perf: paginate docs list, lazy thumbnails, static cache headers

services/auth_service.py

@@ -1,6 +1,9 @@
 import hashlib
 import hmac
 import secrets
+from datetime import datetime, timedelta
+
+SESSION_TTL_SECONDS = 86400  # 24h
 
 def hash_password(password: str) -> str:
     salt = secrets.token_hex(16)
@@ -38,3 +41,47 @@ def get_all_users():
         cursor = conn.execute("SELECT id, username, created_at FROM users ORDER BY created_at DESC")
         return cursor.fetchall()
 
+
+# ─── Sessions (DB-backed) ─────────────────────────────────────────
+
+def create_session(user_id: int, username: str, ttl_seconds: int = SESSION_TTL_SECONDS) -> str:
+    from database.connection import get_db
+    session_id = secrets.token_urlsafe(32)
+    expires_at = (datetime.utcnow() + timedelta(seconds=ttl_seconds)).strftime("%Y-%m-%d %H:%M:%S")
+    with get_db() as conn:
+        conn.execute(
+            "INSERT INTO sessions (id, user_id, username, expires_at) VALUES (?, ?, ?, ?)",
+            (session_id, user_id, username, expires_at),
+        )
+    return session_id
+
+
+def get_session(session_id: str):
+    """Return dict with user_id/username if session is valid and unexpired, else None."""
+    if not session_id:
+        return None
+    from database.connection import get_db
+    now = datetime.utcnow().strftime("%Y-%m-%d %H:%M:%S")
+    with get_db() as conn:
+        row = conn.execute(
+            "SELECT id, user_id, username, expires_at FROM sessions WHERE id = ? AND expires_at > ?",
+            (session_id, now),
+        ).fetchone()
+    return dict(row) if row else None
+
+
+def delete_session(session_id: str) -> None:
+    if not session_id:
+        return
+    from database.connection import get_db
+    with get_db() as conn:
+        conn.execute("DELETE FROM sessions WHERE id = ?", (session_id,))
+
+
+def cleanup_expired_sessions() -> int:
+    from database.connection import get_db
+    now = datetime.utcnow().strftime("%Y-%m-%d %H:%M:%S")
+    with get_db() as conn:
+        cur = conn.execute("DELETE FROM sessions WHERE expires_at <= ?", (now,))
+        return cur.rowcount or 0
+