Update configurations and prepare for HF deployment

Dockerfile

@@ -1,79 +0,0 @@
-# ============================================================
-# AuthorBot RAG API — Dockerfile (HuggingFace Spaces optimized)
-# ============================================================
-# Multi-stage build:
-#   Stage 1: Build dependencies (cached layer)
-#   Stage 2: Lean production image (~900MB)
-#
-# HuggingFace Spaces constraints:
-#   - Must run on port 7860 or configure app_port in README.md
-#   - No GPU by default (CPU-only BART + CrossEncoder)
-#   - Persistent storage at /data (HF Datasets mount)
-#   - Environment vars set via HF Space secrets
-# ============================================================
-
-FROM python:3.11-slim AS builder
-
-# System dependencies for compiled packages
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    build-essential \
-    libpq-dev \
-    curl \
-    git \
-    && rm -rf /var/lib/apt/lists/*
-
-WORKDIR /app
-
-# Copy and install Python dependencies (cached if requirements.txt unchanged)
-COPY backend/requirements.txt .
-RUN pip install --no-cache-dir --upgrade pip && \
-    pip install --no-cache-dir -r requirements.txt
-
-# ── Production Stage ──────────────────────────────────────────
-FROM python:3.11-slim
-
-# Install runtime system deps + Redis server (runs inside container)
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    libpq5 \
-    curl \
-    redis-server \
-    libmagic1 \
-    && rm -rf /var/lib/apt/lists/*
-
-WORKDIR /app
-
-# Copy installed packages from builder
-COPY --from=builder /usr/local/lib/python3.11/site-packages /usr/local/lib/python3.11/site-packages
-COPY --from=builder /usr/local/bin /usr/local/bin
-
-# Copy backend application code
-COPY backend/ .
-
-# Create necessary directories (including /data for SQLite persistent storage)
-RUN mkdir -p /app/uploads /app/data/chroma /app/data/geo /app/logs /data
-
-# HuggingFace Spaces: run as non-root user (uid 1000)
-RUN adduser --disabled-password --gecos "" --uid 1000 appuser && \
-    chown -R appuser:appuser /app /data
-
-# Configure Redis to not require root and use /data for persistence
-RUN mkdir -p /data/redis && chown -R appuser:appuser /data/redis
-RUN echo "dir /data/redis\nbind 127.0.0.1\nport 6379\ndaemonize yes\nlogfile /dev/null" > /app/redis.conf
-
-USER appuser
-
-# Pre-download models at build time (avoids cold-start delays)
-# These are small enough to include in the image
-RUN python -c "from sentence_transformers import CrossEncoder; CrossEncoder('cross-encoder/ms-marco-MiniLM-L-6-v2')" || true
-RUN python -c "from sentence_transformers import SentenceTransformer; SentenceTransformer('sentence-transformers/all-MiniLM-L6-v2')" || true
-
-# Health check
-HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
-    CMD curl -f http://localhost:8080/health || exit 1
-
-# HuggingFace Spaces port
-EXPOSE 8080
-
-# Startup: create redis data dir → start Redis → run Alembic migrations → start Uvicorn
-CMD ["sh", "-c", "mkdir -p /data/redis && redis-server /app/redis.conf && sleep 1 && alembic upgrade head && uvicorn app.main:app --host 0.0.0.0 --port 8080 --workers 2 --loop uvloop --http httptools"]
-

README.md

@@ -1,13 +1,3 @@
----
-title: AuthorBot RAG API
-emoji: ✨
-colorFrom: indigo
-colorTo: purple
-sdk: docker
-pinned: false
-app_port: 8080
----
-
 # AuthorBot RAG Chatbot SaaS
 ### Production-grade AI book advisor for author websites
 

backend/alembic.ini

@@ -1,41 +1,5 @@
-[alembic]
 version_locations = %(here)s/versions
 script_location = alembic
 # URL is overridden at runtime by alembic/env.py using get_settings().DATABASE_URL
 # Do NOT hardcode credentials here — this file is committed to git
-sqlalchemy.url = sqlite+aiosqlite:////data/db.sqlite
-
-# Logging configuration
-[loggers]
-keys = root,sqlalchemy,alembic
-
-[handlers]
-keys = console
-
-[formatters]
-keys = generic
-
-[logger_root]
-level = WARN
-handlers = console
-qualname =
-
-[logger_sqlalchemy]
-level = WARN
-handlers =
-qualname = sqlalchemy.engine
-
-[logger_alembic]
-level = INFO
-handlers =
-qualname = alembic
-
-[handler_console]
-class = StreamHandler
-args = (sys.stderr,)
-level = NOTSET
-formatter = generic
-
-[formatter_generic]
-format = %(levelname)-5.5s [%(name)s] %(message)s
-datefmt = %H:%M:%S
+sqlalchemy.url = postgresql+asyncpg://placeholder:placeholder@localhost/placeholder

backend/alembic/env.py

@@ -1,13 +1,8 @@
 """Author RAG Chatbot SaaS — Alembic Migration Environment."""
 
 import asyncio
-import os
-import sys
 from logging.config import fileConfig
 
-# Ensure the root directory is in sys.path so 'app' can be imported
-sys.path.insert(0, os.path.dirname(os.path.dirname(__file__)))
-
 from alembic import context
 from sqlalchemy import pool
 from sqlalchemy.ext.asyncio import async_engine_from_config

backend/alembic/versions/001_initial_schema.py

@@ -30,7 +30,7 @@ def upgrade() -> None:
         sa.Column("id", sa.String(36), primary_key=True),
         sa.Column("email", sa.String(255), nullable=False, unique=True),
         sa.Column("password_hash", sa.String(255), nullable=False),
-        sa.Column("role", sa.String(20), nullable=False, server_default="author"),
+        sa.Column("role", sa.Enum("author", "superadmin", name="user_role"), nullable=False, server_default="author"),
         sa.Column("is_active", sa.Boolean, nullable=False, server_default="true"),
         sa.Column("failed_login_attempts", sa.Integer, nullable=False, server_default="0"),
         sa.Column("locked_until", sa.String(50), nullable=True),
@@ -47,7 +47,7 @@ def upgrade() -> None:
                   server_default="Hi! I'm here to help you find your next great read."),
         sa.Column("fallback_message", sa.String(500), nullable=False,
                   server_default="I want to give you the most accurate answer. Could you rephrase that?"),
-        sa.Column("response_style", sa.String(20),
+        sa.Column("response_style", sa.Enum("concise", "balanced", "detailed", name="response_style"),
                   nullable=False, server_default="balanced"),
         sa.Column("chatbot_is_active", sa.Boolean, nullable=False, server_default="true"),
         sa.Column("widget_theme", sa.String(50), nullable=False, server_default="indigo"),
@@ -138,7 +138,7 @@ def upgrade() -> None:
         sa.Column("id", sa.String(36), primary_key=True),
         sa.Column("author_id", sa.String(36), sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=False),
         sa.Column("granted_by", sa.String(36), sa.ForeignKey("users.id"), nullable=False),
-        sa.Column("plan", sa.String(20), nullable=False),
+        sa.Column("plan", sa.Enum("monthly", "quarterly", "semi_annual", "annual", name="subscription_plan"), nullable=False),
         sa.Column("granted_at", sa.DateTime(timezone=True), nullable=False),
         sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
         sa.Column("token_hash", sa.String(255), nullable=False, unique=True),
@@ -273,4 +273,7 @@ def downgrade() -> None:
     op.drop_table("documents")
     op.drop_table("books")
     op.drop_table("users")
-
+    # Drop enums manually (Postgres keeps them after table drops)
+    op.execute("DROP TYPE IF EXISTS user_role")
+    op.execute("DROP TYPE IF EXISTS response_style")
+    op.execute("DROP TYPE IF EXISTS subscription_plan")

backend/app/config.py

@@ -8,7 +8,7 @@ Import `get_settings()` wherever configuration is needed.
 from functools import lru_cache
 from typing import Literal
 
-from pydantic import EmailStr, Field, field_validator
+from pydantic import EmailStr, Field, PostgresDsn, RedisDsn, field_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 
@@ -26,19 +26,21 @@ class Settings(BaseSettings):
     APP_NAME: str = "AuthorBot"
     APP_ENV: Literal["development", "staging", "production"] = "development"
     DEBUG: bool = False
-    SECRET_KEY: str = Field(default="change-me-set-a-real-secret-key-in-hf-secrets-32chars")  # HMAC signing key and JWT secret
-    JWT_ALGORITHM: str = "HS256"
+    SECRET_KEY: str = Field(..., min_length=32)          # HMAC signing key
+    JWT_PRIVATE_KEY: str = Field(...)                    # RS256 private key (PEM)
+    JWT_PUBLIC_KEY: str = Field(...)                     # RS256 public key (PEM)
+    JWT_ALGORITHM: str = "RS256"
     ACCESS_TOKEN_EXPIRE_MINUTES: int = 15
     REFRESH_TOKEN_EXPIRE_DAYS: int = 7
     MAX_CONCURRENT_SESSIONS: int = 3
 
     # ─── Database ─────────────────────────────────────────
-    DATABASE_URL: str = Field(default="sqlite+aiosqlite:////data/db.sqlite")
+    DATABASE_URL: PostgresDsn = Field(...)
     DB_POOL_SIZE: int = 10
     DB_MAX_OVERFLOW: int = 20
 
     # ─── Redis ────────────────────────────────────────────
-    REDIS_URL: str = Field(default="redis://localhost:6379/0")
+    REDIS_URL: RedisDsn = Field(...)
     REDIS_DECODE_RESPONSES: bool = True
 
     # ─── ChromaDB ─────────────────────────────────────────
@@ -47,7 +49,7 @@ class Settings(BaseSettings):
     CHROMA_PERSIST_DIR: str = "./chroma_data"
 
     # ─── OpenAI ───────────────────────────────────────────
-    OPENAI_API_KEY: str = Field(default="")
+    OPENAI_API_KEY: str = Field(...)
     OPENAI_CHAT_MODEL: str = "gpt-4o"                   # Never change without approval
     OPENAI_EMBEDDING_MODEL: str = "text-embedding-3-small"
     OPENAI_MAX_RETRIES: int = 3
@@ -81,10 +83,10 @@ class Settings(BaseSettings):
     SMTP_HOST: str = "smtp.gmail.com"
     SMTP_PORT: int = 465
     SMTP_USE_SSL: bool = True
-    SMTP_USERNAME: EmailStr | None = None
-    SMTP_PASSWORD: str | None = None
+    SMTP_USERNAME: EmailStr = Field(...)
+    SMTP_PASSWORD: str = Field(...)                     # Gmail App Password (not account pw)
     EMAIL_FROM_NAME: str = "AuthorBot"
-    EMAIL_FROM_ADDRESS: EmailStr | None = None
+    EMAIL_FROM_ADDRESS: EmailStr = Field(...)
 
     # ─── Rate Limiting ────────────────────────────────────
     RATE_LIMIT_CHAT_PER_MINUTE: int = 60

backend/app/core/access/token_crypto.py

@@ -44,7 +44,7 @@ def create_access_token(subject: str, extra_claims: dict[str, Any] | None = None
         "type": "access",
         **(extra_claims or {}),
     }
-    return jwt.encode(payload, cfg.SECRET_KEY, algorithm=cfg.JWT_ALGORITHM)
+    return jwt.encode(payload, cfg.JWT_PRIVATE_KEY, algorithm=cfg.JWT_ALGORITHM)
 
 
 def create_refresh_token(subject: str) -> str:
@@ -64,7 +64,7 @@ def create_refresh_token(subject: str) -> str:
         "exp": expire,
         "type": "refresh",
     }
-    return jwt.encode(payload, cfg.SECRET_KEY, algorithm=cfg.JWT_ALGORITHM)
+    return jwt.encode(payload, cfg.JWT_PRIVATE_KEY, algorithm=cfg.JWT_ALGORITHM)
 
 
 def decode_jwt(token: str) -> dict[str, Any]:
@@ -81,7 +81,7 @@ def decode_jwt(token: str) -> dict[str, Any]:
         InvalidTokenError: If the token is malformed or signature is invalid.
     """
     try:
-        payload = jwt.decode(token, cfg.SECRET_KEY, algorithms=[cfg.JWT_ALGORITHM])
+        payload = jwt.decode(token, cfg.JWT_PUBLIC_KEY, algorithms=[cfg.JWT_ALGORITHM])
         return payload
     except JWTError as e:
         error_msg = str(e).lower()

backend/app/dependencies.py

@@ -20,20 +20,13 @@ logger = structlog.get_logger(__name__)
 
 def _create_engine(cfg: Settings):
     """Create SQLAlchemy async engine from settings."""
-    db_url = str(cfg.DATABASE_URL)
-    is_sqlite = db_url.startswith("sqlite")
-
-    engine_kwargs = {
-        "echo": cfg.DEBUG,
-        "pool_pre_ping": True,
-    }
-
-    if not is_sqlite:
-        # Connection pool settings only apply to server-based databases
-        engine_kwargs["pool_size"] = cfg.DB_POOL_SIZE
-        engine_kwargs["max_overflow"] = cfg.DB_MAX_OVERFLOW
-
-    return create_async_engine(db_url, **engine_kwargs)
+    return create_async_engine(
+        str(cfg.DATABASE_URL),
+        pool_size=cfg.DB_POOL_SIZE,
+        max_overflow=cfg.DB_MAX_OVERFLOW,
+        echo=cfg.DEBUG,
+        pool_pre_ping=True,
+    )
 
 
 def _create_session_factory(cfg: Settings) -> async_sessionmaker:

backend/app/models/client_access.py

@@ -7,7 +7,7 @@ Revocation is instant via Redis blacklist + this record.
 
 from datetime import datetime
 
-from sqlalchemy import Boolean, DateTime, Integer, String, Text
+from sqlalchemy import Boolean, DateTime, Enum, Integer, String, Text
 from sqlalchemy import ForeignKey
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 
@@ -27,7 +27,7 @@ class ClientAccess(Base, TimestampMixin):
         String(36), ForeignKey("users.id"), nullable=False
     )
     plan: Mapped[str] = mapped_column(
-        String(20),
+        Enum("monthly", "quarterly", "semi_annual", "annual", name="subscription_plan"),
         nullable=False,
     )
     granted_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)

backend/app/models/user.py

@@ -4,7 +4,7 @@ Represents both Author (client) and SuperAdmin accounts.
 Role is enforced at the middleware and service layers.
 """
 
-from sqlalchemy import Boolean, Integer, String
+from sqlalchemy import Boolean, Enum, Integer, String
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 
 from app.models.base import Base, TimestampMixin, generate_uuid
@@ -19,7 +19,7 @@ class User(Base, TimestampMixin):
     email: Mapped[str] = mapped_column(String(255), unique=True, nullable=False, index=True)
     password_hash: Mapped[str] = mapped_column(String(255), nullable=False)
     role: Mapped[str] = mapped_column(
-        String(20),
+        Enum("author", "superadmin", name="user_role"),
         nullable=False,
         default="author",
     )
@@ -48,7 +48,7 @@ class User(Base, TimestampMixin):
         nullable=False,
     )
     response_style: Mapped[str] = mapped_column(
-        String(20),
+        Enum("concise", "balanced", "detailed", name="response_style"),
         default="balanced",
         nullable=False,
     )

backend/requirements.txt

@@ -13,7 +13,6 @@ pydantic-settings==2.2.1
 # ── Database ──────────────────────────────────────────────
 sqlalchemy[asyncio]==2.0.30
 asyncpg==0.29.0
-aiosqlite==0.20.0
 alembic==1.13.1
 greenlet==3.0.3