Issue 1: repo scaffold and project structure

backend/ten31portal/auth.py

@@ -0,0 +1,51 @@
+"""Authentication, session management, and role enforcement."""
+
+from typing import Annotated
+
+from argon2 import PasswordHasher
+from argon2.exceptions import VerifyMismatchError
+from fastapi import Depends, HTTPException, Request
+from sqlmodel import Session, select
+
+from ten31portal.database import get_session
+from ten31portal.models import User, UserRole
+
+ph = PasswordHasher()
+
+
+def hash_password(password: str) -> str:
+    return ph.hash(password)
+
+
+def verify_password(password: str, password_hash: str) -> bool:
+    try:
+        return ph.verify(password_hash, password)
+    except VerifyMismatchError:
+        return False
+
+
+def get_current_user(request: Request, session: Session = Depends(get_session)) -> User:
+    """FastAPI dependency: extract user from session cookie."""
+    user_id = request.session.get("user_id")
+    if user_id is None:
+        raise HTTPException(status_code=401, detail="Not authenticated")
+    user = session.get(User, user_id)
+    if user is None or not user.is_active:
+        raise HTTPException(status_code=401, detail="Not authenticated")
+    return user
+
+
+def require_role(*roles: UserRole):
+    """Return a dependency that enforces one of the given roles."""
+    def checker(user: User = Depends(get_current_user)) -> User:
+        if user.role not in roles:
+            raise HTTPException(status_code=403, detail="Insufficient permissions")
+        return user
+    return checker
+
+
+# Convenience aliases
+require_user = get_current_user
+require_writer = require_role(UserRole.fund_admin, UserRole.cfo, UserRole.approver)
+require_approver = require_role(UserRole.approver)
+require_audit_reader = require_role(UserRole.approver, UserRole.cfo)