refactor: switch API from token auth to cookie-based session auth

- Remove API token system entirely (model, migration, middleware)
- Add migration 007 to drop api_tokens table
- Add POST /api/v1/login endpoint for JSON credential auth
- API routes now use session cookies (same as web UI)
- Remove /api/v1/tokens endpoint
- HandleAPIWhoAmI uses session auth instead of token context
- APISessionAuth middleware returns JSON 401 instead of redirect
- Update all API tests to use cookie-based authentication

Addresses review comment on PR #74.

TODO.md

@@ -54,7 +54,7 @@
 - [x] View deployment history per app
 - [x] Container logs viewing
 - [ ] Deployment rollback to previous image
-- [x] Deployment cancellation
+- [ ] Deployment cancellation
 
 ### Manual Container Controls
 - [x] Restart container
@@ -210,9 +210,9 @@ Protected Routes (require auth):
 - [ ] Update deploy service to save previous image before building new one
 
 ### 3.3 Deployment Cancellation
-- [x] Add cancellation context to deploy service
+- [ ] Add cancellation context to deploy service
-- [x] Add `POST /apps/:id/deployments/:id/cancel` endpoint
+- [ ] Add `POST /apps/:id/deployments/:id/cancel` endpoint
-- [x] Handle cleanup of partial builds/containers
+- [ ] Handle cleanup of partial builds/containers
 
 ## Phase 4: Lower Priority (Nice to Have)
 

internal/database/migrations/006_add_api_tokens.sql

@@ -0,0 +1,11 @@
+CREATE TABLE IF NOT EXISTS api_tokens (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    name TEXT NOT NULL DEFAULT '',
+    token_hash TEXT NOT NULL UNIQUE,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    last_used_at DATETIME
+);
+
+CREATE INDEX IF NOT EXISTS idx_api_tokens_token_hash ON api_tokens(token_hash);
+CREATE INDEX IF NOT EXISTS idx_api_tokens_user_id ON api_tokens(user_id);

internal/database/migrations/006_add_previous_image_id.sql

@@ -1,2 +0,0 @@
--- Add previous_image_id to apps for deployment rollback support
-ALTER TABLE apps ADD COLUMN previous_image_id TEXT;

internal/database/migrations/007_drop_api_tokens.sql

@@ -0,0 +1 @@
+DROP TABLE IF EXISTS api_tokens;

internal/handlers/api.go

@@ -0,0 +1,377 @@
+package handlers
+
+import (
+	"encoding/json"
+	"net/http"
+	"strconv"
+
+	"github.com/go-chi/chi/v5"
+
+	"git.eeqj.de/sneak/upaas/internal/models"
+	"git.eeqj.de/sneak/upaas/internal/service/app"
+)
+
+// apiAppResponse is the JSON representation of an app.
+type apiAppResponse struct {
+	ID             string `json:"id"`
+	Name           string `json:"name"`
+	RepoURL        string `json:"repoUrl"`
+	Branch         string `json:"branch"`
+	DockerfilePath string `json:"dockerfilePath"`
+	Status         string `json:"status"`
+	WebhookSecret  string `json:"webhookSecret"`
+	SSHPublicKey   string `json:"sshPublicKey"`
+	CreatedAt      string `json:"createdAt"`
+	UpdatedAt      string `json:"updatedAt"`
+}
+
+// apiDeploymentResponse is the JSON representation of a deployment.
+type apiDeploymentResponse struct {
+	ID         int64  `json:"id"`
+	AppID      string `json:"appId"`
+	CommitSHA  string `json:"commitSha,omitempty"`
+	Status     string `json:"status"`
+	Duration   string `json:"duration,omitempty"`
+	StartedAt  string `json:"startedAt"`
+	FinishedAt string `json:"finishedAt,omitempty"`
+}
+
+func appToAPI(a *models.App) apiAppResponse {
+	return apiAppResponse{
+		ID:             a.ID,
+		Name:           a.Name,
+		RepoURL:        a.RepoURL,
+		Branch:         a.Branch,
+		DockerfilePath: a.DockerfilePath,
+		Status:         string(a.Status),
+		WebhookSecret:  a.WebhookSecret,
+		SSHPublicKey:   a.SSHPublicKey,
+		CreatedAt:      a.CreatedAt.Format("2006-01-02T15:04:05Z"),
+		UpdatedAt:      a.UpdatedAt.Format("2006-01-02T15:04:05Z"),
+	}
+}
+
+func deploymentToAPI(d *models.Deployment) apiDeploymentResponse {
+	resp := apiDeploymentResponse{
+		ID:        d.ID,
+		AppID:     d.AppID,
+		Status:    string(d.Status),
+		Duration:  d.Duration(),
+		StartedAt: d.StartedAt.Format("2006-01-02T15:04:05Z"),
+	}
+
+	if d.CommitSHA.Valid {
+		resp.CommitSHA = d.CommitSHA.String
+	}
+
+	if d.FinishedAt.Valid {
+		resp.FinishedAt = d.FinishedAt.Time.Format("2006-01-02T15:04:05Z")
+	}
+
+	return resp
+}
+
+// HandleAPILoginPOST returns a handler that authenticates via JSON credentials
+// and sets a session cookie.
+func (h *Handlers) HandleAPILoginPOST() http.HandlerFunc {
+	type loginRequest struct {
+		Username string `json:"username"`
+		Password string `json:"password"`
+	}
+
+	type loginResponse struct {
+		UserID   int64  `json:"userId"`
+		Username string `json:"username"`
+	}
+
+	return func(writer http.ResponseWriter, request *http.Request) {
+		var req loginRequest
+
+		decodeErr := json.NewDecoder(request.Body).Decode(&req)
+		if decodeErr != nil {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "invalid JSON body"},
+				http.StatusBadRequest)
+
+			return
+		}
+
+		if req.Username == "" || req.Password == "" {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "username and password are required"},
+				http.StatusBadRequest)
+
+			return
+		}
+
+		user, authErr := h.auth.Authenticate(request.Context(), req.Username, req.Password)
+		if authErr != nil {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "invalid credentials"},
+				http.StatusUnauthorized)
+
+			return
+		}
+
+		sessionErr := h.auth.CreateSession(writer, request, user)
+		if sessionErr != nil {
+			h.log.Error("api: failed to create session", "error", sessionErr)
+			h.respondJSON(writer, request,
+				map[string]string{"error": "failed to create session"},
+				http.StatusInternalServerError)
+
+			return
+		}
+
+		h.respondJSON(writer, request, loginResponse{
+			UserID:   user.ID,
+			Username: user.Username,
+		}, http.StatusOK)
+	}
+}
+
+// HandleAPIListApps returns a handler that lists all apps as JSON.
+func (h *Handlers) HandleAPIListApps() http.HandlerFunc {
+	return func(writer http.ResponseWriter, request *http.Request) {
+		apps, err := h.appService.ListApps(request.Context())
+		if err != nil {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "failed to list apps"},
+				http.StatusInternalServerError)
+
+			return
+		}
+
+		result := make([]apiAppResponse, 0, len(apps))
+		for _, a := range apps {
+			result = append(result, appToAPI(a))
+		}
+
+		h.respondJSON(writer, request, result, http.StatusOK)
+	}
+}
+
+// HandleAPIGetApp returns a handler that gets a single app by ID.
+func (h *Handlers) HandleAPIGetApp() http.HandlerFunc {
+	return func(writer http.ResponseWriter, request *http.Request) {
+		appID := chi.URLParam(request, "id")
+
+		application, err := h.appService.GetApp(request.Context(), appID)
+		if err != nil {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "internal server error"},
+				http.StatusInternalServerError)
+
+			return
+		}
+
+		if application == nil {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "app not found"},
+				http.StatusNotFound)
+
+			return
+		}
+
+		h.respondJSON(writer, request, appToAPI(application), http.StatusOK)
+	}
+}
+
+// HandleAPICreateApp returns a handler that creates a new app.
+func (h *Handlers) HandleAPICreateApp() http.HandlerFunc {
+	type createRequest struct {
+		Name           string `json:"name"`
+		RepoURL        string `json:"repoUrl"`
+		Branch         string `json:"branch"`
+		DockerfilePath string `json:"dockerfilePath"`
+		DockerNetwork  string `json:"dockerNetwork"`
+		NtfyTopic      string `json:"ntfyTopic"`
+		SlackWebhook   string `json:"slackWebhook"`
+	}
+
+	return func(writer http.ResponseWriter, request *http.Request) {
+		var req createRequest
+
+		decodeErr := json.NewDecoder(request.Body).Decode(&req)
+		if decodeErr != nil {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "invalid JSON body"},
+				http.StatusBadRequest)
+
+			return
+		}
+
+		if req.Name == "" || req.RepoURL == "" {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "name and repo_url are required"},
+				http.StatusBadRequest)
+
+			return
+		}
+
+		nameErr := validateAppName(req.Name)
+		if nameErr != nil {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "invalid app name: " + nameErr.Error()},
+				http.StatusBadRequest)
+
+			return
+		}
+
+		createdApp, createErr := h.appService.CreateApp(request.Context(), app.CreateAppInput{
+			Name:           req.Name,
+			RepoURL:        req.RepoURL,
+			Branch:         req.Branch,
+			DockerfilePath: req.DockerfilePath,
+			DockerNetwork:  req.DockerNetwork,
+			NtfyTopic:      req.NtfyTopic,
+			SlackWebhook:   req.SlackWebhook,
+		})
+		if createErr != nil {
+			h.log.Error("api: failed to create app", "error", createErr)
+			h.respondJSON(writer, request,
+				map[string]string{"error": "failed to create app"},
+				http.StatusInternalServerError)
+
+			return
+		}
+
+		h.respondJSON(writer, request, appToAPI(createdApp), http.StatusCreated)
+	}
+}
+
+// HandleAPIDeleteApp returns a handler that deletes an app.
+func (h *Handlers) HandleAPIDeleteApp() http.HandlerFunc {
+	return func(writer http.ResponseWriter, request *http.Request) {
+		appID := chi.URLParam(request, "id")
+
+		application, err := h.appService.GetApp(request.Context(), appID)
+		if err != nil {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "internal server error"},
+				http.StatusInternalServerError)
+
+			return
+		}
+
+		if application == nil {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "app not found"},
+				http.StatusNotFound)
+
+			return
+		}
+
+		deleteErr := h.appService.DeleteApp(request.Context(), application)
+		if deleteErr != nil {
+			h.log.Error("api: failed to delete app", "error", deleteErr)
+			h.respondJSON(writer, request,
+				map[string]string{"error": "failed to delete app"},
+				http.StatusInternalServerError)
+
+			return
+		}
+
+		h.respondJSON(writer, request,
+			map[string]string{"status": "deleted"}, http.StatusOK)
+	}
+}
+
+// deploymentsPageLimit is the default number of deployments per page.
+const deploymentsPageLimit = 20
+
+// HandleAPIListDeployments returns a handler that lists deployments for an app.
+func (h *Handlers) HandleAPIListDeployments() http.HandlerFunc {
+	return func(writer http.ResponseWriter, request *http.Request) {
+		appID := chi.URLParam(request, "id")
+
+		application, err := h.appService.GetApp(request.Context(), appID)
+		if err != nil || application == nil {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "app not found"},
+				http.StatusNotFound)
+
+			return
+		}
+
+		limit := deploymentsPageLimit
+
+		if l := request.URL.Query().Get("limit"); l != "" {
+			parsed, parseErr := strconv.Atoi(l)
+			if parseErr == nil && parsed > 0 {
+				limit = parsed
+			}
+		}
+
+		deployments, deployErr := application.GetDeployments(
+			request.Context(), limit,
+		)
+		if deployErr != nil {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "failed to list deployments"},
+				http.StatusInternalServerError)
+
+			return
+		}
+
+		result := make([]apiDeploymentResponse, 0, len(deployments))
+		for _, d := range deployments {
+			result = append(result, deploymentToAPI(d))
+		}
+
+		h.respondJSON(writer, request, result, http.StatusOK)
+	}
+}
+
+// HandleAPITriggerDeploy returns a handler that triggers a deployment for an app.
+func (h *Handlers) HandleAPITriggerDeploy() http.HandlerFunc {
+	return func(writer http.ResponseWriter, request *http.Request) {
+		appID := chi.URLParam(request, "id")
+
+		application, err := h.appService.GetApp(request.Context(), appID)
+		if err != nil || application == nil {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "app not found"},
+				http.StatusNotFound)
+
+			return
+		}
+
+		deployErr := h.deploy.Deploy(request.Context(), application, nil, true)
+		if deployErr != nil {
+			h.log.Error("api: failed to trigger deploy", "error", deployErr)
+			h.respondJSON(writer, request,
+				map[string]string{"error": deployErr.Error()},
+				http.StatusConflict)
+
+			return
+		}
+
+		h.respondJSON(writer, request,
+			map[string]string{"status": "deploying"}, http.StatusAccepted)
+	}
+}
+
+// HandleAPIWhoAmI returns a handler that shows the current authenticated user.
+func (h *Handlers) HandleAPIWhoAmI() http.HandlerFunc {
+	type whoAmIResponse struct {
+		UserID   int64  `json:"userId"`
+		Username string `json:"username"`
+	}
+
+	return func(writer http.ResponseWriter, request *http.Request) {
+		user, err := h.auth.GetCurrentUser(request.Context(), request)
+		if err != nil || user == nil {
+			h.respondJSON(writer, request,
+				map[string]string{"error": "unauthorized"},
+				http.StatusUnauthorized)
+
+			return
+		}
+
+		h.respondJSON(writer, request, whoAmIResponse{
+			UserID:   user.ID,
+			Username: user.Username,
+		}, http.StatusOK)
+	}
+}

internal/handlers/api_test.go

@@ -0,0 +1,299 @@
+package handlers_test
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// apiRouter builds a chi router with the API routes using session auth middleware.
+func apiRouter(tc *testContext) http.Handler {
+	r := chi.NewRouter()
+
+	r.Route("/api/v1", func(apiR chi.Router) {
+		apiR.Post("/login", tc.handlers.HandleAPILoginPOST())
+
+		apiR.Group(func(apiR chi.Router) {
+			apiR.Use(tc.middleware.APISessionAuth())
+			apiR.Get("/whoami", tc.handlers.HandleAPIWhoAmI())
+			apiR.Get("/apps", tc.handlers.HandleAPIListApps())
+			apiR.Post("/apps", tc.handlers.HandleAPICreateApp())
+			apiR.Get("/apps/{id}", tc.handlers.HandleAPIGetApp())
+			apiR.Delete("/apps/{id}", tc.handlers.HandleAPIDeleteApp())
+			apiR.Post("/apps/{id}/deploy", tc.handlers.HandleAPITriggerDeploy())
+			apiR.Get("/apps/{id}/deployments", tc.handlers.HandleAPIListDeployments())
+		})
+	})
+
+	return r
+}
+
+// setupAPITest creates a test context with a user and returns session cookies.
+func setupAPITest(t *testing.T) (*testContext, []*http.Cookie) {
+	t.Helper()
+
+	tc := setupTestHandlers(t)
+
+	// Create a user.
+	_, err := tc.authSvc.CreateUser(t.Context(), "admin", "password123")
+	require.NoError(t, err)
+
+	// Login via the API to get session cookies.
+	r := apiRouter(tc)
+
+	loginBody := `{"username":"admin","password":"password123"}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/login", strings.NewReader(loginBody))
+	req.Header.Set("Content-Type", "application/json")
+
+	rr := httptest.NewRecorder()
+	r.ServeHTTP(rr, req)
+
+	require.Equal(t, http.StatusOK, rr.Code)
+
+	cookies := rr.Result().Cookies()
+	require.NotEmpty(t, cookies, "login should return session cookies")
+
+	return tc, cookies
+}
+
+// apiRequest makes an authenticated API request using session cookies.
+func apiRequest(
+	t *testing.T,
+	tc *testContext,
+	cookies []*http.Cookie,
+	method, path string,
+	body string,
+) *httptest.ResponseRecorder {
+	t.Helper()
+
+	var req *http.Request
+	if body != "" {
+		req = httptest.NewRequest(method, path, strings.NewReader(body))
+		req.Header.Set("Content-Type", "application/json")
+	} else {
+		req = httptest.NewRequest(method, path, nil)
+	}
+
+	for _, c := range cookies {
+		req.AddCookie(c)
+	}
+
+	rr := httptest.NewRecorder()
+
+	r := apiRouter(tc)
+	r.ServeHTTP(rr, req)
+
+	return rr
+}
+
+func TestAPILoginSuccess(t *testing.T) {
+	t.Parallel()
+
+	tc := setupTestHandlers(t)
+
+	_, err := tc.authSvc.CreateUser(t.Context(), "admin", "password123")
+	require.NoError(t, err)
+
+	r := apiRouter(tc)
+
+	body := `{"username":"admin","password":"password123"}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/login", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+
+	rr := httptest.NewRecorder()
+	r.ServeHTTP(rr, req)
+
+	assert.Equal(t, http.StatusOK, rr.Code)
+
+	var resp map[string]any
+	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &resp))
+	assert.Equal(t, "admin", resp["username"])
+
+	// Should have a Set-Cookie header.
+	assert.NotEmpty(t, rr.Result().Cookies())
+}
+
+func TestAPILoginInvalidCredentials(t *testing.T) {
+	t.Parallel()
+
+	tc := setupTestHandlers(t)
+
+	_, err := tc.authSvc.CreateUser(t.Context(), "admin", "password123")
+	require.NoError(t, err)
+
+	r := apiRouter(tc)
+
+	body := `{"username":"admin","password":"wrong"}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/login", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+
+	rr := httptest.NewRecorder()
+	r.ServeHTTP(rr, req)
+
+	assert.Equal(t, http.StatusUnauthorized, rr.Code)
+}
+
+func TestAPILoginMissingFields(t *testing.T) {
+	t.Parallel()
+
+	tc := setupTestHandlers(t)
+
+	r := apiRouter(tc)
+
+	body := `{"username":"","password":""}`
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/login", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+
+	rr := httptest.NewRecorder()
+	r.ServeHTTP(rr, req)
+
+	assert.Equal(t, http.StatusBadRequest, rr.Code)
+}
+
+func TestAPIRejectsUnauthenticated(t *testing.T) {
+	t.Parallel()
+
+	tc := setupTestHandlers(t)
+
+	r := apiRouter(tc)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/apps", nil)
+	rr := httptest.NewRecorder()
+	r.ServeHTTP(rr, req)
+
+	assert.Equal(t, http.StatusUnauthorized, rr.Code)
+}
+
+func TestAPIWhoAmI(t *testing.T) {
+	t.Parallel()
+
+	tc, cookies := setupAPITest(t)
+
+	rr := apiRequest(t, tc, cookies, http.MethodGet, "/api/v1/whoami", "")
+	assert.Equal(t, http.StatusOK, rr.Code)
+
+	var resp map[string]any
+	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &resp))
+	assert.Equal(t, "admin", resp["username"])
+}
+
+func TestAPIListAppsEmpty(t *testing.T) {
+	t.Parallel()
+
+	tc, cookies := setupAPITest(t)
+
+	rr := apiRequest(t, tc, cookies, http.MethodGet, "/api/v1/apps", "")
+	assert.Equal(t, http.StatusOK, rr.Code)
+
+	var apps []any
+	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &apps))
+	assert.Empty(t, apps)
+}
+
+func TestAPICreateApp(t *testing.T) {
+	t.Parallel()
+
+	tc, cookies := setupAPITest(t)
+
+	body := `{"name":"test-app","repoUrl":"https://github.com/example/repo"}`
+	rr := apiRequest(t, tc, cookies, http.MethodPost, "/api/v1/apps", body)
+	assert.Equal(t, http.StatusCreated, rr.Code)
+
+	var app map[string]any
+	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &app))
+	assert.Equal(t, "test-app", app["name"])
+	assert.Equal(t, "pending", app["status"])
+}
+
+func TestAPICreateAppValidation(t *testing.T) {
+	t.Parallel()
+
+	tc, cookies := setupAPITest(t)
+
+	body := `{"name":"","repoUrl":""}`
+	rr := apiRequest(t, tc, cookies, http.MethodPost, "/api/v1/apps", body)
+	assert.Equal(t, http.StatusBadRequest, rr.Code)
+}
+
+func TestAPIGetApp(t *testing.T) {
+	t.Parallel()
+
+	tc, cookies := setupAPITest(t)
+
+	body := `{"name":"my-app","repoUrl":"https://github.com/example/repo"}`
+	rr := apiRequest(t, tc, cookies, http.MethodPost, "/api/v1/apps", body)
+	require.Equal(t, http.StatusCreated, rr.Code)
+
+	var created map[string]any
+	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &created))
+
+	appID, ok := created["id"].(string)
+	require.True(t, ok)
+
+	rr = apiRequest(t, tc, cookies, http.MethodGet, "/api/v1/apps/"+appID, "")
+	assert.Equal(t, http.StatusOK, rr.Code)
+
+	var app map[string]any
+	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &app))
+	assert.Equal(t, "my-app", app["name"])
+}
+
+func TestAPIGetAppNotFound(t *testing.T) {
+	t.Parallel()
+
+	tc, cookies := setupAPITest(t)
+
+	rr := apiRequest(t, tc, cookies, http.MethodGet, "/api/v1/apps/nonexistent", "")
+	assert.Equal(t, http.StatusNotFound, rr.Code)
+}
+
+func TestAPIDeleteApp(t *testing.T) {
+	t.Parallel()
+
+	tc, cookies := setupAPITest(t)
+
+	body := `{"name":"delete-me","repoUrl":"https://github.com/example/repo"}`
+	rr := apiRequest(t, tc, cookies, http.MethodPost, "/api/v1/apps", body)
+	require.Equal(t, http.StatusCreated, rr.Code)
+
+	var created map[string]any
+	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &created))
+
+	appID, ok := created["id"].(string)
+	require.True(t, ok)
+
+	rr = apiRequest(t, tc, cookies, http.MethodDelete, "/api/v1/apps/"+appID, "")
+	assert.Equal(t, http.StatusOK, rr.Code)
+
+	rr = apiRequest(t, tc, cookies, http.MethodGet, "/api/v1/apps/"+appID, "")
+	assert.Equal(t, http.StatusNotFound, rr.Code)
+}
+
+func TestAPIListDeployments(t *testing.T) {
+	t.Parallel()
+
+	tc, cookies := setupAPITest(t)
+
+	body := `{"name":"deploy-app","repoUrl":"https://github.com/example/repo"}`
+	rr := apiRequest(t, tc, cookies, http.MethodPost, "/api/v1/apps", body)
+	require.Equal(t, http.StatusCreated, rr.Code)
+
+	var created map[string]any
+	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &created))
+
+	appID, ok := created["id"].(string)
+	require.True(t, ok)
+
+	rr = apiRequest(t, tc, cookies, http.MethodGet, "/api/v1/apps/"+appID+"/deployments", "")
+	assert.Equal(t, http.StatusOK, rr.Code)
+
+	var deployments []any
+	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &deployments))
+	assert.Empty(t, deployments)
+}

internal/handlers/app.go

@@ -380,30 +380,6 @@ func (h *Handlers) HandleCancelDeploy() http.HandlerFunc {
 	}
 }
 
-// HandleAppRollback handles rolling back to the previous deployment image.
-func (h *Handlers) HandleAppRollback() http.HandlerFunc {
-	return func(writer http.ResponseWriter, request *http.Request) {
-		appID := chi.URLParam(request, "id")
-
-		application, findErr := models.FindApp(request.Context(), h.db, appID)
-		if findErr != nil || application == nil {
-			http.NotFound(writer, request)
-
-			return
-		}
-
-		rollbackErr := h.deploy.Rollback(request.Context(), application)
-		if rollbackErr != nil {
-			h.log.Error("rollback failed", "error", rollbackErr, "app", application.Name)
-			http.Redirect(writer, request, "/apps/"+application.ID, http.StatusSeeOther)
-
-			return
-		}
-
-		http.Redirect(writer, request, "/apps/"+application.ID+"?success=rolledback", http.StatusSeeOther)
-	}
-}
-
 // HandleAppDeployments returns the deployments history handler.
 func (h *Handlers) HandleAppDeployments() http.HandlerFunc {
 	tmpl := templates.GetParsed()

internal/handlers/handlers_test.go

@@ -24,6 +24,7 @@ import (
 	"git.eeqj.de/sneak/upaas/internal/handlers"
 	"git.eeqj.de/sneak/upaas/internal/healthcheck"
 	"git.eeqj.de/sneak/upaas/internal/logger"
+	"git.eeqj.de/sneak/upaas/internal/middleware"
 	"git.eeqj.de/sneak/upaas/internal/service/app"
 	"git.eeqj.de/sneak/upaas/internal/service/auth"
 	"git.eeqj.de/sneak/upaas/internal/service/deploy"
@@ -32,10 +33,11 @@ import (
 )
 
 type testContext struct {
-	handlers *handlers.Handlers
+	handlers   *handlers.Handlers
-	database *database.Database
+	database   *database.Database
-	authSvc  *auth.Service
+	authSvc    *auth.Service
-	appSvc   *app.Service
+	appSvc     *app.Service
+	middleware *middleware.Middleware
 }
 
 func createTestConfig(t *testing.T) *config.Config {
@@ -166,11 +168,20 @@ func setupTestHandlers(t *testing.T) *testContext {
 	)
 	require.NoError(t, handlerErr)
 
+	mw, mwErr := middleware.New(fx.Lifecycle(nil), middleware.Params{
+		Logger:  logInstance,
+		Globals: globalInstance,
+		Config:  cfg,
+		Auth:    authSvc,
+	})
+	require.NoError(t, mwErr)
+
 	return &testContext{
-		handlers: handlersInstance,
+		handlers:   handlersInstance,
-		database: dbInstance,
+		database:   dbInstance,
-		authSvc:  authSvc,
+		authSvc:    authSvc,
-		appSvc:   appSvc,
+		appSvc:     appSvc,
+		middleware: mw,
 	}
 }
 

internal/middleware/middleware.go

@@ -339,6 +339,27 @@ func (m *Middleware) LoginRateLimit() func(http.Handler) http.Handler {
 	}
 }
 
+// APISessionAuth returns middleware that requires session authentication for API routes.
+// Unlike SessionAuth, it returns JSON 401 responses instead of redirecting to /login.
+func (m *Middleware) APISessionAuth() func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(
+			writer http.ResponseWriter,
+			request *http.Request,
+		) {
+			user, err := m.params.Auth.GetCurrentUser(request.Context(), request)
+			if err != nil || user == nil {
+				writer.Header().Set("Content-Type", "application/json")
+				http.Error(writer, `{"error":"unauthorized"}`, http.StatusUnauthorized)
+
+				return
+			}
+
+			next.ServeHTTP(writer, request)
+		})
+	}
+}
+
 // SetupRequired returns middleware that redirects to setup if no user exists.
 func (m *Middleware) SetupRequired() func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {

internal/models/app.go

@@ -14,7 +14,7 @@ import (
 const appColumns = `id, name, repo_url, branch, dockerfile_path, webhook_secret,
 			ssh_private_key, ssh_public_key, image_id, status,
 			docker_network, ntfy_topic, slack_webhook, webhook_secret_hash,
-			previous_image_id, created_at, updated_at`
+			created_at, updated_at`
 
 // AppStatus represents the status of an app.
 type AppStatus string
@@ -41,9 +41,8 @@ type App struct {
 	WebhookSecretHash string
 	SSHPrivateKey     string
 	SSHPublicKey   string
-	ImageID         sql.NullString
+	ImageID        sql.NullString
-	PreviousImageID sql.NullString
+	Status         AppStatus
-	Status          AppStatus
 	DockerNetwork  sql.NullString
 	NtfyTopic      sql.NullString
 	SlackWebhook   sql.NullString
@@ -141,15 +140,13 @@ func (a *App) insert(ctx context.Context) error {
 		INSERT INTO apps (
 			id, name, repo_url, branch, dockerfile_path, webhook_secret,
 			ssh_private_key, ssh_public_key, image_id, status,
-			docker_network, ntfy_topic, slack_webhook, webhook_secret_hash,
+			docker_network, ntfy_topic, slack_webhook, webhook_secret_hash
-			previous_image_id
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
-		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
 
 	_, err := a.db.Exec(ctx, query,
 		a.ID, a.Name, a.RepoURL, a.Branch, a.DockerfilePath, a.WebhookSecret,
 		a.SSHPrivateKey, a.SSHPublicKey, a.ImageID, a.Status,
 		a.DockerNetwork, a.NtfyTopic, a.SlackWebhook, a.WebhookSecretHash,
-		a.PreviousImageID,
 	)
 	if err != nil {
 		return err
@@ -164,7 +161,6 @@ func (a *App) update(ctx context.Context) error {
 			name = ?, repo_url = ?, branch = ?, dockerfile_path = ?,
 			image_id = ?, status = ?,
 			docker_network = ?, ntfy_topic = ?, slack_webhook = ?,
-			previous_image_id = ?,
 			updated_at = CURRENT_TIMESTAMP
 		WHERE id = ?`
 
@@ -172,7 +168,6 @@ func (a *App) update(ctx context.Context) error {
 		a.Name, a.RepoURL, a.Branch, a.DockerfilePath,
 		a.ImageID, a.Status,
 		a.DockerNetwork, a.NtfyTopic, a.SlackWebhook,
-		a.PreviousImageID,
 		a.ID,
 	)
 
@@ -187,7 +182,6 @@ func (a *App) scan(row *sql.Row) error {
 		&a.ImageID, &a.Status,
 		&a.DockerNetwork, &a.NtfyTopic, &a.SlackWebhook,
 		&a.WebhookSecretHash,
-		&a.PreviousImageID,
 		&a.CreatedAt, &a.UpdatedAt,
 	)
 }
@@ -205,7 +199,6 @@ func scanApps(appDB *database.Database, rows *sql.Rows) ([]*App, error) {
 			&app.ImageID, &app.Status,
 			&app.DockerNetwork, &app.NtfyTopic, &app.SlackWebhook,
 			&app.WebhookSecretHash,
-			&app.PreviousImageID,
 			&app.CreatedAt, &app.UpdatedAt,
 		)
 		if scanErr != nil {

internal/server/routes.go

@@ -76,7 +76,6 @@ func (s *Server) SetupRoutes() {
 		r.Get("/apps/{id}/container-logs", s.handlers.HandleContainerLogsAPI())
 		r.Get("/apps/{id}/status", s.handlers.HandleAppStatusAPI())
 		r.Get("/apps/{id}/recent-deployments", s.handlers.HandleRecentDeploymentsAPI())
-		r.Post("/apps/{id}/rollback", s.handlers.HandleAppRollback())
 		r.Post("/apps/{id}/restart", s.handlers.HandleAppRestart())
 		r.Post("/apps/{id}/stop", s.handlers.HandleAppStop())
 		r.Post("/apps/{id}/start", s.handlers.HandleAppStart())
@@ -99,6 +98,26 @@ func (s *Server) SetupRoutes() {
 		})
 	})
 
+	// API v1 routes (cookie-based session auth, no CSRF)
+	s.router.Route("/api/v1", func(r chi.Router) {
+		// Login endpoint is public (returns session cookie)
+		r.With(s.mw.LoginRateLimit()).Post("/login", s.handlers.HandleAPILoginPOST())
+
+		// All other API routes require session auth
+		r.Group(func(r chi.Router) {
+			r.Use(s.mw.APISessionAuth())
+
+			r.Get("/whoami", s.handlers.HandleAPIWhoAmI())
+
+			r.Get("/apps", s.handlers.HandleAPIListApps())
+			r.Post("/apps", s.handlers.HandleAPICreateApp())
+			r.Get("/apps/{id}", s.handlers.HandleAPIGetApp())
+			r.Delete("/apps/{id}", s.handlers.HandleAPIDeleteApp())
+			r.Post("/apps/{id}/deploy", s.handlers.HandleAPITriggerDeploy())
+			r.Get("/apps/{id}/deployments", s.handlers.HandleAPIListDeployments())
+		})
+	})
+
 	// Metrics endpoint (optional, with basic auth)
 	if s.params.Config.MetricsUsername != "" {
 		s.router.Group(func(r chi.Router) {

internal/service/deploy/deploy.go

@@ -49,8 +49,6 @@ var (
 	ErrBuildTimeout = errors.New("build timeout exceeded")
 	// ErrDeployTimeout indicates the deploy phase exceeded the timeout.
 	ErrDeployTimeout = errors.New("deploy timeout exceeded")
-	// ErrNoPreviousImage indicates there is no previous image to rollback to.
-	ErrNoPreviousImage = errors.New("no previous image available for rollback")
 )
 
 // logFlushInterval is how often to flush buffered logs to the database.
@@ -361,107 +359,6 @@ func (svc *Service) Deploy(
 	return svc.runBuildAndDeploy(deployCtx, bgCtx, app, deployment)
 }
 
-// Rollback rolls back an app to its previous image.
-// It stops the current container, starts a new one with the previous image,
-// and creates a deployment record for the rollback.
-func (svc *Service) Rollback(ctx context.Context, app *models.App) error {
-	if !app.PreviousImageID.Valid || app.PreviousImageID.String == "" {
-		return ErrNoPreviousImage
-	}
-
-	// Acquire per-app deployment lock
-	if !svc.tryLockApp(app.ID) {
-		return ErrDeploymentInProgress
-	}
-	defer svc.unlockApp(app.ID)
-
-	bgCtx := context.WithoutCancel(ctx)
-
-	deployment, err := svc.createRollbackDeployment(bgCtx, app)
-	if err != nil {
-		return err
-	}
-
-	return svc.executeRollback(ctx, bgCtx, app, deployment)
-}
-
-// createRollbackDeployment creates a deployment record for a rollback operation.
-func (svc *Service) createRollbackDeployment(
-	ctx context.Context,
-	app *models.App,
-) (*models.Deployment, error) {
-	deployment := models.NewDeployment(svc.db)
-	deployment.AppID = app.ID
-	deployment.Status = models.DeploymentStatusDeploying
-	deployment.ImageID = sql.NullString{String: app.PreviousImageID.String, Valid: true}
-
-	saveErr := deployment.Save(ctx)
-	if saveErr != nil {
-		return nil, fmt.Errorf("failed to create rollback deployment: %w", saveErr)
-	}
-
-	_ = deployment.AppendLog(ctx, "Rolling back to previous image: "+app.PreviousImageID.String)
-
-	return deployment, nil
-}
-
-// executeRollback performs the container swap for a rollback.
-func (svc *Service) executeRollback(
-	ctx context.Context,
-	bgCtx context.Context,
-	app *models.App,
-	deployment *models.Deployment,
-) error {
-	previousImageID := app.PreviousImageID.String
-
-	svc.removeOldContainer(ctx, app, deployment)
-
-	rollbackOpts, err := svc.buildContainerOptions(ctx, app, deployment.ID)
-	if err != nil {
-		svc.failDeployment(bgCtx, app, deployment, err)
-
-		return fmt.Errorf("failed to build container options: %w", err)
-	}
-
-	rollbackOpts.Image = previousImageID
-
-	containerID, err := svc.docker.CreateContainer(ctx, rollbackOpts)
-	if err != nil {
-		svc.failDeployment(bgCtx, app, deployment, fmt.Errorf("failed to create rollback container: %w", err))
-
-		return fmt.Errorf("failed to create rollback container: %w", err)
-	}
-
-	deployment.ContainerID = sql.NullString{String: containerID, Valid: true}
-	_ = deployment.AppendLog(bgCtx, "Rollback container created: "+containerID)
-
-	startErr := svc.docker.StartContainer(ctx, containerID)
-	if startErr != nil {
-		svc.failDeployment(bgCtx, app, deployment, fmt.Errorf("failed to start rollback container: %w", startErr))
-
-		return fmt.Errorf("failed to start rollback container: %w", startErr)
-	}
-
-	_ = deployment.AppendLog(bgCtx, "Rollback container started")
-
-	currentImageID := app.ImageID
-	app.ImageID = sql.NullString{String: previousImageID, Valid: true}
-	app.PreviousImageID = currentImageID
-	app.Status = models.AppStatusRunning
-
-	saveErr := app.Save(bgCtx)
-	if saveErr != nil {
-		return fmt.Errorf("failed to update app after rollback: %w", saveErr)
-	}
-
-	_ = deployment.MarkFinished(bgCtx, models.DeploymentStatusSuccess)
-	_ = deployment.AppendLog(bgCtx, "Rollback complete")
-
-	svc.log.Info("rollback completed", "app", app.Name, "image", previousImageID)
-
-	return nil
-}
-
 // runBuildAndDeploy executes the build and deploy phases, handling cancellation.
 func (svc *Service) runBuildAndDeploy(
 	deployCtx context.Context,
@@ -493,11 +390,6 @@ func (svc *Service) runBuildAndDeploy(
 		return err
 	}
 
-	// Save current image as previous before updating to new one
-	if app.ImageID.Valid && app.ImageID.String != "" {
-		app.PreviousImageID = app.ImageID
-	}
-
 	err = svc.updateAppRunning(bgCtx, app, imageID)
 	if err != nil {
 		return err

static/css/input.css

@@ -57,10 +57,6 @@
     @apply inline-flex items-center justify-center px-4 py-2 rounded-md font-medium text-sm transition-all duration-200 focus:outline-none focus:ring-2 focus:ring-offset-2 disabled:opacity-50 disabled:cursor-not-allowed bg-success-500 text-white hover:bg-success-700 active:bg-green-800 focus:ring-green-500 shadow-elevation-1 hover:shadow-elevation-2;
   }
 
-  .btn-warning {
-    @apply inline-flex items-center justify-center px-4 py-2 rounded-md font-medium text-sm transition-all duration-200 focus:outline-none focus:ring-2 focus:ring-offset-2 disabled:opacity-50 disabled:cursor-not-allowed bg-warning-500 text-white hover:bg-warning-700 active:bg-orange-800 focus:ring-orange-500 shadow-elevation-1 hover:shadow-elevation-2;
-  }
-
   .btn-text {
     @apply inline-flex items-center justify-center px-4 py-2 rounded-md font-medium text-sm transition-all duration-200 focus:outline-none focus:ring-2 focus:ring-offset-2 disabled:opacity-50 disabled:cursor-not-allowed text-primary-600 hover:bg-primary-50 active:bg-primary-100;
   }

templates/app_detail.html

@@ -44,12 +44,6 @@
                 {{ .CSRFField }}
                 <button type="submit" class="btn-danger">Cancel Deploy</button>
             </form>
-            {{if .App.PreviousImageID.Valid}}
-            <form method="POST" action="/apps/{{.App.ID}}/rollback" class="inline" x-data="confirmAction('Roll back to the previous deployment?')" @submit="confirm($event)">
-                {{ .CSRFField }}
-                <button type="submit" class="btn-warning">Rollback</button>
-            </form>
-            {{end}}
         </div>
     </div>