequest(BaseModel):
             raise ValueError("must contain at least one letter and one digit")
         if len(v.encode("utf-8")) > 72:
             raise ValueError("must be at most 72 bytes when encoded as UTF-8")
-        return v
+        return v
+# ... (keep existing schemas) ...
+
+class DocumentSummary(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+    id: UUID
+    origin: str
+    filename: str
+    status: str
+    chunk_count: int = 0
+
+class HubResponse(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+    id: UUID
+    name: str
+    description: str | None
+    ai_summary: str | None
+    suggested_questions: list[str]
+    document_count: int = 0
+    chunk_count: int = 0
+    created_at: datetime
+    updated_at: datetime
+
+class HubDetail(HubResponse):
+    documents: list[DocumentSummary] = []    
+
+    

tests/conftest.py

@@ -25,7 +25,7 @@ os.environ["JWT_SECRET_KEY"] = "test-secret-test-secret-test-secret-123"
 os.environ["GEMINI_API_KEY"] = "test-key"
 
 from app.main import app
-from app.db import engine
+from app.db import engine, SessionLocal
 
 @pytest.fixture(scope="session", autouse=True)
 def setup_database():
@@ -43,4 +43,12 @@ def clean_tables():
 @pytest.fixture
 def client():
     with TestClient(app) as c:
-        yield c
+        yield c
+
+@pytest.fixture
+def db_session():
+    db = SessionLocal()
+    try:
+        yield db
+    finally:
+        db.close()

tests/test_isolation.py

@@ -0,0 +1,45 @@
+import pytest
+from uuid import uuid4
+from app.models import Hub
+
+def create_test_hub(db_session, owner_id, name="Test Hub"):
+    hub = Hub(owner_id=owner_id, name=name)
+    db_session.add(hub)
+    db_session.commit()
+    return hub
+
+def test_user_b_cannot_read_user_a_hub(client, db_session):
+    # 1. Create two users
+    client.post("/api/v1/auth/signup", json={"email": "usera@example.com", "password": "Pass1234"})
+    client.post("/api/v1/auth/signup", json={"email": "userb@example.com", "password": "Pass1234"})
+    
+    token_a = client.post("/api/v1/auth/login", json={"email": "usera@example.com", "password": "Pass1234"}).json()["access_token"]
+    token_b = client.post("/api/v1/auth/login", json={"email": "userb@example.com", "password": "Pass1234"}).json()["access_token"]
+    
+    from app.models import User
+    user_a = db_session.query(User).filter(User.email == "usera@example.com").first()
+    user_b = db_session.query(User).filter(User.email == "userb@example.com").first()
+
+    # 2. Create a hub for User A
+    hub_a = create_test_hub(db_session, user_a.id, "A's Secret Hub")
+
+    # 3. User A can read it
+    r_a = client.get(f"/api/v1/hubs/{hub_a.id}", headers={"Authorization": f"Bearer {token_a}"})
+    assert r_a.status_code == 200
+    
+    # 4. User B CANNOT read it (404 Cloaking)
+    r_b = client.get(f"/api/v1/hubs/{hub_a.id}", headers={"Authorization": f"Bearer {token_b}"})
+    assert r_b.status_code == 404
+    assert r_b.json()["error"]["code"] == "HUB_NOT_FOUND"
+
+    # 5. User B cannot list it
+    r_list_b = client.get("/api/v1/hubs", headers={"Authorization": f"Bearer {token_b}"})
+    assert r_list_b.json()["total"] == 0
+
+    # 6. User B cannot delete it
+    r_del_b = client.delete(f"/api/v1/hubs/{hub_a.id}", headers={"Authorization": f"Bearer {token_b}"})
+    assert r_del_b.status_code == 404
+    
+    # 7. User A can delete it
+    r_del_a = client.delete(f"/api/v1/hubs/{hub_a.id}", headers={"Authorization": f"Bearer {token_a}"})
+    assert r_del_a.status_code == 204