MVP frontend+backend

backend/app/main.py

@@ -5,17 +5,19 @@ routers, locks CORS to the configured frontend origin(s), and attaches a
 rate-limiter to the app (applied per-endpoint via decorators).
 """
 
+import asyncio
+import logging
 from contextlib import asynccontextmanager
 from collections.abc import AsyncIterator
 
-from fastapi import FastAPI
+from fastapi import FastAPI, Request
 from fastapi.middleware.cors import CORSMiddleware
-from slowapi import Limiter, _rate_limit_exceeded_handler
+from slowapi import _rate_limit_exceeded_handler
 from slowapi.errors import RateLimitExceeded
-from slowapi.util import get_remote_address
 
 from app.config import settings
 from app.db.connection import connect, run_migrations
+from app.rate_limit import limiter
 from app.routers import vacation_days
 from app.routers.analytics import router as analytics_router
 from app.routers.auth import router as auth_router
@@ -26,18 +28,43 @@ from app.routers.settings import break_router, child_router, settings_child_rout
 from app.routers.workspace import _inv_router as invitations_router
 from app.routers.workspace import router as workspace_router
 
-limiter = Limiter(key_func=get_remote_address)
+logger = logging.getLogger(__name__)
+
+
+def _configure_logging() -> None:
+    level = logging.getLevelName(settings.log_level.upper())
+
+    handler = logging.StreamHandler()
+    handler.setLevel(level)
+    handler.setFormatter(logging.Formatter("%(levelname)s %(name)s %(message)s"))
+
+    app_logger = logging.getLogger("app")
+    app_logger.handlers.clear()
+    app_logger.addHandler(handler)
+    app_logger.setLevel(level)
+    app_logger.propagate = False
+    app_logger.disabled = False
+
+    for name, log in logging.Logger.manager.loggerDict.items():
+        if (name == "app" or name.startswith("app.")) and isinstance(log, logging.Logger):
+            log.disabled = False
 
 
 @asynccontextmanager
 async def lifespan(app: FastAPI) -> AsyncIterator[None]:
-    # Run pending migrations before accepting requests (dev convenience).
-    # In production, run `alembic upgrade head` as a separate deploy step.
+    _configure_logging()
+
     if settings.database_type == "sqlite":
         try:
-            run_migrations(f"sqlite:///{settings.sqlite_path}")
-        except Exception:
-            pass  # migrations may fail in test envs without alembic installed
+            await asyncio.to_thread(run_migrations, f"sqlite:///{settings.sqlite_path}")
+        except Exception as exc:
+            logger.error("Migration failed — DB schema may be incomplete: %s", exc, exc_info=True)
+
+    # Re-enable after migrations: alembic's env.py calls fileConfig() which may
+    # still touch logger state even with disable_existing_loggers=False.
+    for name, log in logging.Logger.manager.loggerDict.items():
+        if (name == "app" or name.startswith("app.")) and isinstance(log, logging.Logger):
+            log.disabled = False
 
     app.state.db_connection = await connect(settings.sqlite_path)
     try:
@@ -52,6 +79,13 @@ def create_app() -> FastAPI:
     app.state.limiter = limiter
     app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
 
+    @app.middleware("http")
+    async def log_error_responses(request: Request, call_next):
+        response = await call_next(request)
+        if response.status_code >= 400:
+            logger.warning("%s %s %d", request.method, request.url.path, response.status_code)
+        return response
+
     app.add_middleware(
         CORSMiddleware,
         allow_origins=list(settings.cors_origins),