Phase 1: auth, room CRUD, WebSocket chat, PWA frontend

Invite-only FastAPI + SQLAlchemy(async) + Postgres backend (session-cookie
auth via CLI-provisioned accounts, open-room CRUD, single-instance /ws/chat)
and a React + Vite PWA frontend (login, room list, chat view). Backend tests
pass against a local Postgres DB. See README.md and backend/README.md for
setup, and ARCHITECTURE.md for the full phased design.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/app/ws/chat.py

@@ -0,0 +1,112 @@
+import uuid
+
+from fastapi import APIRouter, Depends, WebSocket, WebSocketDisconnect
+from pydantic import BaseModel, ValidationError
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.models import RoomMembership, User
+from app.services.message_service import create_message
+
+router = APIRouter(tags=["ws"])
+
+WS_UNAUTHENTICATED = 4401
+
+
+class ClientEnvelope(BaseModel):
+    type: str
+    room_id: uuid.UUID | None = None
+    content: str | None = None
+
+
+async def _is_room_member(db: AsyncSession, room_id: uuid.UUID, user_id: uuid.UUID) -> bool:
+    result = await db.execute(
+        select(RoomMembership).where(
+            RoomMembership.room_id == room_id, RoomMembership.user_id == user_id
+        )
+    )
+    return result.scalar_one_or_none() is not None
+
+
+@router.websocket("/ws/chat")
+async def chat_endpoint(websocket: WebSocket, db: AsyncSession = Depends(get_db)) -> None:
+    user_id_raw = websocket.session.get("user_id")
+    if not user_id_raw:
+        await websocket.close(code=WS_UNAUTHENTICATED)
+        return
+
+    user = await db.get(User, uuid.UUID(user_id_raw))
+    if user is None:
+        await websocket.close(code=WS_UNAUTHENTICATED)
+        return
+
+    await websocket.accept()
+    manager = websocket.app.state.connection_manager
+    joined_rooms: set[uuid.UUID] = set()
+
+    try:
+        while True:
+            raw = await websocket.receive_json()
+            try:
+                envelope = ClientEnvelope.model_validate(raw)
+            except ValidationError:
+                await websocket.send_json({"type": "error", "detail": "Malformed message"})
+                continue
+
+            if envelope.type == "join":
+                if envelope.room_id is None:
+                    await websocket.send_json({"type": "error", "detail": "room_id required"})
+                    continue
+                if not await _is_room_member(db, envelope.room_id, user.id):
+                    await websocket.send_json(
+                        {"type": "error", "detail": "Not a member of this room"}
+                    )
+                    continue
+                manager.join(envelope.room_id, websocket)
+                joined_rooms.add(envelope.room_id)
+                await websocket.send_json({"type": "joined", "room_id": str(envelope.room_id)})
+
+            elif envelope.type == "leave":
+                if envelope.room_id is None:
+                    await websocket.send_json({"type": "error", "detail": "room_id required"})
+                    continue
+                manager.leave(envelope.room_id, websocket)
+                joined_rooms.discard(envelope.room_id)
+
+            elif envelope.type == "message":
+                if envelope.room_id is None or not envelope.content:
+                    await websocket.send_json(
+                        {"type": "error", "detail": "room_id and content required"}
+                    )
+                    continue
+                if envelope.room_id not in joined_rooms or not await _is_room_member(
+                    db, envelope.room_id, user.id
+                ):
+                    await websocket.send_json(
+                        {"type": "error", "detail": "Not a member of this room"}
+                    )
+                    continue
+                message = await create_message(db, envelope.room_id, user.id, envelope.content)
+                await manager.broadcast(
+                    envelope.room_id,
+                    {
+                        "type": "message",
+                        "id": str(message.id),
+                        "room_id": str(message.room_id),
+                        "user_id": str(message.user_id),
+                        "username": user.username,
+                        "content": message.content,
+                        "created_at": message.created_at.isoformat(),
+                    },
+                )
+
+            else:
+                await websocket.send_json(
+                    {"type": "error", "detail": f"Unknown message type: {envelope.type}"}
+                )
+
+    except WebSocketDisconnect:
+        pass
+    finally:
+        manager.leave_all(websocket)

backend/app/ws/connection_manager.py

@@ -0,0 +1,31 @@
+import uuid
+from collections import defaultdict
+
+from fastapi import WebSocket
+
+
+class ConnectionManager:
+    """In-memory, single-process WebSocket registry.
+
+    Correct for a single app-server instance only; cross-instance fan-out via
+    Redis pub/sub is a later phase (ARCHITECTURE.md phase 5).
+    """
+
+    def __init__(self) -> None:
+        self._rooms: dict[uuid.UUID, set[WebSocket]] = defaultdict(set)
+
+    def join(self, room_id: uuid.UUID, websocket: WebSocket) -> None:
+        self._rooms[room_id].add(websocket)
+
+    def leave(self, room_id: uuid.UUID, websocket: WebSocket) -> None:
+        self._rooms[room_id].discard(websocket)
+        if not self._rooms[room_id]:
+            del self._rooms[room_id]
+
+    def leave_all(self, websocket: WebSocket) -> None:
+        for room_id in list(self._rooms.keys()):
+            self.leave(room_id, websocket)
+
+    async def broadcast(self, room_id: uuid.UUID, payload: dict) -> None:
+        for websocket in list(self._rooms.get(room_id, ())):
+            await websocket.send_json(payload)