6 Commits

Author	SHA1	Message	Date
Lars	cf522190c6	fix: correct indentation in auth.py _check_impl function ... Behebt IndentationError in Zeile 204 der _check_impl() Funktion. Die Funktion wurde beim Connection-Pool-Fix erstellt, hatte aber inkonsistente Einrückungen (8 statt 4 Spaces nach der ersten Zeile). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-21 07:06:53 +01:00
Lars	329daaef1c	fix: prevent connection pool exhaustion in features/usage ... - Add optional conn parameter to get_effective_tier() - Add optional conn parameter to check_feature_access() - Pass existing connection in features.py loop - Prevents opening 20+ connections simultaneously - Fixes "connection pool exhausted" error Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-21 07:02:42 +01:00
Lars	4fcde4abfb	ROLLBACK: complete removal of broken feature enforcement system ... Reverts all feature enforcement changes (commits 3745ebd, cbad50a, cd4d912, 8415509) to restore original working functionality. Issues caused by feature enforcement implementation: - Export buttons disappeared and never reappeared - KI analysis counter not incrementing - New analyses not saving - Pipeline appearing twice - Many core features broken Restored files to working state before enforcement implementation (commit 0210844): - Backend: auth.py, insights.py, exportdata.py, importdata.py, nutrition.py, activity.py - Frontend: Analysis.jsx, SettingsPage.jsx, api.js - Removed: FeatureGate.jsx, useFeatureAccess.js The original simple AI limit system (ai_enabled, ai_limit_day) is now active again. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-20 15:19:56 +01:00
Lars	8415509f4c	fix: monthly reset now updates reset_at correctly ... Critical bug: usage limits were never resetting after first month because reset_at timestamp was not updated during ON CONFLICT UPDATE. This caused users to stay permanently blocked after reaching monthly limit once. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-20 13:14:35 +01:00
Lars	c002cb1e54	feat: add feature-access middleware for v9c subscription system ... Implements flexible feature access control with 3-tier hierarchy: 1. User-specific restrictions (highest priority) 2. Tier limits 3. Feature defaults New functions: - get_effective_tier(profile_id) - Checks access_grants, falls back to profile.tier - check_feature_access(profile_id, feature_id) - Complete access check Returns: {allowed, limit, used, remaining, reason} - increment_feature_usage(profile_id, feature_id) - Usage tracking - _calculate_next_reset(reset_period) - Helper for daily/monthly resets Supports: - Boolean features (enabled/disabled) - Count-based features with limits - Automatic reset (daily/monthly/never) - Unlimited (NULL) and disabled (0) states Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-19 13:04:49 +01:00
Lars	d826524789	refactor: extract auth functions to auth.py ... Phase 1.2 - Authentication-Logik isolieren NEUE DATEI: - backend/auth.py: Auth-Funktionen mit Dokumentation * hash_pin() - bcrypt + SHA256 legacy support * verify_pin() - Password verification * make_token() - Session token generation * get_session() - Token validation * require_auth() - FastAPI dependency * require_auth_flexible() - Auth via header OR query * require_admin() - Admin-only dependency ÄNDERUNGEN: - backend/main.py: * Import from auth.py * Removed 48 lines of auth code * hashlib, secrets nicht mehr benötigt KEINE funktionalen Änderungen. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-19 09:51:25 +01:00