feat: Supabase login gate + persistent resume + generated LaTeX storage

- Login page (email/password via Supabase Auth) gates the entire app
- Resume PDF backed up to Supabase Storage on upload; restored on restart
- Generated LaTeX saved to generated_resumes table after each run
- Logout button in header clears session
- src/supabase_client.py: lazy singleton clients + get_owner_user_id()
- supabase>=2.3.0 added to requirements.txt

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

HISTORY.md

@@ -4,6 +4,37 @@ A running log of everything built, fixed, and changed. Most recent first.
 
 ---
 
+## 2026-06-23 (PM8) — Supabase integration: login gate + persistent storage
+
+Added Supabase (PostgreSQL + Auth + Storage) as the persistent backend.
+HF Spaces has an ephemeral filesystem — every restart wiped job history,
+candidate vault, uploaded resumes, and generated LaTeX files. Supabase fixes all of this.
+
+**New file: `src/supabase_client.py`**
+Lazy singleton clients (`get_anon_client`, `get_service_client`) and a
+`get_owner_user_id()` helper that uses the service_role admin API to look up the
+single owner user's UUID (cached after first call).
+
+**Login gate (`ui.py`)**
+The entire app is now behind email/password auth via Supabase Auth. A centered
+sign-in form renders if `st.session_state["logged_in"]` is `False` and calls
+`supabase.auth.sign_in_with_password()`. On success, `user_id` and `user_email`
+are stored in session state. A sign-out button appears in the header.
+
+**Resume PDF persistence (`ui.py`)**
+- On upload: saved to Supabase Storage bucket `resumes/{user_id}/resume.pdf`
+  (upsert so re-uploads overwrite).
+- On startup: if `data/resume/resume.pdf` is missing (post-restart), it is
+  automatically restored from Supabase Storage before the app renders.
+
+**Generated resume persistence (`api_server.py`)**
+After each successful LaTeX generation, the `.tex` source, job title, company,
+and ATS score are inserted into the `generated_resumes` Supabase table. Non-fatal.
+
+**`requirements.txt`**: added `supabase>=2.3.0`.
+
+---
+
 ## 2026-06-23 (PM7) — LaTeX resume upload support
 
 Resume upload page now accepts `.tex` files in addition to PDF. When a `.tex` file is

api_server.py

@@ -310,6 +310,21 @@ async def _generate_from_latex(
         print(f"[api/generate:latex] max_ats={max_ats} status={status} "
               f"external_cov={pct}% compiled={payload['latex_compiled']} "
               f"engine={payload['latex_engine']} injected={len(payload['injected_terms'])}")
+        # Persist generated resume to Supabase so it survives HF Space restarts
+        try:
+            from src.supabase_client import get_service_client, is_configured, get_owner_user_id
+            if is_configured() and tex_src:
+                uid = get_owner_user_id()
+                if uid:
+                    get_service_client().table("generated_resumes").insert({
+                        "job_title": job_title,
+                        "company": company,
+                        "tex_source": tex_src,
+                        "ats_score": pct,
+                        "user_id": uid,
+                    }).execute()
+        except Exception as _sb_exc:
+            print(f"[api/generate:latex] supabase save failed (non-fatal): {_sb_exc}")
         return JSONResponse(payload)
     except Exception as exc:
         return JSONResponse(

requirements.txt

@@ -52,3 +52,6 @@ fastapi>=0.111.0
 uvicorn[standard]>=0.29.0
 websockets>=12.0
 python-multipart>=0.0.9
+
+# Database + Auth (persistent storage across HF Space restarts)
+supabase>=2.3.0

src/supabase_client.py

@@ -0,0 +1,57 @@
+"""
+Supabase singleton clients.
+
+Two clients:
+  get_anon_client()     — anon key, used for user-facing auth (sign in/out)
+  get_service_client()  — service_role key, used server-side for DB + Storage
+                          (bypasses RLS, never expose to the browser)
+
+get_owner_user_id()   — returns the single owner user's UUID (single-user app).
+                        Cached after first call.
+"""
+import os
+
+SUPABASE_URL             = os.getenv("SUPABASE_URL", "")
+SUPABASE_ANON_KEY        = os.getenv("SUPABASE_ANON_KEY", "")
+SUPABASE_SERVICE_ROLE_KEY = os.getenv("SUPABASE_SERVICE_ROLE_KEY", "")
+
+_anon_client    = None
+_service_client = None
+_owner_user_id  = None   # cached after first admin lookup
+
+
+def is_configured() -> bool:
+    return bool(SUPABASE_URL and SUPABASE_ANON_KEY)
+
+
+def get_anon_client():
+    global _anon_client
+    if _anon_client is None:
+        from supabase import create_client
+        _anon_client = create_client(SUPABASE_URL, SUPABASE_ANON_KEY)
+    return _anon_client
+
+
+def get_service_client():
+    global _service_client
+    if _service_client is None:
+        from supabase import create_client
+        _service_client = create_client(SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY)
+    return _service_client
+
+
+def get_owner_user_id() -> str | None:
+    """Return the single owner user's UUID. Cached after first successful lookup."""
+    global _owner_user_id
+    if _owner_user_id:
+        return _owner_user_id
+    try:
+        sb = get_service_client()
+        result = sb.auth.admin.list_users()
+        users = result if isinstance(result, list) else getattr(result, "users", [])
+        if users:
+            _owner_user_id = users[0].id
+            return _owner_user_id
+    except Exception:
+        pass
+    return None

ui.py

@@ -639,6 +639,7 @@ _DEFAULTS = {
     "setup_step": 1,
     "completed_jobs": [],   # per-job results streamed in during a run
     "custom_roles": [],     # user-added custom role titles
+    "logged_in": False, "user_id": None, "user_email": "",
 }
 for _k, _v in _DEFAULTS.items():
     if _k not in st.session_state:
@@ -656,6 +657,25 @@ if not st.session_state.get("_hf_synced"):
         pass
     st.session_state["_hf_synced"] = True
 
+# ── Restore uploaded resume from Supabase Storage (survives HF restarts) ──────
+if not st.session_state.get("_sb_resume_synced"):
+    st.session_state["_sb_resume_synced"] = True
+    if not os.path.exists("data/resume/resume.pdf"):
+        try:
+            from src.supabase_client import get_service_client, is_configured, get_owner_user_id
+            if is_configured():
+                uid = get_owner_user_id()
+                if uid:
+                    pdf_data = get_service_client().storage.from_("resumes").download(
+                        f"{uid}/resume.pdf"
+                    )
+                    if pdf_data:
+                        os.makedirs("data/resume", exist_ok=True)
+                        with open("data/resume/resume.pdf", "wb") as _f:
+                            _f.write(pdf_data)
+        except Exception:
+            pass
+
 # ── Shared progress queue ────────────────────────────────────────────────────
 if "progress_q" not in st.session_state:
     st.session_state["progress_q"] = queue.Queue()
@@ -923,6 +943,51 @@ def _readiness_level(pct):
     return ("Getting Started", False)
 
 
+# ══════════════════════════════════════════════════════════════════════════════
+# AUTH — Login gate
+# ══════════════════════════════════════════════════════════════════════════════
+def _render_login_page():
+    from src.supabase_client import is_configured, get_anon_client
+    _, col, _ = st.columns([1, 1.4, 1])
+    with col:
+        st.markdown("""
+<div style="text-align:center;padding:48px 0 28px">
+  <div style="font-size:2.8rem;line-height:1">🤖</div>
+  <h2 style="font-size:1.35rem;font-weight:700;color:#0F172A;margin:10px 0 4px">JAA · ATS Tool</h2>
+  <p style="font-size:0.84rem;color:#64748B;margin:0">Sign in to continue</p>
+</div>""", unsafe_allow_html=True)
+        if not is_configured():
+            st.error("Supabase not configured. Add SUPABASE_URL and SUPABASE_ANON_KEY in HF Space → Settings → Secrets.")
+            return
+        with st.form("login_form", clear_on_submit=False):
+            email    = st.text_input("Email", placeholder="you@example.com")
+            password = st.text_input("Password", type="password", placeholder="••••••••")
+            submitted = st.form_submit_button("Sign in", use_container_width=True)
+        if submitted:
+            if not email or not password:
+                st.error("Enter your email and password.")
+                return
+            try:
+                resp = get_anon_client().auth.sign_in_with_password(
+                    {"email": email, "password": password}
+                )
+                st.session_state["logged_in"]   = True
+                st.session_state["user_id"]     = resp.user.id
+                st.session_state["user_email"]  = resp.user.email
+                st.rerun()
+            except Exception as exc:
+                msg = str(exc).lower()
+                if "invalid" in msg or "credentials" in msg or "login" in msg:
+                    st.error("Incorrect email or password.")
+                else:
+                    st.error(f"Login failed: {exc}")
+
+
+if not st.session_state.get("logged_in"):
+    _render_login_page()
+    st.stop()
+
+
 # ══════════════════════════════════════════════════════════════════════════════
 # HEADER
 # ══════════════════════════════════════════════════════════════════════════════
@@ -987,6 +1052,16 @@ with hdr_r:
     if st.button(hist_label, use_container_width=True):
         st.session_state.show_history = not st.session_state.show_history
         st.rerun()
+    _email_short = (st.session_state.get("user_email") or "").split("@")[0]
+    if st.button(f"⏻ {_email_short or 'Sign out'}", use_container_width=True, help="Sign out"):
+        try:
+            from src.supabase_client import get_anon_client
+            get_anon_client().auth.sign_out()
+        except Exception:
+            pass
+        for _k in ("logged_in", "user_id", "user_email"):
+            st.session_state[_k] = False if _k == "logged_in" else None
+        st.rerun()
 
 
 # ══════════════════════════════════════════════════════════════════════════════
@@ -1208,6 +1283,19 @@ if show_config:
                         with open("data/resume/resume.pdf", "wb") as f:
                             f.write(resume_file.getvalue())
                     st.session_state["_uploaded_sig"] = _sig
+                    # Persist to Supabase Storage so it survives HF Space restarts
+                    try:
+                        from src.supabase_client import get_service_client, is_configured, get_owner_user_id
+                        if is_configured():
+                            _uid = st.session_state.get("user_id") or get_owner_user_id()
+                            if _uid:
+                                with open("data/resume/resume.pdf", "rb") as _rf:
+                                    get_service_client().storage.from_("resumes").upload(
+                                        f"{_uid}/resume.pdf", _rf.read(),
+                                        {"upsert": "true", "content-type": "application/pdf"},
+                                    )
+                    except Exception:
+                        pass
                     # Invalidate the parsed-profile cache so it re-parses the
                     # NEW file (cache is keyed by mtime+size, but delete to be safe)
                     try: