siftlode/backend/requirements.txt

fastapi>=0.115,<1.0
uvicorn[standard]>=0.30,<1.0
sqlalchemy>=2.0,<2.1
psycopg[binary]>=3.2,<4.0
alembic>=1.13,<2.0
pydantic>=2.7,<3.0
pydantic-settings>=2.3,<3.0
authlib>=1.3,<2.0
httpx>=0.27,<1.0
feedparser>=6.0,<7.0
apscheduler>=3.10,<4.0
py3langid>=0.3,<1.0
itsdangerous>=2.1,<3.0
cryptography>=46.0.7,<47
argon2-cffi>=23.1,<26
feat: M1 foundation — compose stack, FastAPI, Google OAuth, encrypted tokens - docker-compose with Postgres 16 + slim Python API image - FastAPI app with session middleware, health endpoint, static login page - Google OAuth (Authlib) with email invite-list whitelist; admin role support - User + OAuthToken models; refresh tokens encrypted at rest (Fernet) - Alembic migrations, run automatically on container startup - Postgres backup/restore scripts for portability between machines 2026-06-11 01:01:37 +02:00			`fastapi>=0.115,<1.0`
			`uvicorn[standard]>=0.30,<1.0`
			`sqlalchemy>=2.0,<2.1`
			`psycopg[binary]>=3.2,<4.0`
			`alembic>=1.13,<2.0`
			`pydantic>=2.7,<3.0`
			`pydantic-settings>=2.3,<3.0`
			`authlib>=1.3,<2.0`
			`httpx>=0.27,<1.0`
feat: M2 (part 2) — RSS poller, backfill, enrichment, scheduler - Free per-channel RSS reader for quota-less fresh-video detection - Recent-first backfill (configurable: 100 videos / 1 year) plus resumable deep backfill from the uploads playlist - Enrichment via videos.list: duration, view/like counts, category, topics, language, Shorts heuristic and livestream/premiere classification - Reusable sync runners + APScheduler jobs (rss / enrich / backfill), all quota-aware with a reserve so backfill never starves fresh enrichment - Manual triggers: POST /api/sync/{rss,backfill,enrich} - Exact insert counting via RETURNING with in-batch de-duplication 2026-06-11 01:36:41 +02:00			`feedparser>=6.0,<7.0`
			`apscheduler>=3.10,<4.0`
feat: M3 — automatic channel tagging (language + topic system tags) - Tag and ChannelTag models + migration 0003 (partial unique indexes split system vs per-user tag names) - Offline language detection (py3langid) constrained to a curated language set, with the channel's declared default language as a strong prior - Topic tags mapped from YouTube topicDetails + dominant video category; the generic "Lifestyle" catch-all is intentionally dropped - System (auto) tags are regenerated idempotently and never touch user tags; orphaned system tags are cleaned up - GET /api/tags and admin POST /api/tags/recompute; scheduled autotag job 2026-06-11 01:57:19 +02:00			`py3langid>=0.3,<1.0`
feat: M1 foundation — compose stack, FastAPI, Google OAuth, encrypted tokens - docker-compose with Postgres 16 + slim Python API image - FastAPI app with session middleware, health endpoint, static login page - Google OAuth (Authlib) with email invite-list whitelist; admin role support - User + OAuthToken models; refresh tokens encrypted at rest (Fernet) - Alembic migrations, run automatically on container startup - Postgres backup/restore scripts for portability between machines 2026-06-11 01:01:37 +02:00			`itsdangerous>=2.1,<3.0`
fix(security): patch cryptography CVEs, upgrade pip at build, harden /auth/upgrade - requirements: cryptography >=46.0.7 (was pinned <46, which excluded the fix for the CVEs pip-audit flagged in our Fernet/crypto library). pip-audit now clean. - Dockerfile: upgrade pip before installing deps (patches installer-level CVEs). - auth: /auth/upgrade now defaults to the least-privileged read scope; only an explicit access=write requests the write scope. 2026-06-14 05:59:34 +02:00			`cryptography>=46.0.7,<47`
feat(auth): email+password registration with two-gate activation (5a backend) Add email+password auth alongside Google: argon2id hashing; users gains password_hash/email_verified/is_active and google_sub becomes nullable (migration 0022); a single-use, hashed auth_tokens table for email verification + password reset. Registration creates a pending (inactive, unverified) account + an access request; sign-in needs verified email AND admin approval. Anti-enumeration: uniform register/login/reset responses (a correct-password owner still gets a specific pending reason). allow_registration flag (DB-tunable). Admin users-list + role endpoint (guards: not self, not demo, not the last admin); approving access (or a manual whitelist add) now activates the matching pending account. current_user rejects deactivated accounts. Verified end-to-end via curl + DB. 2026-06-19 14:03:11 +02:00			`argon2-cffi>=23.1,<26`