Production-grade: guest mode, daily limits, modal auth, inline confirms

- App opens immediately for all visitors — no login gate
- Guests tracked by session UUID (localStorage), 5 prompts/day
- Registered users get 10 prompts/day
- Usage counter shown inline in the form, warning on last prompt
- Form disabled at limit with contextual banner and sign-up CTA
- Auth converted to modal overlay (Escape/backdrop to close)
- Replaced all confirm()/prompt() dialogs with inline UI
- LoginPage/RegisterPage support noWrapper prop for modal use
- Dark mode now uses Tailwind dark: variants consistently throughout
- PDF export available to all users, premium gate removed
- backend: guest+auth daily_usage tracking in SQLite, /usage endpoint
- backend: optional JWT auth (get_optional_user), X-Session-ID header support
- backend: GROQ_SSL_VERIFY env var for local dev SSL workaround
- vite: proxy /usage to backend
- INFRA_SUGGESTIONS.md: 10 senior-engineer recommendations

app.py

@@ -3,7 +3,7 @@ from contextlib import asynccontextmanager
 from pathlib import Path
 
 from dotenv import load_dotenv
-from fastapi import Depends, FastAPI, HTTPException, Request, APIRouter
+from fastapi import Depends, FastAPI, Header, HTTPException, Request, APIRouter
 from fastapi.middleware.cors import CORSMiddleware
 from pydantic import BaseModel, Field
 from slowapi import Limiter, _rate_limit_exceeded_handler
@@ -14,8 +14,14 @@ import logging
 
 from ai_prompts import TEMPLATES
 from utils import call_llm
-from database import init_db
-from auth import get_current_user
+from database import (
+    init_db,
+    GUEST_DAILY_LIMIT,
+    USER_DAILY_LIMIT,
+    get_usage_today,
+    increment_usage_today,
+)
+from auth import get_optional_user
 from routers.auth import router as auth_router
 
 _BACKEND_DIR = Path(__file__).resolve().parent
@@ -64,7 +70,11 @@ app.state.limiter = limiter
 app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
 
 _cors_origins = os.getenv("CORS_ORIGINS", "*").strip()
-allow_origins = [o.strip() for o in _cors_origins.split(",") if o.strip()] if _cors_origins != "*" else ["*"]
+allow_origins = (
+    [o.strip() for o in _cors_origins.split(",") if o.strip()]
+    if _cors_origins != "*"
+    else ["*"]
+)
 app.add_middleware(
     CORSMiddleware,
     allow_origins=allow_origins,
@@ -73,12 +83,11 @@ app.add_middleware(
     allow_headers=["*"],
 )
 
-FREE_MAX_INPUT_LEN = 4000
-PREMIUM_MAX_INPUT_LEN = 12000
+MAX_INPUT_LEN = 4000
 
 
 class GenerateRequest(BaseModel):
-    problem_description: Annotated[str, Field(min_length=1, max_length=PREMIUM_MAX_INPUT_LEN)]
+    problem_description: Annotated[str, Field(min_length=1, max_length=MAX_INPUT_LEN)]
     style: Annotated[str, Field(pattern="^(Academic|Developer-Friendly|English-Like|Step-by-Step)$")]
     detail: Annotated[str, Field(pattern="^(Concise|Detailed)$")]
 
@@ -93,10 +102,40 @@ async def root():
     return {"service": "Pseudogen API", "version": "1"}
 
 
+@app.get("/usage")
+async def usage(
+    user: dict | None = Depends(get_optional_user),
+    x_session_id: str | None = Header(default=None),
+):
+    if user:
+        identifier = f"user:{user['id']}"
+        limit = USER_DAILY_LIMIT
+        is_guest = False
+    elif x_session_id:
+        identifier = f"session:{x_session_id}"
+        limit = GUEST_DAILY_LIMIT
+        is_guest = True
+    else:
+        return {"used": 0, "limit": GUEST_DAILY_LIMIT, "remaining": GUEST_DAILY_LIMIT, "is_guest": True}
+
+    used = get_usage_today(identifier)
+    return {
+        "used": used,
+        "limit": limit,
+        "remaining": max(0, limit - used),
+        "is_guest": is_guest,
+    }
+
+
 @v1_router.post("/generate-pseudocode")
 @limiter.limit("30/minute")
-async def generate_v1(request: Request, req: GenerateRequest, user: dict = Depends(get_current_user)):
-    return await _generate(request, req, user)
+async def generate_v1(
+    request: Request,
+    req: GenerateRequest,
+    user: dict | None = Depends(get_optional_user),
+    x_session_id: str | None = Header(default=None),
+):
+    return await _generate(req, user, x_session_id)
 
 
 app.include_router(v1_router)
@@ -104,18 +143,43 @@ app.include_router(v1_router)
 
 @app.post("/generate-pseudocode")
 @limiter.limit("30/minute")
-async def generate(request: Request, req: GenerateRequest, user: dict = Depends(get_current_user)):
-    return await _generate(request, req, user)
-
-
-async def _generate(request: Request, req: GenerateRequest, user: dict):
-    plan = (user.get("plan") or "free").strip().lower()
-    if plan != "premium" and len(req.problem_description) > FREE_MAX_INPUT_LEN:
+async def generate(
+    request: Request,
+    req: GenerateRequest,
+    user: dict | None = Depends(get_optional_user),
+    x_session_id: str | None = Header(default=None),
+):
+    return await _generate(req, user, x_session_id)
+
+
+async def _generate(req: GenerateRequest, user: dict | None, x_session_id: str | None):
+    if user:
+        identifier = f"user:{user['id']}"
+        limit = USER_DAILY_LIMIT
+        is_guest = False
+    elif x_session_id:
+        identifier = f"session:{x_session_id}"
+        limit = GUEST_DAILY_LIMIT
+        is_guest = True
+    else:
         raise HTTPException(
             status_code=400,
-            detail=f"Input exceeds the Free plan limit of {FREE_MAX_INPUT_LEN} characters. Upgrade to Premium for up to {PREMIUM_MAX_INPUT_LEN}.",
+            detail="A session ID or account is required.",
         )
 
+    used = get_usage_today(identifier)
+    if used >= limit:
+        if is_guest:
+            raise HTTPException(
+                status_code=429,
+                detail=f"You've used all {limit} free prompts for today. Create a free account to get {USER_DAILY_LIMIT} per day.",
+            )
+        else:
+            raise HTTPException(
+                status_code=429,
+                detail=f"Daily limit of {limit} prompts reached. Resets at midnight UTC.",
+            )
+
     template = TEMPLATES.get(req.style)
     if template is None:
         raise HTTPException(status_code=400, detail="Unknown style")
@@ -128,4 +192,13 @@ async def _generate(request: Request, req: GenerateRequest, user: dict):
         logger.exception("LLM call failed")
         raise HTTPException(status_code=502, detail="Failed to generate pseudocode. Please try again.")
 
-    return {"markdown": response_text}
+    new_count = increment_usage_today(identifier)
+    remaining = max(0, limit - new_count)
+
+    return {
+        "markdown": response_text,
+        "used": new_count,
+        "limit": limit,
+        "remaining": remaining,
+        "is_guest": is_guest,
+    }

auth.py

@@ -49,7 +49,6 @@ def decode_token(token: str) -> dict | None:
 async def get_current_user(
     credentials: HTTPAuthorizationCredentials | None = Depends(security),
 ) -> dict:
-    """Dependency: require valid Bearer token and return user dict (id, email, plan)."""
     if credentials is None:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
@@ -70,3 +69,17 @@ async def get_current_user(
     if user is None:
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="User not found")
     return user
+
+
+async def get_optional_user(
+    credentials: HTTPAuthorizationCredentials | None = Depends(security),
+) -> dict | None:
+    if credentials is None:
+        return None
+    payload = decode_token(credentials.credentials)
+    if payload is None:
+        return None
+    user_id = payload.get("sub")
+    if not user_id:
+        return None
+    return get_user_by_id(int(user_id))

database.py

@@ -1,13 +1,13 @@
-# backend/database.py
-"""
-SQLite database and user CRUD for Pseudogen auth.
-"""
 import sqlite3
+from datetime import datetime, timezone
 from pathlib import Path
 
 _BACKEND_DIR = Path(__file__).resolve().parent
 DB_PATH = _BACKEND_DIR / "pseudogen.db"
 
+GUEST_DAILY_LIMIT = 5
+USER_DAILY_LIMIT = 10
+
 
 def get_connection():
     conn = sqlite3.connect(DB_PATH)
@@ -16,7 +16,6 @@ def get_connection():
 
 
 def init_db():
-    """Create users table if it does not exist."""
     conn = get_connection()
     try:
         conn.execute("""
@@ -28,6 +27,15 @@ def init_db():
                 created_at TEXT NOT NULL DEFAULT (datetime('now'))
             )
         """)
+        conn.execute("""
+            CREATE TABLE IF NOT EXISTS daily_usage (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                identifier TEXT NOT NULL,
+                date TEXT NOT NULL,
+                count INTEGER NOT NULL DEFAULT 0,
+                UNIQUE(identifier, date)
+            )
+        """)
         conn.commit()
     finally:
         conn.close()
@@ -40,9 +48,7 @@ def get_user_by_email(email: str) -> dict | None:
             "SELECT id, email, hashed_password, plan, created_at FROM users WHERE email = ?",
             (email.strip().lower(),),
         ).fetchone()
-        if row is None:
-            return None
-        return dict(row)
+        return dict(row) if row else None
     finally:
         conn.close()
 
@@ -54,9 +60,7 @@ def get_user_by_id(user_id: int) -> dict | None:
             "SELECT id, email, plan, created_at FROM users WHERE id = ?",
             (user_id,),
         ).fetchone()
-        if row is None:
-            return None
-        return dict(row)
+        return dict(row) if row else None
     finally:
         conn.close()
 
@@ -69,7 +73,44 @@ def create_user(email: str, hashed_password: str, plan: str = "free") -> dict:
             (email.strip().lower(), hashed_password, plan),
         )
         conn.commit()
-        user_id = cursor.lastrowid
-        return {"id": user_id, "email": email.strip().lower(), "plan": plan}
+        return {"id": cursor.lastrowid, "email": email.strip().lower(), "plan": plan}
+    finally:
+        conn.close()
+
+
+def _today_utc() -> str:
+    return datetime.now(timezone.utc).strftime("%Y-%m-%d")
+
+
+def get_usage_today(identifier: str) -> int:
+    conn = get_connection()
+    try:
+        row = conn.execute(
+            "SELECT count FROM daily_usage WHERE identifier = ? AND date = ?",
+            (identifier, _today_utc()),
+        ).fetchone()
+        return row["count"] if row else 0
+    finally:
+        conn.close()
+
+
+def increment_usage_today(identifier: str) -> int:
+    today = _today_utc()
+    conn = get_connection()
+    try:
+        conn.execute(
+            """
+            INSERT INTO daily_usage (identifier, date, count)
+            VALUES (?, ?, 1)
+            ON CONFLICT(identifier, date) DO UPDATE SET count = count + 1
+            """,
+            (identifier, today),
+        )
+        conn.commit()
+        row = conn.execute(
+            "SELECT count FROM daily_usage WHERE identifier = ? AND date = ?",
+            (identifier, today),
+        ).fetchone()
+        return row["count"]
     finally:
         conn.close()

utils.py

@@ -65,6 +65,7 @@ def call_groq_with_retries(prompt: str, model: str = None, max_retries: int = 3,
     if not api_key:
         raise RuntimeError("Missing GROQ_API_KEY")
     model = model or os.getenv("GROQ_MODEL", "llama3-8b-8192")
+    ssl_verify = os.getenv("GROQ_SSL_VERIFY", "true").lower() != "false"
     headers = {
         "Authorization": f"Bearer {api_key}",
         "Content-Type": "application/json",
@@ -83,6 +84,7 @@ def call_groq_with_retries(prompt: str, model: str = None, max_retries: int = 3,
                 headers=headers,
                 json=payload,
                 timeout=30,
+                verify=ssl_verify,
             )
             if resp.status_code == 200:
                 data = resp.json()