[g-eoj]

Demo gateway: invite links and sessions

Adds gateway/, a FastAPI app on Modal that gates demos behind signed invite links.

• Operator creates an invite with modal run invites.py::create. The record lives in a Modal Dict; the link carries a signed {iid, exp} token.
• Redeeming the link checks the signature and the Dict record, then sets a signed session cookie capped at 8 hours or the invite's expiry, whichever is sooner.
• Every gated route re-reads the invite from the Dict, so revoke takes effect on the next request.
• CI runs ruff, mypy, and pytest on PRs and deploys on push to main. The container installs from uv.lock.

sequenceDiagram
    participant Op as Operator (CLI)
    participant D as Modal Dict
    participant G as Guest
    participant W as Gateway

    Op->>D: put invite:{iid} {expires, revoked, budget}
    Op-->>Op: sign_invite({iid, exp}) → /i/<token>

    G->>W: GET /i/<token>
    W->>W: verify_invite (signature + exp)
    W->>D: get invite:{iid}
    W->>W: is_invite_valid (revoked, expires)
    W-->>G: 303 /menu + Set-Cookie session (signed {iid, sid, exp})

    G->>W: GET /menu (cookie)
    W->>W: read_session (signature + exp)
    W->>D: get invite:{iid}
    W->>W: is_invite_valid
    W-->>G: 200 menu

    Op->>D: revoke: revoked = true
    G->>W: GET /menu (cookie)
    W->>D: get invite:{iid}
    W-->>G: 303 /expired

Loading