Add local bearer authentication foundation

SovereignAI-Starter/app/database.py

@@ -57,10 +57,20 @@ def initialize_database() -> None:
                 provider TEXT NOT NULL,
                 provider_subject TEXT NOT NULL,
                 email TEXT,
+                password_hash TEXT,
                 created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
                 UNIQUE(provider, provider_subject)
             );
 
+            CREATE TABLE IF NOT EXISTS auth_sessions (
+                token_hash TEXT PRIMARY KEY,
+                user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+                expires_at INTEGER NOT NULL,
+                created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+            );
+            CREATE INDEX IF NOT EXISTS idx_auth_sessions_user
+                ON auth_sessions(user_id, expires_at);
+
             CREATE TABLE IF NOT EXISTS conversations (
                 id TEXT PRIMARY KEY,
                 user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
@@ -123,6 +133,11 @@ def initialize_database() -> None:
             connection.execute(
                 "ALTER TABLE messages ADD COLUMN selected_version INTEGER NOT NULL DEFAULT 0"
             )
+        identity_columns = {
+            row["name"] for row in connection.execute("PRAGMA table_info(user_identities)")
+        }
+        if "password_hash" not in identity_columns:
+            connection.execute("ALTER TABLE user_identities ADD COLUMN password_hash TEXT")
 
 
 def ensure_user(user_id: str) -> None: