test(unit): add roles, web deps, use cases, VO boundary tests — reach 70% coverage

- test_post_deletion.py: user delete own, admin delete any, 403 for other's
- test_pagination.py: navigation across pages, boundary on last page
- test_errors.py: 404 nonexistent post, 404 for other user's draft
- test_post_lifecycle.py: draft-to-publish via edit flow
- test_post_ownership.py: user can edit own post
- test_profile_and_theme.py: profile page rendering, theme toggle with localStorage
- fix(web): remove infinite pagination for USER role (routes.py)
- fix(e2e): stabilize all publish() calls with expect_navigation
- fix(e2e): add _unique_title() to avoid slug collisions at scale
- docs: update FEATURE_POST_LIFECYCLE.md and TEST_MODEL.md coverage

.env.example

@@ -0,0 +1,33 @@
+# Environment mode: dev or prod
+ENVIRONMENT=dev
+
+# App settings
+APP_NAME=Blog API
+APP_DEBUG=false
+APP_HOST=0.0.0.0
+APP_PORT=8000
+
+# Database settings
+# For dev (SQLite): DB_URL=sqlite+aiosqlite:///./blog.db
+# For prod (PostgreSQL): DB_URL=postgresql+asyncpg://user:pass@host:port/db
+# Or use individual DB_* vars for prod (see below)
+DB_URL=
+DB_ECHO=false
+
+# PostgreSQL-specific settings (used in prod when DB_URL is not set)
+DB_HOST=localhost
+DB_PORT=5432
+DB_USER=postgres
+DB_PASSWORD=postgres
+DB_NAME=blog
+
+# Security settings (REQUIRED)
+SECURITY_SECRET_KEY=your-secret-key-here-change-in-production
+SECURITY_ACCESS_TOKEN_EXPIRE_MINUTES=30
+
+# Keycloak settings (REQUIRED for authentication)
+KC_SERVER_URL=http://localhost:8080
+KC_REALM=blog
+KC_CLIENT_ID=blog-api
+KC_CLIENT_SECRET=your-keycloak-client-secret-here
+KC_TOKEN_CACHE_TTL=60

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,30 +0,0 @@
-## Description
-<!-- Brief description of changes -->
-
-## Type of Change
-<!-- Mark with [x] -->
-- [ ] 🚀 Feature (`feat`)
-- [ ] 🐛 Bug Fix (`fix`)
-- [ ] 📝 Documentation (`docs`)
-- [ ] ♻️ Refactor (`refactor`)
-- [ ] 🎨 Code Style (`style`)
-- [ ] ✅ Tests (`test`)
-- [ ] 🔧 Chore (`chore`)
-
-## Checklist
-- [ ] Code follows project style guidelines (ruff, isort)
-- [ ] Tests added/updated (if applicable)
-- [ ] Documentation updated (if applicable)
-- [ ] Commit message follows convention (`type: description`)
-- [ ] Branch rebased to single commit before merge
-- [ ] No cache files in commit (`__pycache__`, `*.pyc`)
-
-## Testing
-<!-- Describe how changes were tested -->
-
-## Related Issues
-<!-- Link to issues if applicable -->
-Fixes #
-
-## Screenshots (if applicable)
-<!-- Add screenshots for UI changes -->

.gitignore

@@ -8,14 +8,6 @@ site/
 *.pyc
 *.pyo
 
-# opencode skills (agent-only)
-.opencode/
-AGENTS.md
-.github/
-
-# Scripts (except hooks)
-scripts/
-
 # IDE
 .idea/
 .vscode/
@@ -36,13 +28,9 @@ htmlcov/
 
 # Environment
 .env
-.env.example
 .venv/
 venv/
 
 # uv cache
 .uv/
-
+blog.db
-# Scripts cache
-scripts/__pycache__/
-

.woodpecker/comment_pr.yaml

@@ -1,24 +0,0 @@
-when:
-      event: [push, pull_request]
-
-steps:
-  - name: comment
-    image: mcs94/gitea-comment
-    settings:
-      gitea_address: https://git.pyaqa.ru
-      gitea_token:
-        from_secret: gitea_token
-      comment: >
-        ✅ Build ${CI_BUILD_EVENT} of `${CI_REPO_NAME}` has status `${CI_BUILD_STATUS}`.
-
-        📝 Commit by ${CI_COMMIT_AUTHOR} on `${CI_COMMIT_BRANCH}`:
-
-        `${CI_COMMIT_MESSAGE}`
-
-        🌐 ${CI_BUILD_LINK}
-
-depends_on:
-  - lint
-  - type
-  - test
-

.woodpecker/lint.yaml

@@ -1,14 +0,0 @@
-when:
-  - event: [push, pull_request]
-    branch: dev
-
-steps:
-  - name: lint
-    image: python:3.11
-    commands:
-      - pip install uv
-      - uv sync --no-dev --only-group lints
-      - uv run black --check .
-      - uv run ruff check .
-      - uv run isort --check-only .
-

.woodpecker/pipeline.yml

@@ -0,0 +1,89 @@
+when:
+  event: [push, pull_request]
+  branch: [dev, main, master]
+
+steps:
+  - name: deps
+    image: python:3.13
+    volumes:
+      - /tmp/uv-cache:/root/.cache/uv
+    environment:
+      UV_CACHE_DIR: /root/.cache/uv
+      UV_LINK_MODE: copy
+      UV_PYTHON: "3.13"
+    commands:
+      - pip install uv
+      - cd ..
+      - |
+        cat > pyproject.toml << 'EOF'
+        [project]
+        name = "pyaqa"
+        version = "0.1.0"
+        requires-python = ">=3.13"
+        dependencies = []
+
+        [tool.uv.workspace]
+        members = ["blog.pyaqa.ru", "pytfm"]
+        EOF
+      - git clone https://git.pyaqa.ru/pi3c/pytfm.git
+      - cd $CI_WORKSPACE
+      - rm -rf .venv
+      - uv sync --group lints --group tests --group types --group dev
+
+  - name: lint
+    image: python:3.13
+    volumes:
+      - /tmp/uv-cache:/root/.cache/uv
+    environment:
+      UV_CACHE_DIR: /root/.cache/uv
+      UV_LINK_MODE: copy
+      UV_PYTHON: "3.13"
+    depends_on: [deps]
+    commands:
+      - pip install uv
+      - uv run --no-sync ruff check .
+      - uv run --no-sync ruff format --check .
+      - uv run --no-sync isort --check-only .
+
+  - name: type
+    image: python:3.13
+    volumes:
+      - /tmp/uv-cache:/root/.cache/uv
+    environment:
+      UV_CACHE_DIR: /root/.cache/uv
+      UV_LINK_MODE: copy
+      UV_PYTHON: "3.13"
+    depends_on: [deps]
+    commands:
+      - pip install uv
+      - uv run --no-sync mypy .
+
+  - name: test-unit
+    image: python:3.13
+    volumes:
+      - /tmp/uv-cache:/root/.cache/uv
+    environment:
+      UV_CACHE_DIR: /root/.cache/uv
+      UV_LINK_MODE: copy
+      UV_PYTHON: "3.13"
+    depends_on: [deps]
+    commands:
+      - pip install uv
+      - uv run --no-sync pytest tests/unit/
+
+  - name: test-e2e
+    image: python:3.13
+    volumes:
+      - /tmp/uv-cache:/root/.cache/uv
+    environment:
+      UV_CACHE_DIR: /root/.cache/uv
+      UV_LINK_MODE: copy
+      UV_PYTHON: "3.13"
+    depends_on: [deps]
+    commands:
+      - pip install uv
+      - apt-get update && apt-get install -y libnss3 libnspr4 libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 libxkbcommon0 libxcomposite1 libxdamage1 libxfixes3 libxrandr2 libgbm1 libasound2
+      - uv run --no-sync playwright install chromium
+      - uv run --no-sync blog &
+      - sleep 5
+      - uv run --no-sync pytest tests/e2e/ -v --no-cov

.woodpecker/test.yaml

@@ -1,11 +0,0 @@
-when:
-  - event: [push, pull_request]
-    branch: dev
-
-steps:
-  - name: test
-    image: python:3.11
-    commands:
-      - pip install uv
-      - uv sync --no-dev --group tests
-      - uv run pytest --cov=app --cov-fail-under=70 --cov-report=term-missing

.woodpecker/type.yaml

@@ -1,11 +0,0 @@
-when:
-  - event: [push, pull_request]
-    branch: dev
-
-steps:
-  - name: type
-    image: python:3.11
-    commands:
-      - pip install uv
-      - uv sync --no-dev --only-group types
-      - uv run mypy .

AGENTS.md

@@ -0,0 +1,524 @@
+# Blog AGENTS.md
+
+**Generated:** 2026-05-03 22:15 UTC  
+**Commit:** 41f2a3d  
+**Branch:** feature/tests
+
+## Stack
+- Python 3.13+, FastAPI, pydantic, uvicorn
+- SQLAlchemy 2.0 (async), aiosqlite
+- Package manager: `uv`
+- CI: Woodpecker (lint, test, type on push/PR to `dev`)
+
+## Commands
+```bash
+uv sync --group dev         # Install all dev dependencies
+uv run pytest               # Run tests (coverage >= 70% required)
+uv run pytest tests/unit/   # Run single test directory
+uv run ruff check . --fix   # Lint
+uv run ruff format          # Format
+uv run isort .              # Sort imports
+uv run mypy .               # Type check (strict mode)
+uv run blog                 # Start dev server (port 8000)
+```
+
+## Pre-commit order
+`ruff check --fix` → `ruff format` → `isort` → `mypy`
+
+## DDD Architecture
+
+### Layer Structure
+```
+app/
+├── domain/                   # Domain Layer - business logic, no dependencies
+│   ├── entities/            # Domain entities (Post, User, etc.)
+│   │   ├── base.py          # Base entity class
+│   │   └── post.py          # Post entity with business logic
+│   ├── value_objects/       # Value objects (Title, Content, Slug)
+│   │   ├── base.py
+│   │   ├── title.py
+│   │   ├── content.py
+│   │   └── slug.py
+│   ├── repositories/        # Repository interfaces (abstract)
+│   │   ├── base.py
+│   │   └── post.py
+│   └── exceptions.py        # Domain exceptions
+│
+├── application/             # Application Layer - use cases
+│   ├── dtos/               # Data Transfer Objects
+│   │   └── post.py
+│   ├── interfaces/         # Abstract interfaces (UoW)
+│   │   └── unit_of_work.py
+│   └── use_cases/          # Use cases (CQRS-like)
+│       ├── create_post.py
+│       ├── get_post.py
+│       ├── update_post.py
+│       ├── delete_post.py
+│       ├── list_posts.py
+│       └── publish_post.py
+│
+├── infrastructure/          # Infrastructure Layer - external concerns
+│   ├── config/             # Configuration
+│   │   └── settings.py
+│   ├── database/           # Database connection & ORM models
+│   │   ├── connection.py
+│   │   └── models.py
+│   ├── repositories/       # Repository implementations
+│   │   ├── post.py         # SQLAlchemyPostRepository
+│   │   └── unit_of_work.py # SQLAlchemyUnitOfWork
+│   ├── di/                 # Dependency Injection
+│   │   └── container.py
+│   └── middleware/         # Exception handlers
+│       └── error_handler.py
+│
+├── presentation/            # Presentation Layer - API
+│   ├── api/                # FastAPI routes
+│   │   ├── v1/            # API version 1
+│   │   │   ├── __init__.py
+│   │   │   └── posts.py   # Posts endpoints
+│   │   ├── deps.py        # FastAPI dependencies
+│   │   └── __init__.py
+│   └── schemas/           # Pydantic schemas
+│       └── post.py
+│
+└── main.py                # Application entry point
+
+tests/
+├── unit/                  # Unit tests (domain, use cases)
+│   ├── domain/           # Domain layer tests
+│   ├── application/      # Application layer tests
+│   └── infrastructure/   # Infrastructure tests
+├── integration/          # Integration tests (DB, repos)
+├── api/                  # API endpoint tests
+└── e2e/                  # End-to-end tests
+```
+
+## Where to Look
+
+| Task | Location | Notes |
+|------|----------|-------|
+| Add a new use case | `app/application/use_cases/` | Follow naming: `{action}_post.py` |
+| Add a new API endpoint | `app/presentation/api/v1/posts.py` | Or create new module in `v1/` |
+| Add a new web page | `app/presentation/web/routes.py` | Integrate real use cases, not mocks |
+| Add a domain entity | `app/domain/entities/` | Inherit from `BaseEntity`, add to `domain/__init__.py` |
+| Add a repository method | `app/infrastructure/repositories/post.py` | Mirror in `app/domain/repositories/post.py` |
+| Configure DI provider | `app/infrastructure/di/providers.py` | Add to existing provider class or create new one |
+| Change database schema | `app/infrastructure/database/models.py` | Mirror changes in domain entity |
+| Add/modify tests | `tests/unit/{layer}/` | Mirror `app/` structure exactly |
+| Run linting | `uv run ruff check . --fix` | Pre-commit: ruff → ruff format → isort → mypy |
+| Run tests | `uv run pytest` | Coverage auto-collected, HTML report at `htmlcov/` |
+| Run type check | `uv run mypy .` | Strict mode; excludes `tests/e2e` |
+
+## Code Map
+
+| Symbol | Type | Location | Refs | Role |
+|--------|------|----------|------|------|
+| `app_factory` | Function | `app/main.py:50` | 3 | FastAPI app factory with DI lifespan |
+| `SQLAlchemyPostRepository` | Class | `app/infrastructure/repositories/post.py:18` | 1 | Concrete repository implementation |
+| `Post` | Class | `app/domain/entities/post.py:17` | 1 | Core domain entity |
+| `PostRepository` | Class | `app/domain/repositories/post.py:13` | 1 | Repository interface |
+| `CreatePostUseCase` | Class | `app/application/use_cases/create_post.py:14` | 1 | Use case for creating posts |
+| `home` | Function | `app/presentation/web/routes.py:189` | 1 | Web home page route |
+| `create_post` | Function | `app/presentation/api/v1/posts.py:35` | 1 | API create post endpoint |
+
+## Key Conventions
+
+### Dependency Rule
+- Domain layer has **NO dependencies** on other layers
+- Application layer depends only on Domain
+- Infrastructure depends on Domain and Application
+- Presentation depends on all other layers
+
+### Testing
+- **Unit tests**: Test domain logic without DB/external services
+
+### Code Patterns
+- Use **dataclasses** for entities and value objects
+- Use **frozen dataclasses** for value objects (immutable)
+- Use **Unit of Work** pattern for transactions
+- Use **Repository** pattern for data access
+- Use **Dependency Injection** via FastAPI's Depends()
+
+## Anti-Patterns (This Project)
+
+- **NO inline comments** — Self-documenting code only; Google-style docstrings required
+- **NO type suppression** — Never use `typing.Any` casts or `# type: ignore` to bypass mypy strict mode
+- **Dead code**: `create_container()` in `app/infrastructure/di/container.py` is defined but never used; `main.py` calls `make_async_container()` directly
+- **Empty directories**: `app/domain/exceptions/` and `app/presentation/api/deps/` are empty dirs that co-exist with `.py` files of the same name — import ambiguity risk
+- **Missing `__main__.py`**: `python -m app` fails; use `uv run blog` or `python app/main.py`
+- **Stale config**: `pyproject.toml` excludes `tests/e2e` but the directory does not exist
+- **Unused dependency**: `black` is in `[dependency-groups] lints` but never invoked; ruff format is used instead
+- **Pre-commit excludes `__init__.py`**: All `__init__.py` files skip linting and import sorting
+
+## AI Code Generation Requirements
+
+### Documentation Standards
+- **Write self-documenting code** - use clear, descriptive variable names and function names
+- **NO inline comments** - code should be readable without explanatory comments
+- **Google-style docstrings** are REQUIRED for all modules, classes, and functions
+
+### Docstring Requirements
+
+#### Modules
+Every module must have a module-level docstring:
+```python
+"""Module for managing blog posts.
+
+This module provides use cases for creating, updating, and deleting
+blog posts in the application layer.
+"""
+```
+
+#### Classes
+Every class must have a detailed docstring:
+```python
+class CreatePostUseCase:
+    """Use case for creating a new blog post.
+
+    This class encapsulates the business logic for creating posts,
+    including validation and slug generation.
+
+    Attributes:
+        uow: Unit of Work for database transactions.
+        slug_service: Service for generating URL-friendly slugs.
+
+    Example:
+        >>> use_case = CreatePostUseCase(uow, slug_service)
+        >>> result = await use_case.execute(dto)
+    """
+```
+
+#### Functions/Methods
+Every function must have a detailed docstring with Args, Returns, Raises:
+```python
+async def execute(self, dto: CreatePostDTO) -> PostDTO:
+    """Execute the use case to create a new post.
+
+    Args:
+        dto: Data transfer object containing post creation data
+            including title, content, and author information.
+
+    Returns:
+        PostDTO: The created post data transfer object with
+            generated ID and slug.
+
+    Raises:
+        TitleValidationError: If the title is empty or too long.
+        ContentValidationError: If the content is empty.
+        DuplicateSlugError: If a post with the same slug exists.
+
+    Note:
+        This method is idempotent - calling it multiple times with
+        the same data will create separate posts with unique slugs.
+    """
+```
+
+### Google-Style Docstring Format
+
+Use the following sections as appropriate:
+- `Args` - Parameter descriptions with types
+- `Returns` - Return value description with type
+- `Raises` - Exceptions that may be raised
+- `Yields` - For generator functions
+- `Example` - Usage examples
+- `Note` - Additional important information
+- `Warning` - Critical warnings
+- `Attributes` - For class attributes
+- `See Also` - References to related code
+
+## UI Development Requirements
+
+### HTML Templates (Jinja2)
+- All HTML templates use **Jinja2** templating engine
+- Templates are located in `app/presentation/templates/`
+- Base template: `base.html` with theme support (light/dark)
+
+### data-testid Attributes (REQUIRED)
+**Every interactive and significant HTML element MUST have a `data-testid` attribute** for automated testing.
+
+#### Required Elements:
+- **Navigation**: `data-testid="nav-link-{name}"`, `data-testid="nav-logo"`
+- **Buttons**: `data-testid="btn-{action}"` (e.g., `btn-create`, `btn-save`, `btn-delete`)
+- **Forms**: `data-testid="form-{name}"`, `data-testid="input-{field}"`, `data-testid="submit-{action}"`
+- **Cards/Posts**: `data-testid="post-card-{id}"`, `data-testid="post-title"`, `data-testid="post-content"`
+- **Lists**: `data-testid="list-{name}"`, `data-testid="list-item-{index}"`
+- **Theme Switcher**: `data-testid="theme-toggle"`, `data-testid="theme-{light|dark}"`
+- **Messages/Alerts**: `data-testid="alert-{type}"`, `data-testid="alert-message"
+
+#### Example:
+```html
+<button data-testid="btn-create-post" class="btn btn-primary">
+    Create Post
+</button>
+
+<article data-testid="post-card-{{ post.id }}" class="card">
+    <h2 data-testid="post-title">{{ post.title }}</h2>
+    <p data-testid="post-content">{{ post.content }}</p>
+</article>
+```
+
+### CSS Architecture (Gitea-inspired)
+- **Theme files**: `static/css/themes/theme-{light|dark}.css` with CSS variables
+- **Base styles**: `static/css/base.css` - reset, typography, CSS variables usage
+- **Components**: `static/css/components.css` - buttons, cards, forms, inputs
+- **Layout**: `static/css/layout.css` - grid, navigation, containers
+
+### Theme Support
+- Light and dark themes based on Gitea color scheme
+- Theme switching via `data-theme` attribute on `<html>` element
+- LocalStorage persistence for user preference
+- All colors use CSS custom properties (variables)
+
+### Static Assets
+- **All assets are local** - no external CDN dependencies
+- Location: `static/` directory at project root
+- Served via FastAPI `StaticFiles` middleware
+
+## Authentication & Authorization
+
+### Web UI Authentication
+- **Token storage**: HTTP-only secure cookies
+- **Login flow**: Redirect to Keycloak login page → Callback → Set cookie → Redirect back
+- **Registration**: Only through Keycloak admin interface
+- **Profile**: Read-only display of user info
+
+### Authorization Rules
+
+#### Post Visibility
+| Role | Published Posts | Own Drafts | Other Drafts |
+|------|----------------|------------|--------------|
+| GUEST (unauthenticated) | ✅ | ❌ | ❌ |
+| USER | ✅ | ✅ | ❌ |
+| ADMIN | ✅ | ✅ | ✅ |
+
+#### UI Elements by Role
+| Element | GUEST | USER | ADMIN |
+|---------|-------|------|-------|
+| "New Post" button | ❌ | ✅ | ✅ |
+| "Edit" button on own posts | ❌ | ✅ | ✅ |
+| "Edit" button on other posts | ❌ | ❌ | ✅ |
+| "Delete" button on own posts | ❌ | ✅ | ✅ |
+| "Delete" button on other posts | ❌ | ❌ | ✅ |
+| Draft badges | ❌ | Own only | All |
+| User menu in header | ❌ | ✅ | ✅ |
+| Profile page access | ❌ | ✅ | ✅ |
+
+### Auth Routes
+- `GET /auth/login` - Redirect to Keycloak
+- `GET /auth/callback` - OAuth callback handler
+- `GET /auth/logout` - Clear cookie and logout
+- `GET /profile` - User profile page (read-only)
+
+### Cookie Settings
+```python
+response.set_cookie(
+    key="access_token",
+    value=token,
+    httponly=True,
+    secure=True,  # In production
+    samesite="lax",
+    max_age=3600,  # 1 hour
+)
+```
+
+### DDD Concepts Used
+
+### Entities
+- Have identity (UUID)
+- Mutable state
+- Business logic methods (publish, update_title, etc.)
+- Example: `Post` entity
+
+### Value Objects
+- Immutable
+- Defined by attributes
+- Validated on creation
+- Examples: `Title`, `Content`, `Slug`
+
+### Aggregates & Repositories
+- `Post` is an aggregate root
+- `PostRepository` interface in Domain
+- `SQLAlchemyPostRepository` implementation in Infrastructure
+
+### Domain Events
+- Placeholder for future implementation
+- Can be added via event bus in application layer
+
+## Configuration
+- `.env` file loaded by pydantic-settings
+- Settings available via `app.infrastructure.config.settings`
+
+## Database
+- SQLAlchemy 2.0 with async support
+- SQLite by default (aiosqlite)
+- Tables auto-created on startup
+- Use `init_db()` and `close_db()` in lifespan
+
+## TDD Development Workflow
+
+This project uses **Test-Driven Development (TDD)** with a formal test agreement process.
+
+### Feature Lifecycle
+
+```
+User: "начнем новую фичу"
+  |
+  v
+Discovery Phase (автоматически)
+  |-- Анализ существующего кода
+  |-- Определение затронутых слоев DDD
+  |-- Рекомендации по тесткейсам
+  |
+  v
+User Agreement (согласование)
+  |-- Пользователь подтверждает/корректирует тесткейсы
+  |
+  v
+Test Design
+  |-- Актуализация FEATURE_*.md
+  |-- Создание artifact: pyaqa/feature/{feature-name}.md
+  |-- Назначение TC-UNIT-NNN, TC-API-NNN, TC-WEB-NNN, TC-E2E-NNN
+  |
+  v
+Write Tests (RED)
+  |-- Написать тесты, убедиться что они падают
+  |
+  v
+Implementation (GREEN)
+  |-- Domain -> Application -> Infrastructure -> Presentation
+  |-- Минимальная реализация для прохождения тестов
+  |
+  v
+Refactor
+  |-- Улучшение кода с сохранением зеленых тестов
+  |-- Линтеры, type checker
+  |
+  v
+Verification
+  |-- ruff check, ruff format, isort, mypy
+  |-- pytest (coverage ≥70%)
+  |-- E2E tests
+  |
+  v
+User Acceptance
+  |-- Пользователь подтверждает приемку
+  |
+  v
+Commit (во все затронутые проекты)
+  |-- blog, pytfm, pyaqa (root)
+```
+
+### Bugfix Lifecycle
+
+```
+User: "исправить баг"
+  |
+  v
+Reproduction Phase
+  |-- Анализ бага, воспроизведение
+  |-- Определение root cause
+  |-- Создание artifact: pyaqa/bugfix/{name}.md
+  |
+  v
+Write Regression Test
+  |-- Написать тест, воспроизводящий баг
+  |-- Убедиться что тест падает (RED)
+  |
+  v
+Fix (GREEN)
+  |-- Минимальный фикс
+  |-- Убедиться что тест проходит
+  |
+  v
+Verification
+  |-- Все существующие тесты проходят
+  |-- Coverage не упал
+  |-- Линтеры, type checker
+  |
+  v
+User Acceptance
+  |-- Пользователь проверяет исправление
+  |
+  v
+Commit (во все затронутые проекты)
+```
+
+### Refactoring Lifecycle
+
+```
+User: "отрефакторить"
+  |
+  v
+Analysis Phase
+  |-- Анализ кода
+  |-- Определение scope и рисков
+  |-- Создание artifact: pyaqa/refactor/{name}.md (опционально)
+  |
+  v
+Pre-check
+  |-- Все тесты проходят ДО рефакторинга
+  |-- Фиксация coverage baseline
+  |
+  v
+Refactoring
+  |-- Пошаговые изменения
+  |-- Проверка тестов после каждого шага
+  |
+  v
+Post-check
+  |-- Все тесты проходят ПОСЛЕ рефакторинга
+  |-- Coverage не ниже baseline
+  |-- Поведение не изменилось
+  |
+  v
+Verification
+  |-- Линтеры, type checker
+  |-- Нет новых warnings
+  |
+  v
+User Acceptance (опционально)
+  |-- Пользователь проверяет, что ничего не сломалось
+  |
+  v
+Commit (во все затронутые проекты)
+```
+
+### Branch Naming
+- **Feature**: `feature/{feature-name}` от `dev`
+- **Bugfix**: `bugfix/{bug-name}` от `dev`
+- **Refactor**: `refactor/{name}` от `dev`
+
+### Test Case IDs
+- `TC-UNIT-NNN` — unit тесты (domain, use cases)
+- `TC-API-NNN` — API endpoint тесты
+- `TC-WEB-NNN` — Web route тесты (HTML responses)
+- `TC-E2E-NNN` — End-to-end тесты (Playwright)
+
+### Test Level Selection
+Все 4 уровня по умолчанию. Можно сокращать в зависимости от задачи:
+- **Domain-only фича**: только TC-UNIT
+- **API-only фича**: TC-UNIT + TC-API
+- **Web UI фича**: TC-UNIT + TC-WEB + TC-E2E
+- **Full-stack фича**: все 4 уровня
+- **Bugfix**: уровни в зависимости от слоя бага (минимум unit + regression)
+- **Refactor**: все существующие тесты (unit + api + web + e2e)
+
+### Artifact Location
+- **Feature**: `pyaqa/feature/TEMPLATE.md` → `pyaqa/feature/{feature-name}.md`
+- **Bugfix**: `pyaqa/bugfix/TEMPLATE.md` → `pyaqa/bugfix/{bug-name}.md`
+- **Refactor**: `pyaqa/refactor/TEMPLATE.md` → `pyaqa/refactor/{name}.md`
+
+### Commit Rules
+При завершении коммитить во ВСЕ затронутые подпроекты:
+1. `blog/` — если изменен
+2. `pytfm/` — если изменен
+3. `pyaqa/` (root) — всегда (обновление ссылок на подпроекты)
+
+## Notes
+
+- Web routes (`app/presentation/web/routes.py`) currently use `MockPost` and `MOCK_POSTS` instead of real use cases — integrate with actual use cases when ready
+- `alembic/` directory exists but is non-functional (no `alembic.ini`, no migration scripts)
+- `tests/integration/`, `tests/api/`, `tests/e2e/` are documented in architecture but do not exist yet
+- `app/domain/roles.py` exists but its symbols are not exported in `app/domain/__init__.py`
+- Woodpecker CI uses `.woodpecker/` directory (3 separate YAML files) instead of single `.woodpecker.yml` — valid but non-standard
+- CI pipelines have copy-paste boilerplate; `test.yaml` uses `--group tests` while `lint.yaml` and `type.yaml` use `--only-group <X>`

app/__init__.py

@@ -1 +1,5 @@
-"""Application package."""
+"""Blog API Application.
+
+This package provides a complete blog API implementation following
+Domain-Driven Design principles with FastAPI and SQLAlchemy.
+"""

app/api/__init__.py

@@ -1 +0,0 @@
-"""API module - HTTP routes and endpoints."""

app/api/v1/__init__.py

@@ -1 +0,0 @@
-"""API version 1 endpoints."""

app/application/__init__.py

@@ -0,0 +1,29 @@
+"""Application layer exports.
+
+This module re-exports all application layer components including
+DTOs, interfaces, and use cases for convenient importing.
+"""
+
+from app.application.dtos import CreatePostDTO, PostResponseDTO, UpdatePostDTO
+from app.application.interfaces import TransactionManager
+from app.application.use_cases import (
+    CreatePostUseCase,
+    DeletePostUseCase,
+    GetPostUseCase,
+    ListPostsUseCase,
+    PublishPostUseCase,
+    UpdatePostUseCase,
+)
+
+__all__ = [
+    "CreatePostDTO",
+    "UpdatePostDTO",
+    "PostResponseDTO",
+    "TransactionManager",
+    "CreatePostUseCase",
+    "GetPostUseCase",
+    "UpdatePostUseCase",
+    "DeletePostUseCase",
+    "ListPostsUseCase",
+    "PublishPostUseCase",
+]

app/application/dtos/__init__.py

@@ -0,0 +1,9 @@
+"""Application DTOs.
+
+This module re-exports all Data Transfer Objects used in the
+application layer for data communication.
+"""
+
+from app.application.dtos.post import CreatePostDTO, PostResponseDTO, UpdatePostDTO
+
+__all__ = ["CreatePostDTO", "UpdatePostDTO", "PostResponseDTO"]

app/application/dtos/post.py

@@ -0,0 +1,102 @@
+"""DTOs for post use cases.
+
+This module defines Data Transfer Objects used for communication between
+application layer use cases and presentation layer. DTOs are immutable
+dataclasses that carry data across process boundaries.
+"""
+
+from dataclasses import dataclass
+from datetime import datetime
+from uuid import UUID
+
+
+@dataclass(frozen=True)
+class CreatePostDTO:
+    """DTO for creating a post.
+
+    Carries post creation data from API to use case.
+    Contains all required fields for post creation.
+
+    Attributes:
+        title: Post title string.
+        content: Post content string.
+        author_id: Identifier of the post author.
+        tags: Optional list of tags for categorization.
+
+    Example:
+        >>> dto = CreatePostDTO(
+        ...     title="My Post",
+        ...     content="Content here...",
+        ...     author_id="user-123",
+        ...     tags=["python"]
+        ... )
+    """
+
+    title: str
+    content: str
+    author_id: str
+    tags: list[str] | None = None
+
+
+@dataclass(frozen=True)
+class UpdatePostDTO:
+    """DTO for updating a post.
+
+    Carries optional post update data. All fields are optional
+    allowing partial updates.
+
+    Attributes:
+        title: Optional new title.
+        content: Optional new content.
+        tags: Optional new tags list.
+
+    Example:
+        >>> dto = UpdatePostDTO(title="Updated Title")
+    """
+
+    title: str | None = None
+    content: str | None = None
+    tags: list[str] | None = None
+
+
+@dataclass(frozen=True)
+class PostResponseDTO:
+    """DTO for post response.
+
+    Carries complete post data for API responses.
+    Includes all post attributes and metadata.
+
+    Attributes:
+        id: Unique post identifier.
+        title: Post title.
+        content: Post content.
+        slug: URL-friendly slug.
+        author_id: Author identifier.
+        published: Publication status.
+        tags: List of tags.
+        created_at: Creation timestamp.
+        updated_at: Last update timestamp.
+
+    Example:
+        >>> dto = PostResponseDTO(
+        ...     id=uuid,
+        ...     title="Post",
+        ...     content="...",
+        ...     slug="post",
+        ...     author_id="user-123",
+        ...     published=True,
+        ...     tags=[],
+        ...     created_at=datetime.now(),
+        ...     updated_at=datetime.now()
+        ... )
+    """
+
+    id: UUID
+    title: str
+    content: str
+    slug: str
+    author_id: str
+    published: bool
+    tags: list[str]
+    created_at: datetime
+    updated_at: datetime

app/application/interfaces/__init__.py

@@ -0,0 +1,9 @@
+"""Application interfaces.
+
+This module re-exports all abstract interfaces used in the
+application layer for dependency inversion.
+"""
+
+from app.application.interfaces.transaction_manager import TransactionManager
+
+__all__ = ["TransactionManager"]

app/application/interfaces/transaction_manager.py

@@ -0,0 +1,38 @@
+"""Transaction Manager interface for managing database transactions.
+
+This module defines the abstract interface for transaction management.
+Implementations control transaction boundaries for use cases.
+"""
+
+from abc import ABC, abstractmethod
+
+
+class TransactionManager(ABC):
+    """Abstract Transaction Manager for controlling transaction boundaries.
+
+    Provides interface for committing or rolling back database transactions.
+    Used by use cases to manage atomic operations.
+
+    Example:
+        >>> async with transaction_manager:
+        ...     await repository.add(entity)
+        ...     await transaction_manager.commit()
+    """
+
+    @abstractmethod
+    async def commit(self) -> None:
+        """Commit the current transaction.
+
+        Persists all pending changes to the database.
+        Should be called after all operations succeed.
+        """
+        ...
+
+    @abstractmethod
+    async def rollback(self) -> None:
+        """Rollback the current transaction.
+
+        Discards all pending changes.
+        Should be called when an error occurs.
+        """
+        ...

app/application/use_cases/__init__.py

@@ -0,0 +1,21 @@
+"""Use cases.
+
+This module re-exports all application use cases that implement
+business logic operations for the blog API.
+"""
+
+from app.application.use_cases.create_post import CreatePostUseCase
+from app.application.use_cases.delete_post import DeletePostUseCase
+from app.application.use_cases.get_post import GetPostUseCase
+from app.application.use_cases.list_posts import ListPostsUseCase
+from app.application.use_cases.publish_post import PublishPostUseCase
+from app.application.use_cases.update_post import UpdatePostUseCase
+
+__all__ = [
+    "CreatePostUseCase",
+    "GetPostUseCase",
+    "UpdatePostUseCase",
+    "DeletePostUseCase",
+    "ListPostsUseCase",
+    "PublishPostUseCase",
+]

app/application/use_cases/create_post.py

@@ -0,0 +1,97 @@
+"""Create post use case.
+
+This module implements the use case for creating new blog posts.
+Handles slug generation, duplicate checking, and entity persistence.
+"""
+
+from app.application.dtos.post import CreatePostDTO, PostResponseDTO
+from app.application.interfaces import TransactionManager
+from app.domain.entities import Post
+from app.domain.exceptions import AlreadyExistsException
+from app.domain.repositories import PostRepository
+
+
+class CreatePostUseCase:
+    """Use case for creating a new blog post.
+
+    Encapsulates the business logic for creating posts including
+    slug generation from title and duplicate slug detection.
+
+    Attributes:
+        _post_repo: Repository for post data access.
+        _tx_manager: Transaction manager for commit control.
+
+    Example:
+        >>> use_case = CreatePostUseCase(post_repo, tx_manager)
+        >>> result = await use_case.execute(dto)
+    """
+
+    def __init__(
+        self,
+        post_repo: PostRepository,
+        tx_manager: TransactionManager,
+    ) -> None:
+        """Initialize use case with dependencies.
+
+        Args:
+            post_repo: Repository for post operations.
+            tx_manager: Transaction manager instance.
+        """
+        self._post_repo = post_repo
+        self._tx_manager = tx_manager
+
+    async def execute(self, dto: CreatePostDTO) -> PostResponseDTO:
+        """Execute the use case to create a new post.
+
+        Args:
+            dto: Data transfer object containing post creation data
+                including title, content, author ID, and optional tags.
+
+        Returns:
+            PostResponseDTO with created post data including generated ID and slug.
+
+        Raises:
+            AlreadyExistsException: If a post with the same slug exists.
+
+        Note:
+            Slug is automatically generated from the title.
+        """
+        from app.domain.value_objects import Slug
+
+        slug = Slug.from_title(dto.title)
+
+        if await self._post_repo.slug_exists(slug.value):
+            raise AlreadyExistsException(f"Post with slug '{slug.value}' already exists")
+
+        post = Post.create(
+            title_str=dto.title,
+            content_str=dto.content,
+            author_id=dto.author_id,
+            tags=dto.tags or [],
+        )
+
+        await self._post_repo.add(post)
+        await self._tx_manager.commit()
+
+        return self._map_to_dto(post)
+
+    def _map_to_dto(self, post: Post) -> PostResponseDTO:
+        """Map domain entity to response DTO.
+
+        Args:
+            post: Domain post entity.
+
+        Returns:
+            PostResponseDTO with all post attributes.
+        """
+        return PostResponseDTO(
+            id=post.id,
+            title=post.title.value,
+            content=post.content.value,
+            slug=post.slug.value,
+            author_id=post.author_id,
+            published=post.published,
+            tags=post.tags.copy(),
+            created_at=post.created_at,
+            updated_at=post.updated_at,
+        )

app/application/use_cases/delete_post.py

@@ -0,0 +1,69 @@
+"""Delete post use case.
+
+This module implements the use case for deleting blog posts.
+Includes authorization checks to ensure users can only delete their own posts.
+"""
+
+from uuid import UUID
+
+from app.application.interfaces import TransactionManager
+from app.domain.exceptions import ForbiddenException, NotFoundException
+from app.domain.repositories import PostRepository
+from app.domain.roles import Role
+
+
+class DeletePostUseCase:
+    """Use case for deleting a blog post.
+
+    Handles post deletion with authorization checks.
+    Users can only delete posts they authored.
+
+    Attributes:
+        _post_repo: Repository for post data access.
+        _tx_manager: Transaction manager for commit control.
+
+    Example:
+        >>> use_case = DeletePostUseCase(post_repo, tx_manager)
+        >>> await use_case.execute(post_id, user_id)
+    """
+
+    def __init__(
+        self,
+        post_repo: PostRepository,
+        tx_manager: TransactionManager,
+    ) -> None:
+        """Initialize use case with dependencies.
+
+        Args:
+            post_repo: Repository for post operations.
+            tx_manager: Transaction manager instance.
+        """
+        self._post_repo = post_repo
+        self._tx_manager = tx_manager
+
+    async def execute(
+        self,
+        post_id: UUID,
+        current_user_id: str,
+        current_role: Role = Role.USER,
+    ) -> None:
+        """Execute the use case to delete a post.
+
+        Args:
+            post_id: Unique identifier of the post to delete.
+            current_user_id: ID of the user requesting deletion.
+            current_role: Role of the requesting user (default USER).
+
+        Raises:
+            NotFoundException: If post with given ID does not exist.
+            ForbiddenException: If user is not the post author and not admin.
+        """
+        post = await self._post_repo.get_by_id(post_id)
+        if not post:
+            raise NotFoundException(f"Post with id '{post_id}' not found")
+
+        if current_role != Role.ADMIN and post.author_id != current_user_id:
+            raise ForbiddenException("You can only delete your own posts")
+
+        await self._post_repo.delete(post_id)
+        await self._tx_manager.commit()

app/application/use_cases/get_post.py

@@ -0,0 +1,99 @@
+"""Get post use case.
+
+This module implements the use case for retrieving blog posts.
+Supports lookup by both ID and slug.
+"""
+
+from uuid import UUID
+
+from app.application.dtos.post import PostResponseDTO
+from app.application.interfaces import TransactionManager
+from app.domain.entities import Post
+from app.domain.exceptions import NotFoundException
+from app.domain.repositories import PostRepository
+
+
+class GetPostUseCase:
+    """Use case for retrieving a post by ID or slug.
+
+    Provides methods to fetch posts using different identifiers.
+    Handles not-found scenarios with appropriate exceptions.
+
+    Attributes:
+        _post_repo: Repository for post data access.
+        _tx_manager: Transaction manager for transaction control.
+
+    Example:
+        >>> use_case = GetPostUseCase(post_repo, tx_manager)
+        >>> post = await use_case.by_id(post_id)
+        >>> post = await use_case.by_slug("my-post")
+    """
+
+    def __init__(
+        self,
+        post_repo: PostRepository,
+        tx_manager: TransactionManager,
+    ) -> None:
+        """Initialize use case with dependencies.
+
+        Args:
+            post_repo: Repository for post operations.
+            tx_manager: Transaction manager instance.
+        """
+        self._post_repo = post_repo
+        self._tx_manager = tx_manager
+
+    async def by_id(self, post_id: UUID) -> PostResponseDTO:
+        """Get post by ID.
+
+        Args:
+            post_id: Unique identifier of the post.
+
+        Returns:
+            PostResponseDTO with complete post data.
+
+        Raises:
+            NotFoundException: If post with given ID does not exist.
+        """
+        post = await self._post_repo.get_by_id(post_id)
+        if not post:
+            raise NotFoundException(f"Post with id '{post_id}' not found")
+        return self._map_to_dto(post)
+
+    async def by_slug(self, slug: str) -> PostResponseDTO:
+        """Get post by slug.
+
+        Args:
+            slug: URL-friendly slug identifier.
+
+        Returns:
+            PostResponseDTO with complete post data.
+
+        Raises:
+            NotFoundException: If post with given slug does not exist.
+        """
+        post = await self._post_repo.get_by_slug(slug)
+        if not post:
+            raise NotFoundException(f"Post with slug '{slug}' not found")
+        return self._map_to_dto(post)
+
+    def _map_to_dto(self, post: Post) -> PostResponseDTO:
+        """Map domain entity to response DTO.
+
+        Args:
+            post: Domain post entity.
+
+        Returns:
+            PostResponseDTO with all post attributes.
+        """
+        return PostResponseDTO(
+            id=post.id,
+            title=post.title.value,
+            content=post.content.value,
+            slug=post.slug.value,
+            author_id=post.author_id,
+            published=post.published,
+            tags=post.tags.copy(),
+            created_at=post.created_at,
+            updated_at=post.updated_at,
+        )

app/application/use_cases/list_posts.py

@@ -0,0 +1,144 @@
+"""List posts use case.
+
+This module implements the use case for listing blog posts.
+Provides multiple query methods including filtering by author, tag, and search.
+"""
+
+from app.application.dtos.post import PostResponseDTO
+from app.application.interfaces import TransactionManager
+from app.domain.entities import Post
+from app.domain.repositories import PostRepository
+
+
+class ListPostsUseCase:
+    """Use case for listing blog posts with filtering.
+
+    Provides various methods to query posts with different criteria
+    including pagination support for large result sets.
+
+    Attributes:
+        _post_repo: Repository for post data access.
+        _tx_manager: Transaction manager for transaction control.
+
+    Example:
+        >>> use_case = ListPostsUseCase(post_repo, tx_manager)
+        >>> posts = await use_case.published_posts(limit=10, offset=0)
+    """
+
+    def __init__(
+        self,
+        post_repo: PostRepository,
+        tx_manager: TransactionManager,
+    ) -> None:
+        """Initialize use case with dependencies.
+
+        Args:
+            post_repo: Repository for post operations.
+            tx_manager: Transaction manager instance.
+        """
+        self._post_repo = post_repo
+        self._tx_manager = tx_manager
+
+    async def all_posts(self) -> list[PostResponseDTO]:
+        """Get all posts.
+
+        Returns:
+            List of PostResponseDTO for all posts.
+        """
+        posts = await self._post_repo.get_all()
+        return [self._map_to_dto(post) for post in posts]
+
+    async def published_posts(
+        self,
+        limit: int | None = None,
+        offset: int | None = None,
+    ) -> list[PostResponseDTO]:
+        """Get all published posts.
+
+        Args:
+            limit: Maximum number of posts to return.
+            offset: Number of posts to skip.
+
+        Returns:
+            List of PostResponseDTO for published posts.
+        """
+        posts = await self._post_repo.get_published(limit=limit, offset=offset)
+        return [self._map_to_dto(post) for post in posts]
+
+    async def by_author(
+        self,
+        author_id: str,
+        limit: int | None = None,
+        offset: int | None = None,
+    ) -> list[PostResponseDTO]:
+        """Get posts by author.
+
+        Args:
+            author_id: Identifier of the author.
+            limit: Maximum number of posts to return.
+            offset: Number of posts to skip.
+
+        Returns:
+            List of PostResponseDTO for posts by the author.
+        """
+        posts = await self._post_repo.get_by_author(author_id, limit=limit, offset=offset)
+        return [self._map_to_dto(post) for post in posts]
+
+    async def by_tag(
+        self,
+        tag: str,
+        limit: int | None = None,
+        offset: int | None = None,
+    ) -> list[PostResponseDTO]:
+        """Get posts by tag.
+
+        Args:
+            tag: Tag to filter by.
+            limit: Maximum number of posts to return.
+            offset: Number of posts to skip.
+
+        Returns:
+            List of PostResponseDTO for posts with the tag.
+        """
+        posts = await self._post_repo.get_by_tag(tag, limit=limit, offset=offset)
+        return [self._map_to_dto(post) for post in posts]
+
+    async def search(
+        self,
+        query: str,
+        limit: int | None = None,
+        offset: int | None = None,
+    ) -> list[PostResponseDTO]:
+        """Search posts.
+
+        Args:
+            query: Search query string.
+            limit: Maximum number of posts to return.
+            offset: Number of posts to skip.
+
+        Returns:
+            List of PostResponseDTO for matching posts.
+        """
+        posts = await self._post_repo.search(query, limit=limit, offset=offset)
+        return [self._map_to_dto(post) for post in posts]
+
+    def _map_to_dto(self, post: Post) -> PostResponseDTO:
+        """Map domain entity to response DTO.
+
+        Args:
+            post: Domain post entity.
+
+        Returns:
+            PostResponseDTO with all post attributes.
+        """
+        return PostResponseDTO(
+            id=post.id,
+            title=post.title.value,
+            content=post.content.value,
+            slug=post.slug.value,
+            author_id=post.author_id,
+            published=post.published,
+            tags=post.tags.copy(),
+            created_at=post.created_at,
+            updated_at=post.updated_at,
+        )

app/application/use_cases/publish_post.py

@@ -0,0 +1,131 @@
+"""Publish post use case.
+
+This module implements the use case for publishing and unpublishing blog posts.
+Includes authorization checks to ensure users can only manage their own posts.
+"""
+
+from uuid import UUID
+
+from app.application.dtos.post import PostResponseDTO
+from app.application.interfaces import TransactionManager
+from app.domain.entities import Post
+from app.domain.exceptions import ForbiddenException, NotFoundException
+from app.domain.repositories import PostRepository
+from app.domain.roles import Role
+
+
+class PublishPostUseCase:
+    """Use case for publishing/unpublishing a blog post.
+
+    Handles post publication state changes with authorization checks.
+    Users can only publish or unpublish posts they authored.
+
+    Attributes:
+        _post_repo: Repository for post data access.
+        _tx_manager: Transaction manager for commit control.
+
+    Example:
+        >>> use_case = PublishPostUseCase(post_repo, tx_manager)
+        >>> post = await use_case.publish(post_id, user_id)
+    """
+
+    def __init__(
+        self,
+        post_repo: PostRepository,
+        tx_manager: TransactionManager,
+    ) -> None:
+        """Initialize use case with dependencies.
+
+        Args:
+            post_repo: Repository for post operations.
+            tx_manager: Transaction manager instance.
+        """
+        self._post_repo = post_repo
+        self._tx_manager = tx_manager
+
+    async def publish(
+        self,
+        post_id: UUID,
+        current_user_id: str,
+        current_role: Role = Role.USER,
+    ) -> PostResponseDTO:
+        """Publish a post.
+
+        Args:
+            post_id: Unique identifier of the post.
+            current_user_id: ID of the user requesting publication.
+            current_role: Role of the requesting user (default USER).
+
+        Returns:
+            PostResponseDTO with updated post data.
+
+        Raises:
+            NotFoundException: If post with given ID does not exist.
+            ForbiddenException: If user is not the post author and not admin.
+        """
+        post = await self._post_repo.get_by_id(post_id)
+        if not post:
+            raise NotFoundException(f"Post with id '{post_id}' not found")
+
+        if current_role != Role.ADMIN and post.author_id != current_user_id:
+            raise ForbiddenException("You can only publish your own posts")
+
+        post.publish()
+        await self._post_repo.update(post)
+        await self._tx_manager.commit()
+
+        return self._map_to_dto(post)
+
+    async def unpublish(
+        self,
+        post_id: UUID,
+        current_user_id: str,
+        current_role: Role = Role.USER,
+    ) -> PostResponseDTO:
+        """Unpublish a post.
+
+        Args:
+            post_id: Unique identifier of the post.
+            current_user_id: ID of the user requesting unpublish.
+            current_role: Role of the requesting user (default USER).
+
+        Returns:
+            PostResponseDTO with updated post data.
+
+        Raises:
+            NotFoundException: If post with given ID does not exist.
+            ForbiddenException: If user is not the post author and not admin.
+        """
+        post = await self._post_repo.get_by_id(post_id)
+        if not post:
+            raise NotFoundException(f"Post with id '{post_id}' not found")
+
+        if current_role != Role.ADMIN and post.author_id != current_user_id:
+            raise ForbiddenException("You can only unpublish your own posts")
+
+        post.unpublish()
+        await self._post_repo.update(post)
+        await self._tx_manager.commit()
+
+        return self._map_to_dto(post)
+
+    def _map_to_dto(self, post: Post) -> PostResponseDTO:
+        """Map domain entity to response DTO.
+
+        Args:
+            post: Domain post entity.
+
+        Returns:
+            PostResponseDTO with all post attributes.
+        """
+        return PostResponseDTO(
+            id=post.id,
+            title=post.title.value,
+            content=post.content.value,
+            slug=post.slug.value,
+            author_id=post.author_id,
+            published=post.published,
+            tags=post.tags.copy(),
+            created_at=post.created_at,
+            updated_at=post.updated_at,
+        )

app/application/use_cases/update_post.py

@@ -0,0 +1,114 @@
+"""Update post use case.
+
+This module implements the use case for updating blog posts.
+Supports partial updates and includes authorization checks.
+"""
+
+from uuid import UUID
+
+from app.application.dtos.post import PostResponseDTO, UpdatePostDTO
+from app.application.interfaces import TransactionManager
+from app.domain.entities import Post
+from app.domain.exceptions import ForbiddenException, NotFoundException
+from app.domain.repositories import PostRepository
+from app.domain.roles import Role
+from app.domain.value_objects import Content, Title
+
+
+class UpdatePostUseCase:
+    """Use case for updating a blog post.
+
+    Handles post updates with authorization checks.
+    Supports partial updates - only provided fields are changed.
+    Users can only update posts they authored.
+
+    Attributes:
+        _post_repo: Repository for post data access.
+        _tx_manager: Transaction manager for commit control.
+
+    Example:
+        >>> use_case = UpdatePostUseCase(post_repo, tx_manager)
+        >>> dto = UpdatePostDTO(title="New Title")
+        >>> result = await use_case.execute(post_id, dto, user_id)
+    """
+
+    def __init__(
+        self,
+        post_repo: PostRepository,
+        tx_manager: TransactionManager,
+    ) -> None:
+        """Initialize use case with dependencies.
+
+        Args:
+            post_repo: Repository for post operations.
+            tx_manager: Transaction manager instance.
+        """
+        self._post_repo = post_repo
+        self._tx_manager = tx_manager
+
+    async def execute(
+        self,
+        post_id: UUID,
+        dto: UpdatePostDTO,
+        current_user_id: str,
+        current_role: Role = Role.USER,
+    ) -> PostResponseDTO:
+        """Execute the use case to update a post.
+
+        Args:
+            post_id: Unique identifier of the post to update.
+            dto: Data transfer object with update data.
+            current_user_id: ID of the user requesting update.
+            current_role: Role of the requesting user (default USER).
+
+        Returns:
+            PostResponseDTO with updated post data.
+
+        Raises:
+            NotFoundException: If post with given ID does not exist.
+            ForbiddenException: If user is not the post author and not admin.
+        """
+        post = await self._post_repo.get_by_id(post_id)
+        if not post:
+            raise NotFoundException(f"Post with id '{post_id}' not found")
+
+        if current_role != Role.ADMIN and post.author_id != current_user_id:
+            raise ForbiddenException("You can only update your own posts")
+
+        if dto.title is not None:
+            post.update_title(Title(dto.title))
+
+        if dto.content is not None:
+            post.update_content(Content(dto.content))
+
+        if dto.tags is not None:
+            for tag in post.tags[:]:
+                post.remove_tag(tag)
+            for tag in dto.tags:
+                post.add_tag(tag)
+
+        await self._post_repo.update(post)
+        await self._tx_manager.commit()
+
+        return self._map_to_dto(post)
+
+    def _map_to_dto(self, post: Post) -> PostResponseDTO:
+        """Map domain entity to response DTO.
+
+        Args:
+            post: Domain post entity.
+
+        Returns:
+            PostResponseDTO with all post attributes.
+        """
+        return PostResponseDTO(
+            id=post.id,
+            title=post.title.value,
+            content=post.content.value,
+            slug=post.slug.value,
+            author_id=post.author_id,
+            published=post.published,
+            tags=post.tags.copy(),
+            created_at=post.created_at,
+            updated_at=post.updated_at,
+        )

app/common/__init__.py

@@ -1 +0,0 @@
-"""Common utilities and shared components."""

app/common/error_handler.py

@@ -1,48 +0,0 @@
-from datetime import datetime, timezone
-
-from fastapi import FastAPI, Request
-from fastapi.responses import JSONResponse
-from pydantic import BaseModel
-from starlette.exceptions import HTTPException
-
-from app.core.exceptions import AppException
-
-
-class ErrorResponse(BaseModel):
-    status_code: int
-    message: str
-    details: dict[str, str] | None = None
-    timestamp: str
-
-
-async def app_exception_handler(request: Request, exc: AppException) -> JSONResponse:
-    return JSONResponse(
-        status_code=exc.status_code,
-        content={
-            "status_code": exc.status_code,
-            "message": exc.message,
-            "timestamp": datetime.now(timezone.utc).isoformat(),
-        },
-    )
-
-
-async def http_exception_handler(request: Request, exc: HTTPException) -> JSONResponse:
-    return JSONResponse(
-        status_code=exc.status_code,
-        content={
-            "status_code": exc.status_code,
-            "message": str(exc.detail),
-            "timestamp": datetime.now(timezone.utc).isoformat(),
-        },
-    )
-
-
-def register_exception_handlers(app: FastAPI) -> None:
-    app.add_exception_handler(
-        AppException,
-        app_exception_handler,  # type: ignore[arg-type]
-    )
-    app.add_exception_handler(
-        HTTPException,
-        http_exception_handler,  # type: ignore[arg-type]
-    )

app/core/__init__.py

@@ -1 +0,0 @@
-"""Core module - shared functionality and configuration."""

app/core/config.py

@@ -1,15 +0,0 @@
-from pydantic_settings import BaseSettings, SettingsConfigDict
-
-
-class Settings(BaseSettings):
-    app_name: str = "Blog API"
-    debug: bool = False
-    host: str = "0.0.0.0"
-    port: int = 8000
-
-    database_url: str | None = None
-
-    model_config = SettingsConfigDict(env_file=".env")
-
-
-settings = Settings()

app/core/exceptions.py

@@ -1,25 +0,0 @@
-class AppException(Exception):
-    def __init__(self, message: str, status_code: int = 500):
-        self.message = message
-        self.status_code = status_code
-        super().__init__(self.message)
-
-
-class NotFoundError(AppException):
-    def __init__(self, message: str = "Resource not found"):
-        super().__init__(message, status_code=404)
-
-
-class ValidationError(AppException):
-    def __init__(self, message: str = "Validation failed"):
-        super().__init__(message, status_code=400)
-
-
-class UnauthorizedError(AppException):
-    def __init__(self, message: str = "Unauthorized"):
-        super().__init__(message, status_code=401)
-
-
-class ForbiddenError(AppException):
-    def __init__(self, message: str = "Forbidden"):
-        super().__init__(message, status_code=403)

app/domain/__init__.py

@@ -0,0 +1,34 @@
+"""Domain layer exports.
+
+This module re-exports all domain layer components including
+entities, value objects, repositories, and exceptions.
+"""
+
+from app.domain.entities import BaseEntity, Post
+from app.domain.exceptions import (
+    AlreadyExistsException,
+    DomainException,
+    ForbiddenException,
+    NotFoundException,
+    UnauthorizedException,
+    ValidationException,
+)
+from app.domain.repositories import PostRepository, Repository
+from app.domain.value_objects import Content, Slug, Title, ValueObject
+
+__all__ = [
+    "BaseEntity",
+    "Post",
+    "ValueObject",
+    "Title",
+    "Content",
+    "Slug",
+    "Repository",
+    "PostRepository",
+    "DomainException",
+    "ValidationException",
+    "NotFoundException",
+    "AlreadyExistsException",
+    "UnauthorizedException",
+    "ForbiddenException",
+]

app/domain/entities/__init__.py

@@ -0,0 +1,10 @@
+"""Domain entities.
+
+This module re-exports all domain entities that represent
+core business objects with identity.
+"""
+
+from app.domain.entities.base import BaseEntity
+from app.domain.entities.post import Post
+
+__all__ = ["BaseEntity", "Post"]

app/domain/entities/base.py

@@ -0,0 +1,75 @@
+"""Base entity for DDD domain layer.
+
+This module provides the foundational BaseEntity class that all domain
+entities must inherit from. It implements common entity patterns including
+identity management, equality comparison, and timestamp tracking.
+"""
+
+from abc import ABC, abstractmethod
+from dataclasses import dataclass, field
+from datetime import UTC, datetime
+from typing import Any
+from uuid import UUID, uuid4
+
+
+@dataclass(kw_only=True)
+class BaseEntity(ABC):
+    """Base class for all domain entities.
+
+    Provides common functionality for domain entities including unique
+    identification, creation/update timestamps, and equality comparison
+    based on identity.
+
+    Attributes:
+        id: Unique identifier for the entity, automatically generated.
+        created_at: Timestamp when the entity was created.
+        updated_at: Timestamp when the entity was last updated.
+
+    Example:
+        >>> class User(BaseEntity):
+        ...     name: str
+        ...     def to_dict(self) -> dict[str, Any]:
+        ...         return {"id": str(self.id), "name": self.name}
+    """
+
+    id: UUID = field(default_factory=uuid4)
+    created_at: datetime = field(default_factory=lambda: datetime.now(UTC))
+    updated_at: datetime = field(default_factory=lambda: datetime.now(UTC))
+
+    def __eq__(self, other: object) -> bool:
+        """Compare entities by identity.
+
+        Args:
+            other: Another object to compare with.
+
+        Returns:
+            True if both objects are BaseEntity instances with same ID.
+        """
+        if not isinstance(other, BaseEntity):
+            return NotImplemented
+        return self.id == other.id
+
+    def __hash__(self) -> int:
+        """Get hash based on entity identity.
+
+        Returns:
+            Hash of the entity ID.
+        """
+        return hash(self.id)
+
+    def touch(self) -> None:
+        """Update the updated_at timestamp.
+
+        Should be called whenever the entity is modified to track
+        the last modification time.
+        """
+        self.updated_at = datetime.now(UTC)
+
+    @abstractmethod
+    def to_dict(self) -> dict[str, Any]:
+        """Convert entity to dictionary representation.
+
+        Returns:
+            Dictionary containing all entity attributes.
+        """
+        ...

app/domain/entities/post.py

@@ -0,0 +1,150 @@
+"""Domain entity for Blog Post.
+
+This module defines the Post aggregate root entity that encapsulates
+all business logic related to blog posts including publishing, content
+management, and tag operations.
+"""
+
+from dataclasses import dataclass, field
+from typing import Any
+
+from app.domain.entities.base import BaseEntity
+from app.domain.value_objects.content import Content
+from app.domain.value_objects.slug import Slug
+from app.domain.value_objects.title import Title
+
+
+@dataclass(kw_only=True)
+class Post(BaseEntity):
+    """Blog post domain entity.
+
+    Represents a blog post with title, content, slug, and metadata.
+    Encapsulates business logic for post lifecycle management.
+
+    Attributes:
+        title: Post title value object with validation.
+        content: Post content value object with validation.
+        slug: URL-friendly identifier generated from title.
+        author_id: Identifier of the post author.
+        published: Publication status flag.
+        tags: List of tags associated with the post.
+
+    Example:
+        >>> post = Post.create(
+        ...     title_str="My First Post",
+        ...     content_str="This is the content...",
+        ...     author_id="user-123",
+        ...     tags=["python", "fastapi"]
+        ... )
+        >>> post.publish()
+    """
+
+    title: Title
+    content: Content
+    slug: Slug
+    author_id: str
+    published: bool = False
+    tags: list[str] = field(default_factory=list)
+
+    def publish(self) -> None:
+        """Publish the post.
+
+        Sets the published flag to True and updates the timestamp.
+        """
+        self.published = True
+        self.touch()
+
+    def unpublish(self) -> None:
+        """Unpublish the post.
+
+        Sets the published flag to False and updates the timestamp.
+        """
+        self.published = False
+        self.touch()
+
+    def update_content(self, content: Content) -> None:
+        """Update post content.
+
+        Args:
+            content: New content value object.
+        """
+        self.content = content
+        self.touch()
+
+    def update_title(self, title: Title) -> None:
+        """Update post title and regenerate slug.
+
+        Args:
+            title: New title value object.
+        """
+        self.title = title
+        self.slug = Slug.from_title(title.value)
+        self.touch()
+
+    def add_tag(self, tag: str) -> None:
+        """Add a tag to the post.
+
+        Args:
+            tag: Tag string to add. Only adds if not already present.
+        """
+        if tag not in self.tags:
+            self.tags.append(tag)
+            self.touch()
+
+    def remove_tag(self, tag: str) -> None:
+        """Remove a tag from the post.
+
+        Args:
+            tag: Tag string to remove. Only removes if present.
+        """
+        if tag in self.tags:
+            self.tags.remove(tag)
+            self.touch()
+
+    def to_dict(self) -> dict[str, Any]:
+        """Convert entity to dictionary.
+
+        Returns:
+            Dictionary representation with all post attributes.
+        """
+        return {
+            "id": str(self.id),
+            "title": self.title.value,
+            "content": self.content.value,
+            "slug": self.slug.value,
+            "author_id": self.author_id,
+            "published": self.published,
+            "tags": self.tags.copy(),
+            "created_at": self.created_at.isoformat(),
+            "updated_at": self.updated_at.isoformat(),
+        }
+
+    @classmethod
+    def create(
+        cls,
+        title_str: str,
+        content_str: str,
+        author_id: str,
+        tags: list[str] | None = None,
+    ) -> "Post":
+        """Factory method to create a new post.
+
+        Args:
+            title_str: Title string for the post.
+            content_str: Content string for the post.
+            author_id: Identifier of the post author.
+            tags: Optional list of tags.
+
+        Returns:
+            New Post instance with validated value objects.
+        """
+        title = Title(title_str)
+        content = Content(content_str)
+        slug = Slug.from_title(title_str)
+        return cls(
+            title=title,
+            content=content,
+            slug=slug,
+            author_id=author_id,
+            tags=tags or [],
+        )

app/domain/exceptions.py

@@ -0,0 +1,78 @@
+"""Domain exceptions for business logic errors.
+
+This module defines the exception hierarchy for domain layer errors.
+All domain exceptions inherit from DomainException base class.
+"""
+
+
+class DomainException(Exception):
+    """Base exception for domain layer.
+
+    All domain-specific exceptions should inherit from this class.
+    Provides a consistent interface for error messages.
+
+    Attributes:
+        message: Human-readable error description.
+
+    Example:
+        >>> raise DomainException("Business rule violated")
+    """
+
+    def __init__(self, message: str) -> None:
+        """Initialize domain exception.
+
+        Args:
+            message: Error message describing the exception.
+        """
+        self.message = message
+        super().__init__(self.message)
+
+
+class ValidationException(DomainException):
+    """Raised when validation fails.
+
+    Used when entity or value object validation does not pass.
+
+    Example:
+        >>> raise ValidationException("Title is too long")
+    """
+
+
+class NotFoundException(DomainException):
+    """Raised when an entity is not found.
+
+    Used when requesting an entity that does not exist in the repository.
+
+    Example:
+        >>> raise NotFoundException("Post with id 123 not found")
+    """
+
+
+class AlreadyExistsException(DomainException):
+    """Raised when trying to create an entity that already exists.
+
+    Used when attempting to create a duplicate entity.
+
+    Example:
+        >>> raise AlreadyExistsException("Post with this slug already exists")
+    """
+
+
+class UnauthorizedException(DomainException):
+    """Raised when user is not authorized.
+
+    Used when authentication is required but not provided or invalid.
+
+    Example:
+        >>> raise UnauthorizedException("Authentication required")
+    """
+
+
+class ForbiddenException(DomainException):
+    """Raised when access is forbidden.
+
+    Used when authenticated user lacks required permissions.
+
+    Example:
+        >>> raise ForbiddenException("Only admins can delete posts")
+    """

app/domain/repositories/__init__.py

@@ -0,0 +1,10 @@
+"""Repository interfaces.
+
+This module re-exports all repository interfaces that define
+the contract for data access operations.
+"""
+
+from app.domain.repositories.base import Repository
+from app.domain.repositories.post import PostRepository
+
+__all__ = ["Repository", "PostRepository"]

app/domain/repositories/base.py

@@ -0,0 +1,89 @@
+"""Base repository interface for DDD.
+
+This module defines the generic repository pattern interface that all
+repository implementations must follow. Provides standard CRUD operations.
+"""
+
+from abc import ABC, abstractmethod
+from typing import Generic, TypeVar
+from uuid import UUID
+
+from app.domain.entities.base import BaseEntity
+
+T = TypeVar("T", bound=BaseEntity)
+
+
+class Repository(ABC, Generic[T]):
+    """Generic repository interface.
+
+    Defines the contract for repository implementations. All repositories
+    must provide standard CRUD operations for their entity type.
+
+    Type Parameters:
+        T: Entity type that must inherit from BaseEntity.
+
+    Example:
+        >>> class PostRepository(Repository[Post]):
+        ...     async def get_by_id(self, entity_id: UUID) -> Post | None:
+        ...         ...
+    """
+
+    @abstractmethod
+    async def get_by_id(self, entity_id: UUID) -> T | None:
+        """Get entity by ID.
+
+        Args:
+            entity_id: Unique identifier of the entity.
+
+        Returns:
+            Entity instance if found, None otherwise.
+        """
+        ...
+
+    @abstractmethod
+    async def get_all(self) -> list[T]:
+        """Get all entities.
+
+        Returns:
+            List of all entity instances.
+        """
+        ...
+
+    @abstractmethod
+    async def add(self, entity: T) -> None:
+        """Add new entity.
+
+        Args:
+            entity: Entity instance to add.
+        """
+        ...
+
+    @abstractmethod
+    async def update(self, entity: T) -> None:
+        """Update existing entity.
+
+        Args:
+            entity: Entity instance with updated data.
+        """
+        ...
+
+    @abstractmethod
+    async def delete(self, entity_id: UUID) -> None:
+        """Delete entity by ID.
+
+        Args:
+            entity_id: Unique identifier of the entity to delete.
+        """
+        ...
+
+    @abstractmethod
+    async def exists(self, entity_id: UUID) -> bool:
+        """Check if entity exists.
+
+        Args:
+            entity_id: Unique identifier of the entity.
+
+        Returns:
+            True if entity exists, False otherwise.
+        """
+        ...

app/domain/repositories/post.py

@@ -0,0 +1,121 @@
+"""Post repository interface.
+
+This module extends the base repository interface with post-specific
+query methods including slug lookup, author filtering, and search.
+"""
+
+from abc import abstractmethod
+
+from app.domain.entities.post import Post
+from app.domain.repositories.base import Repository
+
+
+class PostRepository(Repository[Post]):
+    """Repository interface for Blog Posts.
+
+    Extends the generic repository with post-specific operations
+    including slug-based lookup, author filtering, tag filtering,
+    and full-text search capabilities.
+
+    Example:
+        >>> posts = await repo.get_by_author("user-123", limit=10)
+        >>> exists = await repo.slug_exists("my-first-post")
+    """
+
+    @abstractmethod
+    async def get_by_slug(self, slug: str) -> Post | None:
+        """Get post by slug.
+
+        Args:
+            slug: URL-friendly slug identifier.
+
+        Returns:
+            Post instance if found, None otherwise.
+        """
+        ...
+
+    @abstractmethod
+    async def get_by_author(
+        self,
+        author_id: str,
+        limit: int | None = None,
+        offset: int | None = None,
+    ) -> list[Post]:
+        """Get all posts by author.
+
+        Args:
+            author_id: Identifier of the author.
+            limit: Maximum number of posts to return.
+            offset: Number of posts to skip.
+
+        Returns:
+            List of posts by the specified author.
+        """
+        ...
+
+    @abstractmethod
+    async def get_published(
+        self,
+        limit: int | None = None,
+        offset: int | None = None,
+    ) -> list[Post]:
+        """Get all published posts.
+
+        Args:
+            limit: Maximum number of posts to return.
+            offset: Number of posts to skip.
+
+        Returns:
+            List of published posts.
+        """
+        ...
+
+    @abstractmethod
+    async def get_by_tag(
+        self,
+        tag: str,
+        limit: int | None = None,
+        offset: int | None = None,
+    ) -> list[Post]:
+        """Get posts by tag.
+
+        Args:
+            tag: Tag to filter by.
+            limit: Maximum number of posts to return.
+            offset: Number of posts to skip.
+
+        Returns:
+            List of posts with the specified tag.
+        """
+        ...
+
+    @abstractmethod
+    async def slug_exists(self, slug: str) -> bool:
+        """Check if slug already exists.
+
+        Args:
+            slug: Slug to check for existence.
+
+        Returns:
+            True if slug exists, False otherwise.
+        """
+        ...
+
+    @abstractmethod
+    async def search(
+        self,
+        query: str,
+        limit: int | None = None,
+        offset: int | None = None,
+    ) -> list[Post]:
+        """Search posts by query string.
+
+        Args:
+            query: Search query string.
+            limit: Maximum number of posts to return.
+            offset: Number of posts to skip.
+
+        Returns:
+            List of posts matching the search query.
+        """
+        ...

app/domain/roles.py

@@ -0,0 +1,165 @@
+"""Role-based access control definitions.
+
+This module provides role and permission definitions for the application
+along with utility functions and decorators for permission checking.
+"""
+
+from collections.abc import Callable
+from enum import Enum
+from functools import wraps
+from typing import Any
+
+from app.domain.exceptions import ForbiddenException
+
+
+class Role(str, Enum):
+    """User roles in the system.
+
+    Defines the available user roles with hierarchical permissions.
+    ADMIN has full access, USER has standard access, GUEST has read-only.
+
+    Attributes:
+        ADMIN: Administrator with full system access.
+        USER: Regular authenticated user.
+        GUEST: Unauthenticated or limited access user.
+
+    Example:
+        >>> if role == Role.ADMIN:
+        ...     grant_full_access()
+    """
+
+    ADMIN = "admin"
+    USER = "user"
+    GUEST = "guest"
+
+
+class Permission:
+    """Permission definitions.
+
+    Contains string constants for all available permissions in the system.
+    Used for role-based access control checks.
+
+    Example:
+        >>> if has_permission(role, Permission.POST_CREATE):
+        ...     allow_post_creation()
+    """
+
+    POST_CREATE = "post:create"
+    POST_READ = "post:read"
+    POST_READ_UNPUBLISHED = "post:read_unpublished"
+    POST_UPDATE = "post:update"
+    POST_DELETE = "post:delete"
+    POST_PUBLISH = "post:publish"
+
+
+ROLE_PERMISSIONS: dict[Role, list[str]] = {
+    Role.ADMIN: [
+        Permission.POST_CREATE,
+        Permission.POST_READ,
+        Permission.POST_READ_UNPUBLISHED,
+        Permission.POST_UPDATE,
+        Permission.POST_DELETE,
+        Permission.POST_PUBLISH,
+    ],
+    Role.USER: [
+        Permission.POST_CREATE,
+        Permission.POST_READ,
+        Permission.POST_UPDATE,
+        Permission.POST_DELETE,
+        Permission.POST_PUBLISH,
+    ],
+    Role.GUEST: [
+        Permission.POST_READ,
+    ],
+}
+
+
+def has_permission(role: Role, permission: str) -> bool:
+    """Check if role has specific permission.
+
+    Args:
+        role: User role to check.
+        permission: Permission string to verify.
+
+    Returns:
+        True if role has the permission, False otherwise.
+
+    Example:
+        >>> has_permission(Role.ADMIN, Permission.POST_DELETE)
+        True
+    """
+    return permission in ROLE_PERMISSIONS.get(role, [])
+
+
+def require_permission(
+    permission: str,
+) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
+    """Decorator to require specific permission.
+
+    Creates a decorator that checks if the user has the required permission
+    before executing the decorated function.
+
+    Args:
+        permission: Permission string required for execution.
+
+    Returns:
+        Decorator function for permission checking.
+
+    Raises:
+        ForbiddenException: If user lacks the required permission.
+
+    Example:
+        >>> @require_permission(Permission.POST_CREATE)
+        ... async def create_post():
+        ...     ...
+    """
+
+    def decorator(func: Callable[..., Any]) -> Callable[..., Any]:
+        @wraps(func)
+        async def wrapper(*args: Any, **kwargs: Any) -> Any:
+            token_info = kwargs.get("token_info")
+            if not token_info:
+                raise ForbiddenException("Authentication required")
+
+            roles = getattr(token_info, "roles", [])
+            if Role.ADMIN.value in roles:
+                role = Role.ADMIN
+            elif Role.USER.value in roles:
+                role = Role.USER
+            else:
+                role = Role.GUEST
+
+            if not has_permission(role, permission):
+                raise ForbiddenException(
+                    f"Permission '{permission}' required for role '{role.value}'"
+                )
+
+            return await func(*args, **kwargs)
+
+        return wrapper
+
+    return decorator
+
+
+def get_effective_role(roles: list[str]) -> Role:
+    """Determine effective role from list of roles.
+
+    Evaluates multiple roles and returns the highest privilege role.
+    Priority order: admin > user > guest.
+
+    Args:
+        roles: List of role strings from token.
+
+    Returns:
+        Highest privilege Role enum value.
+
+    Example:
+        >>> get_effective_role(["user", "admin"])
+        <Role.ADMIN: 'admin'>
+    """
+    if Role.ADMIN.value in roles:
+        return Role.ADMIN
+    elif Role.USER.value in roles:
+        return Role.USER
+    else:
+        return Role.GUEST

app/domain/value_objects/__init__.py

@@ -0,0 +1,12 @@
+"""Value objects.
+
+This module re-exports all domain value objects that represent
+immutable validated domain concepts.
+"""
+
+from app.domain.value_objects.base import ValueObject
+from app.domain.value_objects.content import Content
+from app.domain.value_objects.slug import Slug
+from app.domain.value_objects.title import Title
+
+__all__ = ["ValueObject", "Title", "Content", "Slug"]

app/domain/value_objects/base.py

@@ -0,0 +1,91 @@
+"""Base value object for DDD domain layer.
+
+This module provides the foundational ValueObject class that all domain
+value objects must inherit from. Implements equality, hashing, and
+validation patterns for immutable value objects.
+"""
+
+from abc import ABC, abstractmethod
+from dataclasses import dataclass
+from typing import Any, Generic, TypeVar
+
+T = TypeVar("T")
+
+
+@dataclass(frozen=True, slots=True)
+class ValueObject(ABC, Generic[T]):
+    """Base class for all value objects.
+
+    Value objects are immutable objects defined by their attributes rather
+    than identity. They are validated on creation and provide type safety.
+
+    Attributes:
+        value: The underlying value wrapped by the value object.
+
+    Type Parameters:
+        T: Type of the wrapped value.
+
+    Example:
+        >>> class Email(ValueObject[str]):
+        ...     def _validate(self) -> None:
+        ...         if "@" not in self.value:
+        ...             raise ValueError("Invalid email")
+    """
+
+    value: T
+
+    def __post_init__(self) -> None:
+        """Validate value object after initialization.
+
+        Automatically called by dataclass after __init__. Triggers
+        the validation method to ensure value integrity.
+        """
+        self._validate()
+
+    @abstractmethod
+    def _validate(self) -> None:
+        """Validate the value object.
+
+        Must be implemented by subclasses to enforce value constraints.
+
+        Raises:
+            ValueError: If the value does not meet validation criteria.
+        """
+        ...
+
+    def __eq__(self, other: object) -> bool:
+        """Compare value objects by value.
+
+        Args:
+            other: Another object to compare with.
+
+        Returns:
+            True if both are ValueObjects with equal values.
+        """
+        if not isinstance(other, ValueObject):
+            return False
+        return bool(self.value == other.value)
+
+    def __hash__(self) -> int:
+        """Get hash based on wrapped value.
+
+        Returns:
+            Hash of the underlying value.
+        """
+        return hash(self.value)
+
+    def __str__(self) -> str:
+        """Convert value object to string.
+
+        Returns:
+            String representation of the wrapped value.
+        """
+        return str(self.value)
+
+    def to_primitive(self) -> Any:
+        """Convert value object to primitive type.
+
+        Returns:
+            The underlying primitive value.
+        """
+        return self.value

app/domain/value_objects/content.py

@@ -0,0 +1,50 @@
+"""Content value object.
+
+This module defines the Content value object for blog post content
+with validation for minimum and maximum length constraints.
+"""
+
+from dataclasses import dataclass
+
+from app.domain.value_objects.base import ValueObject
+
+
+@dataclass(frozen=True, slots=True)
+class Content(ValueObject[str]):
+    """Blog post content value object.
+
+    Wraps and validates blog post content ensuring it meets length
+    requirements and is not empty.
+
+    Attributes:
+        value: The content string value.
+        MIN_LENGTH: Minimum allowed content length (10 characters).
+        MAX_LENGTH: Maximum allowed content length (50000 characters).
+
+    Raises:
+        ValueError: If content is empty, too short, or too long.
+
+    Example:
+        >>> content = Content("This is valid content...")
+        >>> print(content.value)
+    """
+
+    MIN_LENGTH: int = 10
+    MAX_LENGTH: int = 50000
+
+    def _validate(self) -> None:
+        """Validate content string.
+
+        Checks that content is a non-empty string within length bounds.
+
+        Raises:
+            ValueError: If content fails validation criteria.
+        """
+        if not isinstance(self.value, str):
+            raise ValueError("Content must be a string")
+        if not self.value.strip():
+            raise ValueError("Content cannot be empty or whitespace")
+        if len(self.value) < self.MIN_LENGTH:
+            raise ValueError(f"Content must be at least {self.MIN_LENGTH} characters")
+        if len(self.value) > self.MAX_LENGTH:
+            raise ValueError(f"Content must be at most {self.MAX_LENGTH} characters")

app/domain/value_objects/slug.py

@@ -0,0 +1,73 @@
+"""Slug value object for URL-friendly identifiers.
+
+This module defines the Slug value object for generating and validating
+URL-friendly slugs from titles. Enforces lowercase, alphanumeric, and
+hyphen-only format.
+"""
+
+import re
+from dataclasses import dataclass
+
+from app.domain.value_objects.base import ValueObject
+
+
+@dataclass(frozen=True, slots=True)
+class Slug(ValueObject[str]):
+    """URL slug value object.
+
+    Represents a URL-friendly identifier generated from titles.
+    Validates format and provides factory method for slug generation.
+
+    Attributes:
+        value: The slug string value.
+        MAX_LENGTH: Maximum allowed slug length (200 characters).
+        SLUG_PATTERN: Regex pattern for valid slug format.
+
+    Raises:
+        ValueError: If slug format is invalid.
+
+    Example:
+        >>> slug = Slug.from_title("My First Post!")
+        >>> print(slug.value)
+        'my-first-post'
+    """
+
+    MAX_LENGTH: int = 200
+    SLUG_PATTERN: str = r"^[a-z0-9]+(?:-[a-z0-9]+)*$"
+
+    def _validate(self) -> None:
+        """Validate slug format.
+
+        Ensures slug contains only lowercase letters, numbers, and hyphens.
+
+        Raises:
+            ValueError: If slug format is invalid.
+        """
+        if not isinstance(self.value, str):
+            raise ValueError("Slug must be a string")
+        if len(self.value) > self.MAX_LENGTH:
+            raise ValueError(f"Slug must be at most {self.MAX_LENGTH} characters")
+        if not re.match(self.SLUG_PATTERN, self.value):
+            raise ValueError("Slug must contain only lowercase letters, numbers, and hyphens")
+
+    @classmethod
+    def from_title(cls, title: str) -> "Slug":
+        """Generate slug from title.
+
+        Converts title to URL-friendly format by lowercasing, removing
+        special characters, and replacing spaces with hyphens.
+
+        Args:
+            title: Source title string.
+
+        Returns:
+            New Slug instance with generated value.
+        """
+        slug = title.lower().strip()
+        slug = re.sub(r"[^a-z0-9\s-]", "", slug)
+        slug = re.sub(r"[-\s]+", "-", slug)
+        max_len = 200
+        slug = slug[:max_len].strip("-")
+        if not slug:
+            slug = "post"
+        return cls(value=slug)

app/domain/value_objects/title.py

@@ -0,0 +1,50 @@
+"""Title value object.
+
+This module defines the Title value object for blog post titles
+with validation for minimum and maximum length constraints.
+"""
+
+from dataclasses import dataclass
+
+from app.domain.value_objects.base import ValueObject
+
+
+@dataclass(frozen=True, slots=True)
+class Title(ValueObject[str]):
+    """Blog post title value object.
+
+    Wraps and validates blog post titles ensuring they meet length
+    requirements and are not empty.
+
+    Attributes:
+        value: The title string value.
+        MIN_LENGTH: Minimum allowed title length (3 characters).
+        MAX_LENGTH: Maximum allowed title length (200 characters).
+
+    Raises:
+        ValueError: If title is empty, too short, or too long.
+
+    Example:
+        >>> title = Title("My Blog Post")
+        >>> print(title.value)
+    """
+
+    MIN_LENGTH: int = 3
+    MAX_LENGTH: int = 200
+
+    def _validate(self) -> None:
+        """Validate title string.
+
+        Checks that title is a non-empty string within length bounds.
+
+        Raises:
+            ValueError: If title fails validation criteria.
+        """
+        if not isinstance(self.value, str):
+            raise ValueError("Title must be a string")
+        if len(self.value) < self.MIN_LENGTH:
+            raise ValueError(f"Title must be at least {self.MIN_LENGTH} characters")
+        if len(self.value) > self.MAX_LENGTH:
+            raise ValueError(f"Title must be at most {self.MAX_LENGTH} characters")
+        if not self.value.strip():
+            raise ValueError("Title cannot be empty or whitespace")

app/infrastructure/__init__.py

@@ -0,0 +1,34 @@
+"""Infrastructure layer exports.
+
+This module re-exports all infrastructure components including
+config, database, repositories, DI, and middleware.
+"""
+
+from app.infrastructure.config import Settings, settings
+from app.infrastructure.database import (
+    AsyncSessionLocal,
+    Base,
+    PostORM,
+    close_db,
+    engine,
+    get_session,
+    init_db,
+)
+from app.infrastructure.di import create_container
+from app.infrastructure.middleware import register_exception_handlers
+from app.infrastructure.repositories import SQLAlchemyPostRepository
+
+__all__ = [
+    "Settings",
+    "settings",
+    "Base",
+    "PostORM",
+    "engine",
+    "AsyncSessionLocal",
+    "get_session",
+    "init_db",
+    "close_db",
+    "SQLAlchemyPostRepository",
+    "create_container",
+    "register_exception_handlers",
+]

app/infrastructure/auth/__init__.py

@@ -0,0 +1,11 @@
+"""Authentication infrastructure package.
+
+This module provides Keycloak authentication client and models
+for token validation and user info retrieval.
+"""
+
+from app.infrastructure.auth.client import KeycloakAuthClient
+from app.infrastructure.auth.mock_client import MockKeycloakClient
+from app.infrastructure.auth.models import KeycloakUser, TokenInfo
+
+__all__ = ["KeycloakAuthClient", "KeycloakUser", "MockKeycloakClient", "TokenInfo"]

app/infrastructure/auth/client.py

@@ -0,0 +1,185 @@
+"""Keycloak authentication client.
+
+This module provides a client for Keycloak authentication operations
+including token introspection and user info retrieval.
+"""
+
+import time
+
+import httpx
+
+from app.infrastructure.auth.models import KeycloakUser, TokenInfo
+from app.infrastructure.config.settings import Settings
+
+
+class KeycloakAuthClient:
+    """Client for Keycloak authentication operations.
+
+    Handles token validation via introspection and user info retrieval.
+    Implements token caching to reduce Keycloak server load.
+
+    Attributes:
+        _settings: Application settings with Keycloak config.
+        _base_url: Keycloak realm base URL.
+        _client_id: OAuth client identifier.
+        _client_secret: OAuth client secret.
+        _cache: Token info cache for performance.
+        _cache_ttl: Cache time-to-live in seconds.
+
+    Example:
+        >>> client = KeycloakAuthClient(settings)
+        >>> token_info = await client.introspect_token(token)
+    """
+
+    def __init__(self, settings: Settings) -> None:
+        """Initialize Keycloak client with settings.
+
+        Args:
+            settings: Application settings with Keycloak configuration.
+        """
+        self._settings = settings
+        self._base_url = f"{settings.kc.server_url}/realms/{settings.kc.realm}"
+        self._client_id = settings.kc.client_id
+        self._client_secret = settings.kc.client_secret
+        self._cache: dict[str, tuple[TokenInfo, float]] = {}
+        self._cache_ttl = settings.kc.token_cache_ttl
+
+    def _get_introspection_url(self) -> str:
+        """Get token introspection endpoint URL.
+
+        Returns:
+            Full URL for token introspection endpoint.
+        """
+        return f"{self._base_url}/protocol/openid-connect/token/introspection"
+
+    def _get_userinfo_url(self) -> str:
+        """Get userinfo endpoint URL.
+
+        Returns:
+            Full URL for userinfo endpoint.
+        """
+        return f"{self._base_url}/protocol/openid-connect/userinfo"
+
+    def _get_cached_token(self, token: str) -> TokenInfo | None:
+        """Get cached token info if valid.
+
+        Args:
+            token: Access token string.
+
+        Returns:
+            Cached TokenInfo if valid and not expired, None otherwise.
+        """
+        if token not in self._cache:
+            return None
+
+        token_info, cached_at = self._cache[token]
+        if time.time() - cached_at > self._cache_ttl:
+            del self._cache[token]
+            return None
+
+        return token_info
+
+    def _cache_token(self, token: str, token_info: TokenInfo) -> None:
+        """Cache token info.
+
+        Args:
+            token: Access token string as cache key.
+            token_info: TokenInfo to cache.
+        """
+        self._cache[token] = (token_info, time.time())
+        current_time = time.time()
+        expired_keys = [
+            k for k, (_, t) in self._cache.items() if current_time - t > self._cache_ttl
+        ]
+        for k in expired_keys:
+            del self._cache[k]
+
+    async def introspect_token(self, token: str) -> TokenInfo:
+        """Introspect access token using Keycloak.
+
+        Validates token with Keycloak server and extracts user information.
+        Uses cache to reduce server requests for recently validated tokens.
+
+        Args:
+            token: Access token to validate.
+
+        Returns:
+            TokenInfo with validation result and user claims.
+        """
+        cached = self._get_cached_token(token)
+        if cached:
+            return cached
+
+        data = {
+            "token": token,
+            "client_id": self._client_id,
+            "client_secret": self._client_secret,
+        }
+
+        try:
+            async with httpx.AsyncClient() as client:
+                response = await client.post(
+                    self._get_introspection_url(),
+                    data=data,
+                    headers={"Content-Type": "application/x-www-form-urlencoded"},
+                    timeout=10.0,
+                )
+                response.raise_for_status()
+                result = response.json()
+        except httpx.HTTPError as e:
+            return TokenInfo(active=False, raw_claims={"error": str(e)})
+
+        if not result.get("active", False):
+            return TokenInfo(active=False, raw_claims=result)
+
+        roles: list[str] = []
+        realm_access = result.get("realm_access", {})
+        if isinstance(realm_access, dict):
+            roles.extend(realm_access.get("roles", []))
+
+        token_info = TokenInfo(
+            active=True,
+            user_id=result.get("sub", ""),
+            username=result.get("preferred_username", ""),
+            email=result.get("email", ""),
+            roles=roles,
+            raw_claims=result,
+        )
+
+        self._cache_token(token, token_info)
+
+        return token_info
+
+    async def get_userinfo(self, token: str) -> KeycloakUser | None:
+        """Get user information from Keycloak using access token.
+
+        Fetches detailed user profile from Keycloak userinfo endpoint.
+
+        Args:
+            token: Valid access token.
+
+        Returns:
+            KeycloakUser with profile data, or None on error.
+        """
+        try:
+            async with httpx.AsyncClient() as client:
+                response = await client.get(
+                    self._get_userinfo_url(),
+                    headers={"Authorization": f"Bearer {token}"},
+                    timeout=10.0,
+                )
+                response.raise_for_status()
+                data = response.json()
+        except httpx.HTTPError:
+            return None
+
+        return KeycloakUser(
+            id=data.get("sub", ""),
+            username=data.get("preferred_username", ""),
+            email=data.get("email", ""),
+            first_name=data.get("given_name", ""),
+            last_name=data.get("family_name", ""),
+            roles=data.get("realm_access", {}).get("roles", [])
+            if isinstance(data.get("realm_access"), dict)
+            else [],
+        )

app/infrastructure/auth/mock_client.py

@@ -0,0 +1,75 @@
+"""Mock Keycloak client for development mode.
+
+This module provides a mock Keycloak authentication client that bypasses
+real Keycloak server authentication in development mode. It generates
+token info based on dev-specific token formats.
+"""
+
+from app.infrastructure.auth.models import TokenInfo
+
+
+class MockKeycloakClient:
+    """Mock Keycloak client for development and testing.
+
+        Bypasses real Keycloak server authentication. Parses dev-specific
+    token formats to generate TokenInfo with configurable roles.
+
+        Attributes:
+            _settings: Application settings.
+
+        Example:
+            >>> client = MockKeycloakClient()
+            >>> token_info = await client.introspect_token("dev-token-admin")
+    """
+
+    def __init__(self) -> None:
+        """Initialize mock client."""
+        pass
+
+    async def introspect_token(self, token: str) -> TokenInfo:
+        """Introspect token in dev mode.
+
+                If token starts with 'dev-token-', parses role from suffix.
+        Otherwise returns inactive token.
+
+                Args:
+                    token: Access token string.
+
+                Returns:
+                    TokenInfo with dev user data if dev token, inactive otherwise.
+        """
+        dev_users: dict[str, dict[str, str]] = {
+            "dev-token-user": {
+                "user_id": "dev-user",
+                "username": "Dev User",
+                "email": "dev.user@example.com",
+                "role": "user",
+            },
+            "dev-token-user2": {
+                "user_id": "dev-user2",
+                "username": "Test User",
+                "email": "test.user@example.com",
+                "role": "user",
+            },
+            "dev-token-admin": {
+                "user_id": "dev-admin",
+                "username": "Dev Admin",
+                "email": "dev.admin@example.com",
+                "role": "admin",
+            },
+        }
+
+        if token == "dev-token-guest":
+            return TokenInfo(active=False)
+
+        if token in dev_users:
+            user = dev_users[token]
+            return TokenInfo(
+                active=True,
+                user_id=user["user_id"],
+                username=user["username"],
+                email=user["email"],
+                roles=[user["role"]],
+            )
+
+        return TokenInfo(active=False)

app/infrastructure/auth/models.py

@@ -0,0 +1,74 @@
+"""Keycloak authentication models.
+
+This module defines data models for Keycloak authentication data
+including token info and user profiles.
+"""
+
+from dataclasses import dataclass, field
+from typing import Any
+
+
+@dataclass(frozen=True)
+class TokenInfo:
+    """Information about validated token from Keycloak.
+
+    Contains the result of token introspection including user claims
+    and role information.
+
+    Attributes:
+        active: Whether the token is active and valid.
+        user_id: Subject identifier from token.
+        username: Username from token claims.
+        email: Email from token claims.
+        roles: List of roles from token.
+        raw_claims: Complete raw claims from token.
+
+    Example:
+        >>> token_info = TokenInfo(active=True, user_id="123", roles=["user"])
+        >>> if token_info.is_valid:
+        ...     grant_access()
+    """
+
+    active: bool
+    user_id: str = ""
+    username: str = ""
+    email: str = ""
+    roles: list[str] = field(default_factory=list)
+    raw_claims: dict[str, Any] = field(default_factory=dict, repr=False)
+
+    @property
+    def is_valid(self) -> bool:
+        """Check if token is valid and active.
+
+        Returns:
+            True if token is active and has user_id.
+        """
+        return self.active and bool(self.user_id)
+
+
+@dataclass(frozen=True)
+class KeycloakUser:
+    """User information from Keycloak.
+
+    Contains user profile data from Keycloak userinfo endpoint.
+
+    Attributes:
+        id: User subject identifier.
+        username: Username.
+        email: Email address.
+        first_name: First name.
+        last_name: Last name.
+        roles: List of user roles.
+        is_active: Whether user account is active.
+
+    Example:
+        >>> user = KeycloakUser(id="123", username="john", email="john@example.com")
+    """
+
+    id: str
+    username: str
+    email: str
+    first_name: str = ""
+    last_name: str = ""
+    roles: list[str] = field(default_factory=list)
+    is_active: bool = True

app/infrastructure/config/__init__.py

@@ -0,0 +1,25 @@
+"""Infrastructure configuration.
+
+This module re-exports all configuration classes and the global
+settings instance for application configuration.
+"""
+
+from app.infrastructure.config.settings import (
+    AppConfig,
+    DBConfig,
+    Environment,
+    KCConfig,
+    SecurityConfig,
+    Settings,
+    settings,
+)
+
+__all__ = [
+    "AppConfig",
+    "DBConfig",
+    "KCConfig",
+    "SecurityConfig",
+    "Environment",
+    "Settings",
+    "settings",
+]

app/infrastructure/config/settings.py

@@ -0,0 +1,285 @@
+"""Application settings with composition pattern.
+
+This module defines the application configuration using pydantic-settings.
+Provides typed configuration for database, Keycloak, security, and app settings.
+"""
+
+from enum import Enum
+from functools import cached_property
+
+from pydantic import Field, PostgresDsn, field_validator
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+
+class Environment(str, Enum):
+    """Application environment modes.
+
+    Defines the available deployment environments.
+    Each environment may have different configuration defaults.
+
+    Attributes:
+        DEV: Development environment with debug features.
+        PROD: Production environment with strict security.
+
+    Example:
+        >>> if settings.environment == Environment.PROD:
+        ...     enable_strict_security()
+    """
+
+    DEV = "dev"
+    PROD = "prod"
+
+
+class AppConfig(BaseSettings):
+    """Application configuration.
+
+    Contains general application settings like name, host, and port.
+
+    Attributes:
+        name: Application display name.
+        debug: Debug mode flag.
+        host: Server bind host.
+        port: Server bind port.
+
+    Example:
+        >>> config = AppConfig(name="My API", port=8000)
+    """
+
+    name: str = "Blog API"
+    debug: bool = False
+    host: str = "0.0.0.0"
+    port: int = 8000
+
+    model_config = SettingsConfigDict(
+        env_prefix="APP_",
+        env_file_encoding="utf-8",
+        case_sensitive=False,
+    )
+
+
+class DBConfig(BaseSettings):
+    """Database configuration.
+
+    Contains database connection settings. Supports both SQLite for
+    development and PostgreSQL for production.
+
+    Attributes:
+        url: Full database URL (optional, can build from components).
+        echo: Enable SQL query logging.
+        host: Database server host.
+        port: Database server port.
+        user: Database username.
+        password: Database password.
+        name: Database name.
+
+    Example:
+        >>> db_config = DBConfig(host="localhost", name="blog")
+    """
+
+    url: str | None = None
+    echo: bool = False
+
+    host: str = "localhost"
+    port: int = 5432
+    user: str = "postgres"
+    password: str = "postgres"
+    name: str = "blog"
+
+    model_config = SettingsConfigDict(
+        env_prefix="DB_",
+        env_file_encoding="utf-8",
+        case_sensitive=False,
+    )
+
+    @field_validator("url")
+    @classmethod
+    def validate_url(cls, v: str | None) -> str | None:
+        """Validate database URL if provided.
+
+        Args:
+            v: Database URL string to validate.
+
+        Returns:
+            Validated URL string.
+
+        Raises:
+            ValueError: If URL does not start with supported prefix.
+        """
+        if v is None:
+            return v
+        if not any(v.startswith(prefix) for prefix in ("sqlite+", "postgresql+")):
+            raise ValueError("Database URL must start with 'sqlite+' or 'postgresql+'")
+        return v
+
+
+class KCConfig(BaseSettings):
+    """Keycloak configuration.
+
+    Contains Keycloak authentication server settings.
+
+    Attributes:
+        server_url: Keycloak server base URL.
+        realm: Keycloak realm name.
+        client_id: OAuth client identifier.
+        client_secret: OAuth client secret.
+        token_cache_ttl: Token cache time-to-live in seconds.
+
+    Example:
+        >>> kc = KCConfig(server_url="http://localhost:8080", realm="blog")
+    """
+
+    server_url: str = "http://localhost:8080"
+    realm: str = "blog"
+    client_id: str = "blog-api"
+    client_secret: str = Field(
+        default="",
+        description="Keycloak client secret - must be set via env in production",
+    )
+    token_cache_ttl: int = 60
+
+    model_config = SettingsConfigDict(
+        env_prefix="KC_",
+        env_file_encoding="utf-8",
+        case_sensitive=False,
+    )
+
+    @property
+    def is_configured(self) -> bool:
+        """Check if Keycloak is properly configured.
+
+        Returns:
+            True if client_secret is set.
+        """
+        return bool(self.client_secret)
+
+
+class SecurityConfig(BaseSettings):
+    """Security configuration.
+
+    Contains security-related settings for JWT and authentication.
+
+    Attributes:
+        secret_key: Secret key for JWT signing.
+        access_token_expire_minutes: Token expiration time in minutes.
+
+    Example:
+        >>> security = SecurityConfig(secret_key="super-secret-key")
+    """
+
+    secret_key: str = Field(
+        default="", description="Secret key for JWT - must be set via env in production"
+    )
+    access_token_expire_minutes: int = 30
+
+    model_config = SettingsConfigDict(
+        env_prefix="SECURITY_",
+        env_file_encoding="utf-8",
+        case_sensitive=False,
+    )
+
+    @property
+    def is_configured(self) -> bool:
+        """Check if security is properly configured.
+
+        Returns:
+            True if secret_key is set.
+        """
+        return bool(self.secret_key)
+
+
+class Settings(BaseSettings):
+    """Application configuration settings with composition.
+
+    Main settings class that composes all sub-configurations.
+    Validates production settings and provides computed properties.
+
+    Attributes:
+        environment: Current deployment environment.
+        app: Application configuration.
+        db: Database configuration.
+        kc: Keycloak configuration.
+        security: Security configuration.
+
+    Raises:
+        ValueError: If required production settings are missing.
+
+    Example:
+        >>> settings = Settings()
+        >>> print(settings.database_url)
+    """
+
+    environment: Environment = Environment.DEV
+
+    app: AppConfig = Field(default_factory=AppConfig)
+    db: DBConfig = Field(default_factory=DBConfig)
+    kc: KCConfig = Field(default_factory=KCConfig)
+    security: SecurityConfig = Field(default_factory=SecurityConfig)
+
+    model_config = SettingsConfigDict(
+        env_file=".env",
+        env_file_encoding="utf-8",
+        case_sensitive=False,
+        env_nested_delimiter="__",
+    )
+
+    def model_post_init(self, __context: object) -> None:
+        """Validate settings after initialization.
+
+        Checks that required settings are configured for production mode.
+
+        Raises:
+            ValueError: If required production settings are missing.
+        """
+        if self.is_prod:
+            if not self.security.is_configured:
+                raise ValueError("SECURITY_SECRET_KEY must be set in production mode")
+            if not self.kc.is_configured:
+                raise ValueError("KC_CLIENT_SECRET must be set in production mode")
+
+    @cached_property
+    def database_url(self) -> str:
+        """Get database URL based on environment.
+
+        Returns configured URL or builds one from components.
+        Uses SQLite for development, PostgreSQL for production.
+
+        Returns:
+            Complete database URL string.
+        """
+        if self.db.url:
+            return self.db.url
+
+        if self.environment == Environment.PROD:
+            return str(
+                PostgresDsn.build(
+                    scheme="postgresql+asyncpg",
+                    username=self.db.user,
+                    password=self.db.password,
+                    host=self.db.host,
+                    port=self.db.port,
+                    path=self.db.name,
+                )
+            )
+
+        return "sqlite+aiosqlite:///./blog.db"
+
+    @property
+    def is_dev(self) -> bool:
+        """Check if running in development mode.
+
+        Returns:
+            True if environment is DEV.
+        """
+        return self.environment == Environment.DEV
+
+    @property
+    def is_prod(self) -> bool:
+        """Check if running in production mode.
+
+        Returns:
+            True if environment is PROD.
+        """
+        return self.environment == Environment.PROD
+
+
+settings = Settings()

app/infrastructure/database/__init__.py

@@ -0,0 +1,26 @@
+"""Database infrastructure.
+
+This module re-exports database connection utilities and ORM models
+for data persistence.
+"""
+
+from app.infrastructure.database.connection import (
+    AsyncSessionLocal,
+    close_db,
+    engine,
+    get_session,
+    get_session_context,
+    init_db,
+)
+from app.infrastructure.database.models import Base, PostORM
+
+__all__ = [
+    "Base",
+    "PostORM",
+    "engine",
+    "AsyncSessionLocal",
+    "get_session",
+    "get_session_context",
+    "init_db",
+    "close_db",
+]

app/infrastructure/database/connection.py

@@ -0,0 +1,94 @@
+"""Database connection and session management.
+
+This module handles database engine creation, session management,
+and connection lifecycle for the application.
+"""
+
+from collections.abc import AsyncGenerator
+from contextlib import asynccontextmanager
+
+from sqlalchemy.ext.asyncio import (
+    AsyncEngine,
+    AsyncSession,
+    async_sessionmaker,
+    create_async_engine,
+)
+
+from app.infrastructure.config import settings
+
+
+def _get_database_url() -> str:
+    """Get database URL with SQLite async compatibility.
+
+    Converts SQLite URL to async format if needed.
+
+    Returns:
+        Database URL string ready for async engine.
+    """
+    url = settings.database_url
+    if url.startswith("sqlite:///") and not url.startswith("sqlite+aiosqlite:///"):
+        return url.replace("sqlite:///", "sqlite+aiosqlite:///")
+    return url
+
+
+engine: AsyncEngine = create_async_engine(
+    _get_database_url(),
+    echo=settings.db.echo,
+    future=True,
+)
+
+AsyncSessionLocal = async_sessionmaker(
+    engine,
+    class_=AsyncSession,
+    expire_on_commit=False,
+    autoflush=False,
+    autocommit=False,
+)
+
+
+async def get_session() -> AsyncGenerator[AsyncSession]:
+    """Get database session.
+
+    Yields:
+        AsyncSession instance for database operations.
+    """
+    async with AsyncSessionLocal() as session:
+        try:
+            yield session
+        finally:
+            await session.close()
+
+
+@asynccontextmanager
+async def get_session_context() -> AsyncGenerator[AsyncSession]:
+    """Get database session as context manager.
+
+    Yields:
+        AsyncSession instance for database operations.
+    """
+    async with AsyncSessionLocal() as session:
+        try:
+            yield session
+        finally:
+            await session.close()
+
+
+async def init_db() -> None:
+    """Initialize database tables.
+
+    Creates all tables defined in the metadata.
+    Should be called on application startup.
+    """
+    from app.infrastructure.database.models import Base
+
+    async with engine.begin() as conn:
+        await conn.run_sync(Base.metadata.create_all)
+
+
+async def close_db() -> None:
+    """Close database connections.
+
+    Disposes of the engine and all connections.
+    Should be called on application shutdown.
+    """
+    await engine.dispose()

app/infrastructure/database/models.py

@@ -0,0 +1,56 @@
+"""SQLAlchemy ORM models.
+
+This module defines the database ORM models that map to database tables.
+Models are used by repositories for data persistence.
+"""
+
+from datetime import UTC, datetime
+from uuid import uuid4
+
+from sqlalchemy import JSON, Boolean, DateTime, String, Text
+from sqlalchemy.orm import Mapped, declarative_base, mapped_column
+
+Base = declarative_base()
+
+
+class PostORM(Base):  # type: ignore[valid-type,misc]
+    """SQLAlchemy model for Blog Post.
+
+    Database table representation of blog posts.
+    Maps to the 'posts' table with all post attributes.
+
+    Attributes:
+        id: Primary key as UUID string.
+        title: Post title (max 200 chars).
+        content: Post content (text).
+        slug: URL-friendly unique identifier.
+        author_id: Author reference.
+        published: Publication status flag.
+        tags: JSON array of tags.
+        created_at: Creation timestamp.
+        updated_at: Last update timestamp.
+
+    Example:
+        >>> post = PostORM(title="Post", content="...", slug="post", author_id="user-1")
+    """
+
+    __tablename__ = "posts"
+
+    id: Mapped[str] = mapped_column(String(36), primary_key=True, default=lambda: str(uuid4()))
+    title: Mapped[str] = mapped_column(String(200), nullable=False)
+    content: Mapped[str] = mapped_column(Text, nullable=False)
+    slug: Mapped[str] = mapped_column(String(200), nullable=False, unique=True, index=True)
+    author_id: Mapped[str] = mapped_column(String(100), nullable=False, index=True)
+    published: Mapped[bool] = mapped_column(Boolean, default=False, nullable=False, index=True)
+    tags: Mapped[list[str]] = mapped_column(JSON, default=list)
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True),
+        default=lambda: datetime.now(UTC),
+        nullable=False,
+    )
+    updated_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True),
+        default=lambda: datetime.now(UTC),
+        onupdate=lambda: datetime.now(UTC),
+        nullable=False,
+    )

app/infrastructure/di/__init__.py

@@ -0,0 +1,11 @@
+"""Dependency Injection using Dishka.
+
+This module provides DI container setup and configuration
+for the application using Dishka library.
+"""
+
+from app.infrastructure.di.container import create_container
+
+__all__ = [
+    "create_container",
+]

app/infrastructure/di/container.py

@@ -0,0 +1,20 @@
+"""Dishka container setup."""
+
+from dishka import AsyncContainer, make_async_container
+
+from app.infrastructure.di.providers import (
+    DatabaseProvider,
+    RepositoryProvider,
+    TransactionManagerProvider,
+    UseCaseProvider,
+)
+
+
+def create_container() -> AsyncContainer:
+    """Create and configure Dishka container."""
+    return make_async_container(
+        DatabaseProvider(),
+        RepositoryProvider(),
+        TransactionManagerProvider(),
+        UseCaseProvider(),
+    )

app/infrastructure/di/providers.py

@@ -0,0 +1,262 @@
+"""Dishka providers for dependency injection.
+
+This module defines Dishka providers for all application dependencies.
+Providers configure how dependencies are created and scoped.
+"""
+
+from collections.abc import AsyncGenerator
+
+from dishka import Provider, Scope, provide
+from sqlalchemy.ext.asyncio import AsyncEngine, AsyncSession
+
+from app.application import (
+    CreatePostUseCase,
+    DeletePostUseCase,
+    GetPostUseCase,
+    ListPostsUseCase,
+    PublishPostUseCase,
+    UpdatePostUseCase,
+)
+from app.application.interfaces import TransactionManager
+from app.domain.repositories import PostRepository
+from app.infrastructure.auth import KeycloakAuthClient, MockKeycloakClient
+from app.infrastructure.config.settings import settings
+from app.infrastructure.database.connection import AsyncSessionLocal, engine
+from app.infrastructure.repositories.post import SQLAlchemyPostRepository
+
+
+class DatabaseProvider(Provider):
+    """Provider for database-related dependencies.
+
+    Provides database engine and session scoped appropriately.
+    Engine is application-scoped, sessions are request-scoped.
+
+    Example:
+        >>> provider = DatabaseProvider()
+    """
+
+    @provide(scope=Scope.APP)
+    def get_engine(self) -> AsyncEngine:
+        """Provide SQLAlchemy engine.
+
+        Returns:
+            AsyncEngine instance for database operations.
+        """
+        return engine
+
+    @provide(scope=Scope.REQUEST)
+    async def get_session(self) -> AsyncGenerator[AsyncSession]:
+        """Provide database session per request.
+
+        Yields:
+            AsyncSession instance for the request lifetime.
+        """
+        async with AsyncSessionLocal() as session:
+            try:
+                yield session
+            finally:
+                await session.close()
+
+
+class RepositoryProvider(Provider):
+    """Provider for repository implementations.
+
+    Provides concrete repository implementations for interfaces.
+    All repositories are request-scoped.
+
+    Example:
+        >>> provider = RepositoryProvider()
+    """
+
+    @provide(scope=Scope.REQUEST)
+    def get_post_repository(self, session: AsyncSession) -> PostRepository:
+        """Provide PostRepository implementation.
+
+        Args:
+            session: Database session from DI container.
+
+        Returns:
+            SQLAlchemyPostRepository instance.
+        """
+        return SQLAlchemyPostRepository(session)
+
+
+class TransactionManagerProvider(Provider):
+    """Provider for transaction manager.
+
+    Provides transaction manager implementation for use cases.
+    Scoped per request for transaction isolation.
+
+    Example:
+        >>> provider = TransactionManagerProvider()
+    """
+
+    @provide(scope=Scope.REQUEST)
+    def get_transaction_manager(self, session: AsyncSession) -> TransactionManager:
+        """Provide TransactionManager implementation.
+
+        Args:
+            session: Database session from DI container.
+
+        Returns:
+            SessionTransactionManager instance.
+        """
+        from app.infrastructure.di.transaction_manager import SessionTransactionManager
+
+        return SessionTransactionManager(session)
+
+
+class UseCaseProvider(Provider):
+    """Provider for use cases.
+
+    Provides all application use cases with their dependencies.
+    All use cases are request-scoped for transaction isolation.
+
+    Example:
+        >>> provider = UseCaseProvider()
+    """
+
+    @provide(scope=Scope.REQUEST)
+    def get_create_post_use_case(
+        self,
+        post_repo: PostRepository,
+        tx_manager: TransactionManager,
+    ) -> CreatePostUseCase:
+        """Provide CreatePostUseCase.
+
+        Args:
+            post_repo: Post repository dependency.
+            tx_manager: Transaction manager dependency.
+
+        Returns:
+            Configured CreatePostUseCase instance.
+        """
+        return CreatePostUseCase(
+            post_repo=post_repo,
+            tx_manager=tx_manager,
+        )
+
+    @provide(scope=Scope.REQUEST)
+    def get_get_post_use_case(
+        self,
+        post_repo: PostRepository,
+        tx_manager: TransactionManager,
+    ) -> GetPostUseCase:
+        """Provide GetPostUseCase.
+
+        Args:
+            post_repo: Post repository dependency.
+            tx_manager: Transaction manager dependency.
+
+        Returns:
+            Configured GetPostUseCase instance.
+        """
+        return GetPostUseCase(
+            post_repo=post_repo,
+            tx_manager=tx_manager,
+        )
+
+    @provide(scope=Scope.REQUEST)
+    def get_update_post_use_case(
+        self,
+        post_repo: PostRepository,
+        tx_manager: TransactionManager,
+    ) -> UpdatePostUseCase:
+        """Provide UpdatePostUseCase.
+
+        Args:
+            post_repo: Post repository dependency.
+            tx_manager: Transaction manager dependency.
+
+        Returns:
+            Configured UpdatePostUseCase instance.
+        """
+        return UpdatePostUseCase(
+            post_repo=post_repo,
+            tx_manager=tx_manager,
+        )
+
+    @provide(scope=Scope.REQUEST)
+    def get_delete_post_use_case(
+        self,
+        post_repo: PostRepository,
+        tx_manager: TransactionManager,
+    ) -> DeletePostUseCase:
+        """Provide DeletePostUseCase.
+
+        Args:
+            post_repo: Post repository dependency.
+            tx_manager: Transaction manager dependency.
+
+        Returns:
+            Configured DeletePostUseCase instance.
+        """
+        return DeletePostUseCase(
+            post_repo=post_repo,
+            tx_manager=tx_manager,
+        )
+
+    @provide(scope=Scope.REQUEST)
+    def get_list_posts_use_case(
+        self,
+        post_repo: PostRepository,
+        tx_manager: TransactionManager,
+    ) -> ListPostsUseCase:
+        """Provide ListPostsUseCase.
+
+        Args:
+            post_repo: Post repository dependency.
+            tx_manager: Transaction manager dependency.
+
+        Returns:
+            Configured ListPostsUseCase instance.
+        """
+        return ListPostsUseCase(
+            post_repo=post_repo,
+            tx_manager=tx_manager,
+        )
+
+    @provide(scope=Scope.REQUEST)
+    def get_publish_post_use_case(
+        self,
+        post_repo: PostRepository,
+        tx_manager: TransactionManager,
+    ) -> PublishPostUseCase:
+        """Provide PublishPostUseCase.
+
+        Args:
+            post_repo: Post repository dependency.
+            tx_manager: Transaction manager dependency.
+
+        Returns:
+            Configured PublishPostUseCase instance.
+        """
+        return PublishPostUseCase(
+            post_repo=post_repo,
+            tx_manager=tx_manager,
+        )
+
+
+class KeycloakProvider(Provider):
+    """Provider for Keycloak authentication client.
+
+    Provides Keycloak client as application-scoped singleton.
+    In development mode uses MockKeycloakClient for local testing.
+
+    Example:
+        >>> provider = KeycloakProvider()
+    """
+
+    @provide(scope=Scope.APP)
+    def get_keycloak_client(self) -> KeycloakAuthClient:
+        """Provide KeycloakAuthClient or MockKeycloakClient singleton.
+
+        Returns MockKeycloakClient in dev mode for local testing
+        without a real Keycloak server.
+
+        Returns:
+            KeycloakAuthClient instance.
+        """
+        if settings.is_dev:
+            return MockKeycloakClient()  # type: ignore[return-value]
+        return KeycloakAuthClient(settings)

app/infrastructure/di/transaction_manager.py

@@ -0,0 +1,48 @@
+"""SQLAlchemy implementation of Transaction Manager.
+
+This module provides the concrete implementation of TransactionManager
+using SQLAlchemy async sessions for transaction control.
+"""
+
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.application.interfaces import TransactionManager
+
+
+class SessionTransactionManager(TransactionManager):
+    """SQLAlchemy Session-based Transaction Manager.
+
+    Implements transaction control using SQLAlchemy async session.
+    Tracks commit state to prevent duplicate commits.
+
+    Attributes:
+        _session: SQLAlchemy async session for transactions.
+        _committed: Flag indicating if transaction was committed.
+
+    Example:
+        >>> tx_manager = SessionTransactionManager(session)
+        >>> await tx_manager.commit()
+    """
+
+    def __init__(self, session: AsyncSession) -> None:
+        """Initialize transaction manager.
+
+        Args:
+            session: SQLAlchemy async session instance.
+        """
+        self._session = session
+        self._committed: bool = False
+
+    async def commit(self) -> None:
+        """Commit the current transaction.
+
+        Persists all pending changes to the database.
+        """
+        await self._session.commit()
+
+    async def rollback(self) -> None:
+        """Rollback the current transaction.
+
+        Discards all pending changes.
+        """
+        await self._session.rollback()

app/infrastructure/middleware/__init__.py

@@ -0,0 +1,19 @@
+"""Infrastructure middleware.
+
+This module re-exports exception handling middleware for
+centralized error management in the application.
+"""
+
+from app.infrastructure.middleware.error_handler import (
+    domain_exception_handler,
+    generic_exception_handler,
+    http_exception_handler,
+    register_exception_handlers,
+)
+
+__all__ = [
+    "domain_exception_handler",
+    "http_exception_handler",
+    "generic_exception_handler",
+    "register_exception_handlers",
+]

app/infrastructure/middleware/error_handler.py

@@ -0,0 +1,132 @@
+"""Exception handling middleware.
+
+This module provides exception handlers for FastAPI application.
+Maps domain exceptions to appropriate HTTP status codes.
+"""
+
+from datetime import UTC, datetime
+
+from fastapi import FastAPI, Request
+from fastapi.responses import JSONResponse
+from starlette.exceptions import HTTPException as StarletteHTTPException
+
+from app.domain.exceptions import (
+    AlreadyExistsException,
+    DomainException,
+    ForbiddenException,
+    NotFoundException,
+    UnauthorizedException,
+    ValidationException,
+)
+
+
+def get_status_code(exc: DomainException) -> int:
+    """Map domain exceptions to HTTP status codes.
+
+    Args:
+        exc: Domain exception instance.
+
+    Returns:
+        HTTP status code for the exception type.
+    """
+    match exc:
+        case ValidationException():
+            return 400
+        case UnauthorizedException():
+            return 401
+        case ForbiddenException():
+            return 403
+        case NotFoundException():
+            return 404
+        case AlreadyExistsException():
+            return 409
+        case _:
+            return 500
+
+
+async def domain_exception_handler(request: Request, exc: DomainException) -> JSONResponse:
+    """Handle domain exceptions.
+
+    Converts domain exceptions to JSON error responses.
+
+    Args:
+        request: FastAPI request object.
+        exc: Domain exception instance.
+
+    Returns:
+        JSONResponse with error details.
+    """
+    status_code = get_status_code(exc)
+    return JSONResponse(
+        status_code=status_code,
+        content={
+            "error": exc.__class__.__name__,
+            "message": exc.message,
+            "timestamp": datetime.now(UTC).isoformat(),
+            "path": str(request.url.path),
+        },
+    )
+
+
+async def http_exception_handler(request: Request, exc: StarletteHTTPException) -> JSONResponse:
+    """Handle HTTP exceptions.
+
+    Converts Starlette HTTP exceptions to JSON error responses.
+
+    Args:
+        request: FastAPI request object.
+        exc: Starlette HTTP exception instance.
+
+    Returns:
+        JSONResponse with error details.
+    """
+    return JSONResponse(
+        status_code=exc.status_code,
+        content={
+            "error": "HTTPException",
+            "message": str(exc.detail),
+            "timestamp": datetime.now(UTC).isoformat(),
+            "path": str(request.url.path),
+        },
+    )
+
+
+async def generic_exception_handler(request: Request, exc: Exception) -> JSONResponse:
+    """Handle generic exceptions.
+
+    Converts unhandled exceptions to generic error responses.
+    Hides internal details for security.
+
+    Args:
+        request: FastAPI request object.
+        exc: Generic exception instance.
+
+    Returns:
+        JSONResponse with generic error message.
+    """
+    return JSONResponse(
+        status_code=500,
+        content={
+            "error": "InternalServerError",
+            "message": "An unexpected error occurred",
+            "timestamp": datetime.now(UTC).isoformat(),
+            "path": str(request.url.path),
+        },
+    )
+
+
+def register_exception_handlers(app: FastAPI) -> None:
+    """Register all exception handlers with FastAPI app.
+
+    Args:
+        app: FastAPI application instance.
+
+    Raises:
+        TypeError: If app is not a FastAPI instance.
+    """
+    if not isinstance(app, FastAPI):
+        raise TypeError("app must be a FastAPI instance")
+
+    app.add_exception_handler(DomainException, domain_exception_handler)  # type: ignore[arg-type]
+    app.add_exception_handler(StarletteHTTPException, http_exception_handler)  # type: ignore[arg-type]
+    app.add_exception_handler(Exception, generic_exception_handler)

app/infrastructure/repositories/__init__.py

@@ -0,0 +1,9 @@
+"""Repository implementations.
+
+This module re-exports concrete repository implementations
+for data access using SQLAlchemy ORM.
+"""
+
+from app.infrastructure.repositories.post import SQLAlchemyPostRepository
+
+__all__ = ["SQLAlchemyPostRepository"]

app/infrastructure/repositories/post.py

@@ -0,0 +1,286 @@
+"""SQLAlchemy implementation of PostRepository.
+
+This module provides the concrete implementation of PostRepository
+using SQLAlchemy ORM for data persistence.
+"""
+
+from uuid import UUID
+
+from sqlalchemy import or_, select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.domain.entities import Post
+from app.domain.repositories import PostRepository
+from app.domain.value_objects import Content, Slug, Title
+from app.infrastructure.database.models import PostORM
+
+
+class SQLAlchemyPostRepository(PostRepository):
+    """SQLAlchemy implementation of Post repository.
+
+    Provides data access methods for Post entities using SQLAlchemy ORM.
+    Handles conversion between domain entities and ORM models.
+
+    Attributes:
+        _session: SQLAlchemy async session for database operations.
+
+    Example:
+        >>> repo = SQLAlchemyPostRepository(session)
+        >>> post = await repo.get_by_id(post_id)
+    """
+
+    def __init__(self, session: AsyncSession) -> None:
+        """Initialize repository with session.
+
+        Args:
+            session: SQLAlchemy async session instance.
+        """
+        self._session = session
+
+    def _to_domain(self, orm: PostORM) -> Post:
+        """Convert ORM model to domain entity.
+
+        Args:
+            orm: SQLAlchemy ORM model instance.
+
+        Returns:
+            Domain Post entity with validated value objects.
+        """
+        return Post(
+            id=UUID(orm.id),
+            title=Title(orm.title),
+            content=Content(orm.content),
+            slug=Slug(orm.slug),
+            author_id=orm.author_id,
+            published=orm.published,
+            tags=orm.tags or [],
+            created_at=orm.created_at,
+            updated_at=orm.updated_at,
+        )
+
+    def _to_orm(self, post: Post) -> PostORM:
+        """Convert domain entity to ORM model.
+
+        Args:
+            post: Domain Post entity.
+
+        Returns:
+            SQLAlchemy ORM model instance.
+        """
+        return PostORM(
+            id=str(post.id),
+            title=post.title.value,
+            content=post.content.value,
+            slug=post.slug.value,
+            author_id=post.author_id,
+            published=post.published,
+            tags=post.tags,
+            created_at=post.created_at,
+            updated_at=post.updated_at,
+        )
+
+    async def get_by_id(self, entity_id: UUID) -> Post | None:
+        """Get post by ID.
+
+        Args:
+            entity_id: Unique identifier of the post.
+
+        Returns:
+            Post entity if found, None otherwise.
+        """
+        result = await self._session.execute(select(PostORM).where(PostORM.id == str(entity_id)))
+        orm = result.scalar_one_or_none()
+        return self._to_domain(orm) if orm else None
+
+    async def get_all(self) -> list[Post]:
+        """Get all posts.
+
+        Returns:
+            List of all Post entities.
+        """
+        result = await self._session.execute(select(PostORM))
+        orms = result.scalars().all()
+        return [self._to_domain(orm) for orm in orms]
+
+    async def add(self, entity: Post) -> None:
+        """Add new post.
+
+        Args:
+            entity: Post entity to add.
+        """
+        orm = self._to_orm(entity)
+        self._session.add(orm)
+
+    async def update(self, entity: Post) -> None:
+        """Update existing post.
+
+        Args:
+            entity: Post entity with updated data.
+        """
+        result = await self._session.execute(select(PostORM).where(PostORM.id == str(entity.id)))
+        orm = result.scalar_one()
+
+        orm.title = entity.title.value
+        orm.content = entity.content.value
+        orm.slug = entity.slug.value
+        orm.published = entity.published
+        orm.tags = entity.tags
+        orm.updated_at = entity.updated_at
+
+    async def delete(self, entity_id: UUID) -> None:
+        """Delete post by ID.
+
+        Args:
+            entity_id: Unique identifier of the post to delete.
+        """
+        result = await self._session.execute(select(PostORM).where(PostORM.id == str(entity_id)))
+        orm = result.scalar_one_or_none()
+        if orm:
+            await self._session.delete(orm)
+
+    async def exists(self, entity_id: UUID) -> bool:
+        """Check if post exists.
+
+        Args:
+            entity_id: Unique identifier of the post.
+
+        Returns:
+            True if post exists, False otherwise.
+        """
+        result = await self._session.execute(select(PostORM).where(PostORM.id == str(entity_id)))
+        return result.scalar_one_or_none() is not None
+
+    async def get_by_slug(self, slug: str) -> Post | None:
+        """Get post by slug.
+
+        Args:
+            slug: URL-friendly slug identifier.
+
+        Returns:
+            Post entity if found, None otherwise.
+        """
+        result = await self._session.execute(select(PostORM).where(PostORM.slug == slug))
+        orm = result.scalar_one_or_none()
+        return self._to_domain(orm) if orm else None
+
+    async def get_by_author(
+        self,
+        author_id: str,
+        limit: int | None = None,
+        offset: int | None = None,
+    ) -> list[Post]:
+        """Get posts by author.
+
+        Args:
+            author_id: Identifier of the author.
+            limit: Maximum number of posts to return.
+            offset: Number of posts to skip.
+
+        Returns:
+            List of Post entities by the author.
+        """
+        query = (
+            select(PostORM)
+            .where(PostORM.author_id == author_id)
+            .order_by(PostORM.created_at.desc())
+        )
+        if limit is not None:
+            query = query.limit(limit)
+        if offset is not None:
+            query = query.offset(offset)
+        result = await self._session.execute(query)
+        orms = result.scalars().all()
+        return [self._to_domain(orm) for orm in orms]
+
+    async def get_published(
+        self,
+        limit: int | None = None,
+        offset: int | None = None,
+    ) -> list[Post]:
+        """Get published posts.
+
+        Args:
+            limit: Maximum number of posts to return.
+            offset: Number of posts to skip.
+
+        Returns:
+            List of published Post entities.
+        """
+        query = (
+            select(PostORM).where(PostORM.published.is_(True)).order_by(PostORM.created_at.desc())
+        )
+        if limit is not None:
+            query = query.limit(limit)
+        if offset is not None:
+            query = query.offset(offset)
+        result = await self._session.execute(query)
+        orms = result.scalars().all()
+        return [self._to_domain(orm) for orm in orms]
+
+    async def get_by_tag(
+        self,
+        tag: str,
+        limit: int | None = None,
+        offset: int | None = None,
+    ) -> list[Post]:
+        """Get posts by tag.
+
+        Args:
+            tag: Tag to filter by.
+            limit: Maximum number of posts to return.
+            offset: Number of posts to skip.
+
+        Returns:
+            List of Post entities with the tag.
+        """
+        query = select(PostORM).where(PostORM.tags.contains([tag]))
+        if limit is not None:
+            query = query.limit(limit)
+        if offset is not None:
+            query = query.offset(offset)
+        result = await self._session.execute(query)
+        orms = result.scalars().all()
+        return [self._to_domain(orm) for orm in orms]
+
+    async def slug_exists(self, slug: str) -> bool:
+        """Check if slug exists.
+
+        Args:
+            slug: Slug to check for existence.
+
+        Returns:
+            True if slug exists, False otherwise.
+        """
+        result = await self._session.execute(select(PostORM).where(PostORM.slug == slug))
+        return result.scalar_one_or_none() is not None
+
+    async def search(
+        self,
+        query: str,
+        limit: int | None = None,
+        offset: int | None = None,
+    ) -> list[Post]:
+        """Search posts.
+
+        Args:
+            query: Search query string.
+            limit: Maximum number of posts to return.
+            offset: Number of posts to skip.
+
+        Returns:
+            List of Post entities matching the query.
+        """
+        search_pattern = f"%{query}%"
+        stmt = select(PostORM).where(
+            or_(
+                PostORM.title.ilike(search_pattern),
+                PostORM.content.ilike(search_pattern),
+            )
+        )
+        if limit is not None:
+            stmt = stmt.limit(limit)
+        if offset is not None:
+            stmt = stmt.offset(offset)
+        result = await self._session.execute(stmt)
+        orms = result.scalars().all()
+        return [self._to_domain(orm) for orm in orms]

app/main.py

@@ -1,22 +1,142 @@
+"""Application entry point with DDD architecture.
+
+This module is the main entry point for the FastAPI application.
+Configures DI container, middleware, and routes following DDD principles.
+"""
+
+from collections.abc import AsyncGenerator, Awaitable, Callable
 from contextlib import asynccontextmanager
-from typing import AsyncGenerator
 
 import uvicorn
-from fastapi import FastAPI
+from dishka import make_async_container
+from dishka.integrations.fastapi import setup_dishka
+from fastapi import FastAPI, Request, Response
+from fastapi.middleware.cors import CORSMiddleware
+from fastapi.responses import HTMLResponse
+from fastapi.staticfiles import StaticFiles
+
+from app.infrastructure import close_db, init_db, register_exception_handlers, settings
+from app.infrastructure.di.providers import (
+    DatabaseProvider,
+    KeycloakProvider,
+    RepositoryProvider,
+    TransactionManagerProvider,
+    UseCaseProvider,
+)
+from app.presentation import router
+from app.presentation.web import auth_router
+from app.presentation.web import router as web_router
+from app.presentation.web.error_handlers import register_error_handlers
+from app.presentation.web.flash import setup_flash_manager
 
 
 @asynccontextmanager
-async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
+async def lifespan(app: FastAPI) -> AsyncGenerator[None]:
+    """Application lifespan manager.
+
+    Handles startup and shutdown tasks for the application.
+
+    Args:
+        app: FastAPI application instance.
+
+    Yields:
+        None during application runtime.
+    """
+    await init_db()
     yield
+    await close_db()
 
 
 def app_factory() -> FastAPI:
-    app = FastAPI(lifespan=lifespan)
+    """Create and configure FastAPI application.
+
+    Sets up DI container, exception handlers, middleware, and routes.
+
+    Returns:
+        Configured FastAPI application instance.
+    """
+    app = FastAPI(
+        title=settings.app.name,
+        debug=settings.app.debug,
+        lifespan=lifespan,
+        docs_url="/docs" if settings.is_dev else None,
+        redoc_url="/redoc" if settings.is_dev else None,
+    )
+
+    container = make_async_container(
+        DatabaseProvider(),
+        RepositoryProvider(),
+        TransactionManagerProvider(),
+        UseCaseProvider(),
+        KeycloakProvider(),
+    )
+    setup_dishka(container, app)
+
+    register_exception_handlers(app)
+    register_error_handlers(app)
+
+    @app.middleware("http")
+    async def flash_middleware(
+        request: Request, call_next: Callable[[Request], Awaitable[Response]]
+    ) -> Response:
+        """Middleware to setup flash manager for each request."""
+        await setup_flash_manager(request)
+        response = await call_next(request)
+        if hasattr(request.state, "flash_manager"):
+            request.state.flash_manager.set_cookie(response)
+        return response
+
+    app.add_middleware(
+        CORSMiddleware,
+        allow_origins=["*"],
+        allow_credentials=True,
+        allow_methods=["*"],
+        allow_headers=["*"],
+    )
+
+    app.include_router(router, prefix="/api")
+    app.include_router(web_router)
+    app.include_router(auth_router)
+    app.mount("/static", StaticFiles(directory="static"), name="static")
+
+    @app.get("/", response_class=HTMLResponse)
+    async def root_redirect() -> HTMLResponse:
+        """Redirect root URL to web UI.
+
+        Returns:
+            HTMLResponse with redirect to web interface.
+        """
+        return HTMLResponse(
+            content='<meta http-equiv="refresh" content="0;url=/web/">', status_code=200
+        )
+
+    @app.get("/health", tags=["health"])
+    async def health_check() -> dict[str, str]:
+        """Health check endpoint.
+
+        Returns:
+            Status information dictionary.
+        """
+        return {
+            "status": "ok",
+            "app": settings.app.name,
+            "env": settings.environment.value,
+        }
+
     return app
 
 
 def main() -> None:
-    uvicorn.run(app_factory, factory=True, host="0.0.0.0", port=8000)
+    """Run the application.
+
+    Starts uvicorn server with application factory.
+    """
+    uvicorn.run(
+        app_factory,
+        factory=True,
+        host=settings.app.host,
+        port=settings.app.port,
+    )
 
 
 if __name__ == "__main__":

app/modules/__init__.py

@@ -1 +0,0 @@
-"""Feature modules - business logic organized by domain."""

app/presentation/__init__.py

@@ -0,0 +1,21 @@
+"""Presentation layer exports.
+
+This module re-exports presentation layer components including
+API router and Pydantic schemas.
+"""
+
+from app.presentation.api import router
+from app.presentation.schemas import (
+    PostCreateSchema,
+    PostListResponseSchema,
+    PostResponseSchema,
+    PostUpdateSchema,
+)
+
+__all__ = [
+    "router",
+    "PostCreateSchema",
+    "PostUpdateSchema",
+    "PostResponseSchema",
+    "PostListResponseSchema",
+]

app/presentation/api/__init__.py

@@ -0,0 +1,12 @@
+"""API router configuration.
+
+This module sets up the main API router and includes versioned
+sub-routers for API organization.
+"""
+
+from fastapi import APIRouter
+
+from app.presentation.api.v1 import router as v1_router
+
+router = APIRouter()
+router.include_router(v1_router)

app/presentation/api/deps.py

@@ -0,0 +1,189 @@
+"""API dependencies using Dishka.
+
+This module defines FastAPI dependencies for authentication, authorization,
+and use case injection using Dishka DI container.
+"""
+
+from typing import Annotated, Any
+
+from dishka.integrations.fastapi import FromDishka
+from fastapi import Depends, Request
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+
+from app.application import (
+    CreatePostUseCase,
+    DeletePostUseCase,
+    GetPostUseCase,
+    ListPostsUseCase,
+    PublishPostUseCase,
+    UpdatePostUseCase,
+)
+from app.domain.exceptions import ForbiddenException, UnauthorizedException
+from app.domain.roles import Role, get_effective_role
+from app.infrastructure.auth import KeycloakAuthClient, TokenInfo
+
+CreatePostDep = FromDishka[CreatePostUseCase]
+GetPostDep = FromDishka[GetPostUseCase]
+UpdatePostDep = FromDishka[UpdatePostUseCase]
+DeletePostDep = FromDishka[DeletePostUseCase]
+ListPostsDep = FromDishka[ListPostsUseCase]
+PublishPostDep = FromDishka[PublishPostUseCase]
+
+security = HTTPBearer(auto_error=False)
+
+
+def get_keycloak_client(request: Request) -> KeycloakAuthClient:
+    """Get Keycloak client from DI container via request state.
+
+    Args:
+        request: FastAPI request object.
+
+    Returns:
+        KeycloakAuthClient instance from container.
+    """
+    client: KeycloakAuthClient = request.state.dishka_container.get(KeycloakAuthClient)
+    return client
+
+
+async def get_current_token_info(
+    credentials: Annotated[HTTPAuthorizationCredentials | None, Depends(security)],
+    request: Request,
+) -> TokenInfo:
+    """Validate token and return token info from Keycloak.
+
+    Args:
+        credentials: HTTP authorization credentials.
+        request: FastAPI request object.
+
+    Returns:
+        Validated TokenInfo instance.
+
+    Raises:
+        UnauthorizedException: If no credentials or invalid token.
+    """
+    if not credentials:
+        raise UnauthorizedException("Authentication required")
+
+    keycloak_client = get_keycloak_client(request)
+    token = credentials.credentials
+    token_info = await keycloak_client.introspect_token(token)
+
+    if not token_info.is_valid:
+        raise UnauthorizedException("Invalid or expired token")
+
+    return token_info
+
+
+async def get_current_user_id(
+    token_info: Annotated[TokenInfo, Depends(get_current_token_info)],
+) -> str:
+    """Get current user ID from validated token.
+
+    Args:
+        token_info: Validated token info.
+
+    Returns:
+        User ID string from token.
+    """
+    return token_info.user_id
+
+
+CurrentUserDep = Annotated[str, Depends(get_current_user_id)]
+TokenInfoDep = Annotated[TokenInfo, Depends(get_current_token_info)]
+
+
+async def get_optional_token_info(
+    credentials: Annotated[HTTPAuthorizationCredentials | None, Depends(security)],
+    request: Request,
+) -> TokenInfo | None:
+    """Get token info if valid token provided, otherwise None.
+
+    For endpoints that support both authenticated and guest access.
+
+    Args:
+        credentials: HTTP authorization credentials.
+        request: FastAPI request object.
+
+    Returns:
+        TokenInfo if valid, None otherwise.
+    """
+    if not credentials:
+        return None
+
+    keycloak_client = get_keycloak_client(request)
+    token = credentials.credentials
+    token_info = await keycloak_client.introspect_token(token)
+
+    if token_info.is_valid:
+        return token_info
+
+    return None
+
+
+OptionalTokenInfoDep = Annotated[TokenInfo | None, Depends(get_optional_token_info)]
+
+
+async def get_optional_user_id(
+    token_info: OptionalTokenInfoDep,
+) -> str | None:
+    """Get current user ID if token is valid, otherwise None.
+
+    Args:
+        token_info: Optional token info.
+
+    Returns:
+        User ID if authenticated, None for guests.
+    """
+    if token_info:
+        return token_info.user_id
+    return None
+
+
+OptionalUserDep = Annotated[str | None, Depends(get_optional_user_id)]
+
+
+def get_current_role(token_info: OptionalTokenInfoDep) -> Role:
+    """Get effective role from token info.
+
+    Returns GUEST if no valid token provided.
+
+    Args:
+        token_info: Optional token info.
+
+    Returns:
+        Effective Role enum value.
+    """
+    if token_info and token_info.roles:
+        return get_effective_role(token_info.roles)
+    return Role.GUEST
+
+
+CurrentRoleDep = Annotated[Role, Depends(get_current_role)]
+
+
+def require_roles(allowed_roles: list[Role]) -> Any:
+    """Create dependency that checks if user has one of the allowed roles.
+
+    Args:
+        allowed_roles: List of roles allowed to access.
+
+    Returns:
+        FastAPI Depends for role checking.
+
+    Raises:
+        ForbiddenException: If user role is not in allowed list.
+    """
+
+    async def check_role(role: CurrentRoleDep) -> Role:
+        if role not in allowed_roles:
+            raise ForbiddenException(
+                f"Access denied. Required roles: {[r.value for r in allowed_roles]}"
+            )
+        return role
+
+    return Depends(check_role)
+
+
+RequireAdmin = require_roles([Role.ADMIN])
+RequireUser = require_roles([Role.USER, Role.ADMIN])
+RequireAny = require_roles([Role.GUEST, Role.USER, Role.ADMIN])

app/presentation/api/v1/__init__.py

@@ -0,0 +1,12 @@
+"""API v1 router.
+
+This module sets up the version 1 API router and includes
+all v1 endpoint routers.
+"""
+
+from fastapi import APIRouter
+
+from app.presentation.api.v1.posts import router as posts_router
+
+router = APIRouter(prefix="/v1")
+router.include_router(posts_router)

app/presentation/api/v1/posts.py

@@ -0,0 +1,346 @@
+"""Posts API routes.
+
+This module defines FastAPI routes for blog post operations.
+Implements CRUD endpoints with authentication and authorization.
+"""
+
+from uuid import UUID
+
+from dishka.integrations.fastapi import DishkaRoute
+from fastapi import APIRouter, status
+
+from app.application.dtos import CreatePostDTO, UpdatePostDTO
+from app.domain.exceptions import ForbiddenException
+from app.domain.roles import Permission, has_permission
+from app.presentation.api.deps import (
+    CreatePostDep,
+    CurrentRoleDep,
+    CurrentUserDep,
+    DeletePostDep,
+    GetPostDep,
+    ListPostsDep,
+    PublishPostDep,
+    UpdatePostDep,
+)
+from app.presentation.schemas import (
+    PostCreateSchema,
+    PostListResponseSchema,
+    PostResponseSchema,
+    PostUpdateSchema,
+)
+
+router = APIRouter(prefix="/posts", tags=["posts"], route_class=DishkaRoute)
+
+
+@router.post(
+    "",
+    response_model=PostResponseSchema,
+    status_code=status.HTTP_201_CREATED,
+    summary="Create a new post",
+)
+async def create_post(
+    schema: PostCreateSchema,
+    use_case: CreatePostDep,
+    current_user_id: CurrentUserDep,
+) -> PostResponseSchema:
+    """Create a new blog post.
+
+    Args:
+        schema: Post creation data.
+        use_case: CreatePostUseCase dependency.
+        current_user_id: Authenticated user ID.
+
+    Returns:
+        PostResponseSchema with created post data.
+    """
+    dto = CreatePostDTO(
+        title=schema.title,
+        content=schema.content,
+        author_id=current_user_id,
+        tags=schema.tags,
+    )
+    result = await use_case.execute(dto)
+    return PostResponseSchema(**result.__dict__)
+
+
+@router.get(
+    "",
+    response_model=PostListResponseSchema,
+    summary="List posts",
+)
+async def list_posts(
+    use_case: ListPostsDep,
+    role: CurrentRoleDep,
+    include_unpublished: bool = False,
+    limit: int = 10,
+    offset: int = 0,
+) -> PostListResponseSchema:
+    """Get blog posts with optional filtering and pagination.
+
+    Args:
+        use_case: ListPostsUseCase dependency.
+        role: Current user role.
+        include_unpublished: If True, returns all posts including drafts.
+            Only admins can use this parameter.
+        limit: Maximum number of posts to return (default: 10, max: 100).
+        offset: Number of posts to skip (default: 0).
+
+    Returns:
+        PostListResponseSchema with paginated posts.
+
+    Raises:
+        ForbiddenException: If non-admin tries to include unpublished posts.
+    """
+    limit = max(1, min(limit, 100))
+    offset = max(0, offset)
+
+    if include_unpublished:
+        if not has_permission(role, Permission.POST_READ_UNPUBLISHED):
+            raise ForbiddenException("Only admins can view unpublished posts")
+        results = await use_case.all_posts()
+    else:
+        results = await use_case.published_posts(limit=limit, offset=offset)
+
+    items = [PostResponseSchema(**r.__dict__) for r in results]
+    return PostListResponseSchema(items=items, total=len(items))
+
+
+@router.get(
+    "/published",
+    response_model=PostListResponseSchema,
+    summary="List published posts",
+)
+async def list_published_posts(
+    use_case: ListPostsDep,
+) -> PostListResponseSchema:
+    """Get all published blog posts.
+
+    Args:
+        use_case: ListPostsUseCase dependency.
+
+    Returns:
+        PostListResponseSchema with published posts.
+    """
+    results = await use_case.published_posts()
+    items = [PostResponseSchema(**r.__dict__) for r in results]
+    return PostListResponseSchema(items=items, total=len(items))
+
+
+@router.get(
+    "/search",
+    response_model=PostListResponseSchema,
+    summary="Search posts",
+)
+async def search_posts(
+    query: str,
+    use_case: ListPostsDep,
+) -> PostListResponseSchema:
+    """Search posts by query.
+
+    Args:
+        query: Search query string.
+        use_case: ListPostsUseCase dependency.
+
+    Returns:
+        PostListResponseSchema with matching posts.
+    """
+    results = await use_case.search(query)
+    items = [PostResponseSchema(**r.__dict__) for r in results]
+    return PostListResponseSchema(items=items, total=len(items))
+
+
+@router.get(
+    "/by-tag/{tag}",
+    response_model=PostListResponseSchema,
+    summary="Get posts by tag",
+)
+async def get_posts_by_tag(
+    tag: str,
+    use_case: ListPostsDep,
+) -> PostListResponseSchema:
+    """Get posts by tag.
+
+    Args:
+        tag: Tag to filter by.
+        use_case: ListPostsUseCase dependency.
+
+    Returns:
+        PostListResponseSchema with tagged posts.
+    """
+    results = await use_case.by_tag(tag)
+    items = [PostResponseSchema(**r.__dict__) for r in results]
+    return PostListResponseSchema(items=items, total=len(items))
+
+
+@router.get(
+    "/by-author/{author_id}",
+    response_model=PostListResponseSchema,
+    summary="Get posts by author",
+)
+async def get_posts_by_author(
+    author_id: str,
+    use_case: ListPostsDep,
+) -> PostListResponseSchema:
+    """Get posts by author.
+
+    Args:
+        author_id: Author identifier.
+        use_case: ListPostsUseCase dependency.
+
+    Returns:
+        PostListResponseSchema with author's posts.
+    """
+    results = await use_case.by_author(author_id)
+    items = [PostResponseSchema(**r.__dict__) for r in results]
+    return PostListResponseSchema(items=items, total=len(items))
+
+
+@router.get(
+    "/{post_id}",
+    response_model=PostResponseSchema,
+    summary="Get post by ID",
+)
+async def get_post(
+    post_id: UUID,
+    use_case: GetPostDep,
+) -> PostResponseSchema:
+    """Get a post by its ID.
+
+    Args:
+        post_id: Unique post identifier.
+        use_case: GetPostUseCase dependency.
+
+    Returns:
+        PostResponseSchema with post data.
+    """
+    result = await use_case.by_id(post_id)
+    return PostResponseSchema(**result.__dict__)
+
+
+@router.get(
+    "/slug/{slug}",
+    response_model=PostResponseSchema,
+    summary="Get post by slug",
+)
+async def get_post_by_slug(
+    slug: str,
+    use_case: GetPostDep,
+) -> PostResponseSchema:
+    """Get a post by its slug.
+
+    Args:
+        slug: URL-friendly slug identifier.
+        use_case: GetPostUseCase dependency.
+
+    Returns:
+        PostResponseSchema with post data.
+    """
+    result = await use_case.by_slug(slug)
+    return PostResponseSchema(**result.__dict__)
+
+
+@router.patch(
+    "/{post_id}",
+    response_model=PostResponseSchema,
+    summary="Update post",
+)
+async def update_post(
+    post_id: UUID,
+    schema: PostUpdateSchema,
+    use_case: UpdatePostDep,
+    current_user_id: CurrentUserDep,
+    role: CurrentRoleDep,
+) -> PostResponseSchema:
+    """Update a post.
+
+    Args:
+        post_id: Unique post identifier.
+        schema: Update data.
+        use_case: UpdatePostUseCase dependency.
+        current_user_id: Authenticated user ID.
+        role: Current user role.
+
+    Returns:
+        PostResponseSchema with updated post data.
+    """
+    dto = UpdatePostDTO(
+        title=schema.title,
+        content=schema.content,
+        tags=schema.tags,
+    )
+    result = await use_case.execute(post_id, dto, current_user_id, role)
+    return PostResponseSchema(**result.__dict__)
+
+
+@router.delete(
+    "/{post_id}",
+    status_code=status.HTTP_204_NO_CONTENT,
+    summary="Delete post",
+)
+async def delete_post(
+    post_id: UUID,
+    use_case: DeletePostDep,
+    current_user_id: CurrentUserDep,
+    role: CurrentRoleDep,
+) -> None:
+    """Delete a post.
+
+    Args:
+        post_id: Unique post identifier.
+        use_case: DeletePostUseCase dependency.
+        current_user_id: Authenticated user ID.
+        role: Current user role.
+    """
+    await use_case.execute(post_id, current_user_id, role)
+
+
+@router.post(
+    "/{post_id}/publish",
+    response_model=PostResponseSchema,
+    summary="Publish post",
+)
+async def publish_post(
+    post_id: UUID,
+    use_case: PublishPostDep,
+    current_user_id: CurrentUserDep,
+    role: CurrentRoleDep,
+) -> PostResponseSchema:
+    """Publish a post.
+
+    Args:
+        post_id: Unique post identifier.
+        use_case: PublishPostUseCase dependency.
+        current_user_id: Authenticated user ID.
+        role: Current user role.
+
+    Returns:
+        PostResponseSchema with published post data.
+    """
+    result = await use_case.publish(post_id, current_user_id, role)
+    return PostResponseSchema(**result.__dict__)
+
+
+@router.post(
+    "/{post_id}/unpublish",
+    response_model=PostResponseSchema,
+    summary="Unpublish post",
+)
+async def unpublish_post(
+    post_id: UUID,
+    use_case: PublishPostDep,
+    current_user_id: CurrentUserDep,
+    role: CurrentRoleDep,
+) -> PostResponseSchema:
+    """Unpublish a post.
+
+    Args:
+        post_id: Unique post identifier.
+        use_case: PublishPostUseCase dependency.
+        current_user_id: Authenticated user ID.
+        role: Current user role.
+
+    Returns:
+        PostResponseSchema with unpublished post data.
+    """
+    result = await use_case.unpublish(post_id, current_user_id, role)
+    return PostResponseSchema(**result.__dict__)

app/presentation/schemas/__init__.py

@@ -0,0 +1,25 @@
+"""Presentation schemas.
+
+This module re-exports all Pydantic schemas used for
+request/response validation in the API layer.
+"""
+
+from app.presentation.schemas.post import (
+    PostBaseSchema,
+    PostCreateSchema,
+    PostListResponseSchema,
+    PostPublishSchema,
+    PostResponseSchema,
+    PostSearchSchema,
+    PostUpdateSchema,
+)
+
+__all__ = [
+    "PostBaseSchema",
+    "PostCreateSchema",
+    "PostUpdateSchema",
+    "PostResponseSchema",
+    "PostListResponseSchema",
+    "PostSearchSchema",
+    "PostPublishSchema",
+]

app/presentation/schemas/post.py

@@ -0,0 +1,124 @@
+"""API schemas for posts.
+
+This module defines Pydantic schemas for request/response validation
+in the posts API endpoints.
+"""
+
+from datetime import datetime
+from uuid import UUID
+
+from pydantic import BaseModel, ConfigDict, Field
+
+
+class PostBaseSchema(BaseModel):
+    """Base schema for posts.
+
+    Contains common fields shared across post schemas.
+
+    Attributes:
+        title: Post title (3-200 characters).
+        content: Post content (10-50000 characters).
+    """
+
+    model_config = ConfigDict(from_attributes=True)
+
+    title: str = Field(..., min_length=3, max_length=200)
+    content: str = Field(..., min_length=10, max_length=50000)
+
+
+class PostCreateSchema(PostBaseSchema):
+    """Schema for creating a post.
+
+    Extends base schema with creation-specific fields.
+
+    Attributes:
+        tags: List of tags for categorization.
+    """
+
+    tags: list[str] = Field(default_factory=list)
+
+
+class PostUpdateSchema(BaseModel):
+    """Schema for updating a post.
+
+    All fields are optional for partial updates.
+
+    Attributes:
+        title: Optional new title.
+        content: Optional new content.
+        tags: Optional new tags list.
+    """
+
+    model_config = ConfigDict(from_attributes=True)
+
+    title: str | None = Field(None, min_length=3, max_length=200)
+    content: str | None = Field(None, min_length=10, max_length=50000)
+    tags: list[str] | None = None
+
+
+class PostResponseSchema(BaseModel):
+    """Schema for post response.
+
+    Complete post data for API responses.
+
+    Attributes:
+        id: Unique post identifier.
+        title: Post title.
+        content: Post content.
+        slug: URL-friendly slug.
+        author_id: Author identifier.
+        published: Publication status.
+        tags: List of tags.
+        created_at: Creation timestamp.
+        updated_at: Last update timestamp.
+    """
+
+    model_config = ConfigDict(from_attributes=True)
+
+    id: UUID
+    title: str
+    content: str
+    slug: str
+    author_id: str
+    published: bool
+    tags: list[str]
+    created_at: datetime
+    updated_at: datetime
+
+
+class PostListResponseSchema(BaseModel):
+    """Schema for list of posts response.
+
+    Paginated response for list endpoints.
+
+    Attributes:
+        items: List of post items.
+        total: Total number of items.
+    """
+
+    items: list[PostResponseSchema]
+    total: int
+
+
+class PostSearchSchema(BaseModel):
+    """Schema for searching posts.
+
+    Search query parameters.
+
+    Attributes:
+        query: Search query string (1-100 characters).
+    """
+
+    query: str = Field(..., min_length=1, max_length=100)
+
+
+class PostPublishSchema(BaseModel):
+    """Schema for publishing/unpublishing a post.
+
+    Publication status toggle.
+
+    Attributes:
+        published: Desired publication status.
+    """
+
+    published: bool

app/presentation/templates/base.html

@@ -0,0 +1,184 @@
+<!DOCTYPE html>
+<html lang="en" data-testid="html-root">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta name="description" content="{% block meta_description %}Blog - A modern blogging platform built with FastAPI{% endblock %}">
+    <meta name="keywords" content="{% block meta_keywords %}blog, articles, posts, writing{% endblock %}">
+    <meta name="author" content="{% block meta_author %}Blog Team{% endblock %}">
+    <meta name="robots" content="{% block meta_robots %}index, follow{% endblock %}">
+    
+    <!-- Canonical URL -->
+    <link rel="canonical" href="{% block canonical_url %}{{ request.url }}{% endblock %}">
+    
+    <!-- Open Graph / Facebook -->
+    <meta property="og:type" content="{% block og_type %}website{% endblock %}">
+    <meta property="og:url" content="{% block og_url %}{{ request.url }}{% endblock %}">
+    <meta property="og:title" content="{% block og_title %}{{ self.title() }}{% endblock %}">
+    <meta property="og:description" content="{% block og_description %}{{ self.meta_description() }}{% endblock %}">
+    <meta property="og:image" content="{% block og_image %}{{ request.base_url }}static/images/og-default.png{% endblock %}">
+    <meta property="og:site_name" content="Blog">
+    
+    <!-- Twitter -->
+    <meta property="twitter:card" content="{% block twitter_card %}summary_large_image{% endblock %}">
+    <meta property="twitter:url" content="{% block twitter_url %}{{ request.url }}{% endblock %}">
+    <meta property="twitter:title" content="{% block twitter_title %}{{ self.title() }}{% endblock %}">
+    <meta property="twitter:description" content="{% block twitter_description %}{{ self.meta_description() }}{% endblock %}">
+    <meta property="twitter:image" content="{% block twitter_image %}{{ self.og_image() }}{% endblock %}">
+    
+    <!-- Favicon -->
+    <link rel="icon" type="image/svg+xml" href="/static/images/favicon.svg">
+    <link rel="alternate icon" href="/static/images/favicon.ico">
+    
+    <title data-testid="page-title">{% block title %}Blog{% endblock %}</title>
+    
+    <link rel="stylesheet" href="/static/css/themes/theme-light.css" data-testid="theme-light-stylesheet">
+    <link rel="stylesheet" href="/static/css/themes/theme-dark.css" data-testid="theme-dark-stylesheet">
+    <link rel="stylesheet" href="/static/css/base.css" data-testid="base-stylesheet">
+    <link rel="stylesheet" href="/static/css/components.css" data-testid="components-stylesheet">
+    <link rel="stylesheet" href="/static/css/layout.css" data-testid="layout-stylesheet">
+    <link rel="stylesheet" href="/static/css/markdown.css" data-testid="markdown-stylesheet">
+    <link rel="stylesheet" href="/static/css/pygments.css" data-testid="pygments-stylesheet">
+    
+    {% block extra_css %}{% endblock %}
+</head>
+<body data-testid="body">
+    {% include "partials/header.html" %}
+    
+    <!-- Flash Messages -->
+    {% if flash_messages %}
+    <div class="flash-container" data-testid="flash-container">
+        {% for msg in flash_messages %}
+        <div class="flash-message flash-{{ msg.category }}" data-testid="flash-message-{{ msg.category }}" role="alert">
+            <span class="flash-text" data-testid="flash-text">{{ msg.message }}</span>
+            <button type="button" class="flash-close" data-testid="flash-close" aria-label="Close message">&times;</button>
+        </div>
+        {% endfor %}
+    </div>
+    {% endif %}
+    
+    <main class="main-wrapper" data-testid="main-content">
+        <div class="container" data-testid="container">
+            {% block content %}{% endblock %}
+        </div>
+    </main>
+    
+    {% include "partials/footer.html" %}
+    
+    <script src="/static/js/theme.js" data-testid="theme-script"></script>
+    <script src="/static/js/flash.js" data-testid="flash-script"></script>
+    {% block extra_js %}{% endblock %}
+</body>
+</html>
+
+<style>
+.flash-container {
+    position: fixed;
+    top: 5rem;
+    right: 1rem;
+    z-index: 1000;
+    max-width: 400px;
+    width: calc(100% - 2rem);
+}
+
+.flash-message {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 1rem;
+    padding: 1rem 1.25rem;
+    margin-bottom: 0.75rem;
+    border-radius: 8px;
+    border: 1px solid transparent;
+    box-shadow: 0 4px 12px var(--color-shadow);
+    animation: slideIn 0.3s ease;
+}
+
+@keyframes slideIn {
+    from {
+        opacity: 0;
+        transform: translateX(100%);
+    }
+    to {
+        opacity: 1;
+        transform: translateX(0);
+    }
+}
+
+.flash-message.fade-out {
+    animation: slideOut 0.3s ease forwards;
+}
+
+@keyframes slideOut {
+    from {
+        opacity: 1;
+        transform: translateX(0);
+    }
+    to {
+        opacity: 0;
+        transform: translateX(100%);
+    }
+}
+
+.flash-success {
+    background-color: var(--color-success-bg);
+    border-color: var(--color-success-border);
+    color: var(--color-success-text);
+}
+
+.flash-error {
+    background-color: var(--color-error-bg);
+    border-color: var(--color-error-border);
+    color: var(--color-error-text);
+}
+
+.flash-warning {
+    background-color: var(--color-warning-bg);
+    border-color: var(--color-warning-border);
+    color: var(--color-warning-text);
+}
+
+.flash-info {
+    background-color: var(--color-info-bg);
+    border-color: var(--color-info-border);
+    color: var(--color-info-text);
+}
+
+.flash-text {
+    flex: 1;
+    font-size: 0.9375rem;
+}
+
+.flash-close {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    width: 1.5rem;
+    height: 1.5rem;
+    padding: 0;
+    background: transparent;
+    border: none;
+    color: inherit;
+    font-size: 1.25rem;
+    cursor: pointer;
+    opacity: 0.6;
+    transition: opacity 0.2s ease;
+}
+
+.flash-close:hover {
+    opacity: 1;
+}
+
+@media (max-width: 768px) {
+    .flash-container {
+        top: 4rem;
+        left: 1rem;
+        right: 1rem;
+        max-width: none;
+    }
+    
+    .flash-message {
+        padding: 0.875rem 1rem;
+    }
+}
+</style>

app/presentation/templates/pages/about.html

@@ -0,0 +1,37 @@
+{% extends "base.html" %}
+
+{% block title %}About - Blog{% endblock %}
+{% block meta_description %}A modern blog built with FastAPI and DDD architecture.{% endblock %}
+
+{% block content %}
+<div class="page-header" data-testid="page-header-about">
+    <h1 class="page-title" data-testid="page-title-about">About</h1>
+</div>
+
+<div class="card" data-testid="about-card">
+    <div class="card-body" data-testid="about-card-body">
+        <p data-testid="about-description">
+            A modern blog built with FastAPI and Domain-Driven Design architecture.
+        </p>
+
+        <div class="divider" data-testid="about-divider"></div>
+
+        <p data-testid="about-user">
+            {% if user %}
+            Signed in as <strong>{{ user.username }}</strong>.
+            {% else %}
+            You are browsing as a guest.
+            {% endif %}
+        </p>
+    </div>
+
+    <div class="card-footer" data-testid="about-card-footer">
+        <a href="/web/" class="btn" data-testid="btn-back-home">
+            <svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" style="margin-right: 0.5rem;">
+                <path d="M10 12L6 8L10 4" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+            </svg>
+            Back to Home
+        </a>
+    </div>
+</div>
+{% endblock %}

app/presentation/templates/pages/error.html

@@ -0,0 +1,111 @@
+{% extends "base.html" %}
+
+{% block title %}{{ error_code }} - {{ error_title }}{% endblock %}
+{% block meta_description %}{{ error_message }}{% endblock %}
+
+{% block content %}
+<div class="error-page" data-testid="error-page">
+    <div class="error-content" data-testid="error-content">
+        <div class="error-icon" data-testid="error-icon">
+            {% if error_code == 404 %}
+            🔍
+            {% elif error_code == 403 %}
+            🚫
+            {% elif error_code == 500 %}
+            ⚠️
+            {% else %}
+            ❌
+            {% endif %}
+        </div>
+        
+        <h1 class="error-code" data-testid="error-code">{{ error_code }}</h1>
+        <h2 class="error-title" data-testid="error-title">{{ error_title }}</h2>
+        <p class="error-message" data-testid="error-message">{{ error_message }}</p>
+        
+        <div class="error-actions" data-testid="error-actions">
+            <a href="/" class="btn btn-primary" data-testid="btn-error-home">
+                <svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" style="margin-right: 0.5rem;">
+                    <path d="M2 8L8 2L14 8M4 6V13H12V6" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+                </svg>
+                Go Home
+            </a>
+            
+            {% if error_code == 403 %}
+            <a href="/auth/login" class="btn" data-testid="btn-error-login">
+                Sign In
+            </a>
+            {% endif %}
+            
+            <button onclick="window.history.back()" class="btn btn-ghost" data-testid="btn-error-back">
+                Go Back
+            </button>
+        </div>
+    </div>
+</div>
+
+<style>
+.error-page {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    min-height: 60vh;
+    padding: 2rem 1rem;
+}
+
+.error-content {
+    text-align: center;
+    max-width: 500px;
+}
+
+.error-icon {
+    font-size: 5rem;
+    margin-bottom: 1.5rem;
+    opacity: 0.8;
+}
+
+.error-code {
+    font-size: 6rem;
+    font-weight: 700;
+    color: var(--color-primary);
+    margin: 0;
+    line-height: 1;
+}
+
+.error-title {
+    font-size: 1.5rem;
+    color: var(--color-text-dark);
+    margin: 1rem 0 0.5rem;
+}
+
+.error-message {
+    color: var(--color-text-light);
+    font-size: 1.125rem;
+    margin-bottom: 2rem;
+}
+
+.error-actions {
+    display: flex;
+    gap: 1rem;
+    justify-content: center;
+    flex-wrap: wrap;
+}
+
+@media (max-width: 768px) {
+    .error-code {
+        font-size: 4rem;
+    }
+    
+    .error-icon {
+        font-size: 3.5rem;
+    }
+    
+    .error-actions {
+        flex-direction: column;
+    }
+    
+    .error-actions .btn {
+        width: 100%;
+    }
+}
+</style>
+{% endblock %}

app/presentation/templates/pages/index.html

@@ -0,0 +1,102 @@
+{% extends "base.html" %}
+
+{% block title %}Blog - Home{% endblock %}
+{% block meta_description %}Discover stories, thinking, and expertise from writers on any topic. A modern blog built with FastAPI.{% endblock %}
+{% block meta_keywords %}blog, articles, posts, writing, fastapi, python{% endblock %}
+
+{% block og_type %}website{% endblock %}
+{% block og_title %}Blog - Home{% endblock %}
+{% block og_description %}Discover stories, thinking, and expertise from writers on any topic.{% endblock %}
+
+{% block twitter_title %}Blog - Home{% endblock %}
+{% block twitter_description %}Discover stories, thinking, and expertise from writers on any topic.{% endblock %}
+
+{% block content %}
+<section class="page-header" data-testid="page-header-home">
+    <div class="page-header-flex">
+        <div data-testid="page-header-content">
+            <h1 class="page-title" data-testid="page-title-home">Latest Posts</h1>
+            <p class="page-subtitle" data-testid="page-subtitle-home">Discover stories, thinking, and expertise from writers on any topic.</p>
+        </div>
+        {% if can_create %}
+        <a href="/web/posts/new" class="btn btn-primary" data-testid="btn-create-post-header">
+            <svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" style="margin-right: 0.5rem;">
+                <path d="M8 2v12M2 8h12" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+            </svg>
+            Write a Post
+        </a>
+        {% endif %}
+    </div>
+</section>
+
+{% if posts %}
+<section class="post-list" data-testid="post-list">
+    {% for post in posts %}
+    <article class="card post-card" data-testid="post-card-{{ post.id }}">
+        <div class="post-card-header" data-testid="post-card-header-{{ post.id }}">
+            <h2 class="post-card-title" data-testid="post-title-{{ post.id }}">
+                <a href="/web/posts/{{ post.slug }}" data-testid="post-title-link-{{ post.id }}">{{ post.title }}</a>
+            </h2>
+            {% if post.published %}
+            <span class="badge badge-success" data-testid="post-status-{{ post.id }}">Published</span>
+            {% else %}
+            <span class="badge" data-testid="post-status-{{ post.id }}">Draft</span>
+            {% endif %}
+        </div>
+        
+        <div class="post-card-meta" data-testid="post-meta-{{ post.id }}">
+            <span class="post-card-meta-item" data-testid="post-author-{{ post.id }}">
+                <span class="avatar avatar-sm" data-testid="post-author-avatar-{{ post.id }}">{{ post.author_id[0]|upper }}</span>
+                <span data-testid="post-author-name-{{ post.id }}">{{ post.author_id }}</span>
+            </span>
+            <span class="post-card-meta-item" data-testid="post-date-{{ post.id }}">
+                {{ post.created_at.strftime('%B %d, %Y') }}
+            </span>
+        </div>
+        
+        <div class="post-card-content" data-testid="post-content-preview-{{ post.id }}">
+            {{ post.content[:200] }}{% if post.content|length > 200 %}...{% endif %}
+        </div>
+        
+        <div class="post-card-footer" data-testid="post-card-footer-{{ post.id }}">
+            <div class="post-card-tags" data-testid="post-tags-{{ post.id }}">
+                {% for tag in post.tags %}
+                <span class="tag" data-testid="post-tag-{{ post.id }}-{{ loop.index }}">{{ tag }}</span>
+                {% endfor %}
+            </div>
+            <a href="/web/posts/{{ post.slug }}" class="btn btn-sm" data-testid="btn-read-more-{{ post.id }}">
+                Read more
+                <svg width="14" height="14" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" style="margin-left: 0.25rem;">
+                    <path d="M6 12L10 8L6 4" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+                </svg>
+            </a>
+        </div>
+    </article>
+    {% endfor %}
+</section>
+
+<nav class="pagination" data-testid="pagination" aria-label="Pagination">
+    {% if has_prev %}
+    <a href="{{ request.url.path }}?page={{ current_page - 1 }}" class="pagination-item" data-testid="pagination-prev">Previous</a>
+    {% else %}
+    <span class="pagination-item disabled" data-testid="pagination-prev">Previous</span>
+    {% endif %}
+    
+    <span class="pagination-item active" data-testid="pagination-current">{{ current_page }}</span>
+    
+    {% if has_next %}
+    <a href="{{ request.url.path }}?page={{ current_page + 1 }}" class="pagination-item" data-testid="pagination-next">Next</a>
+    {% else %}
+    <span class="pagination-item disabled" data-testid="pagination-next">Next</span>
+    {% endif %}
+</nav>
+
+{% else %}
+<div class="empty-state" data-testid="empty-state">
+    <div class="empty-state-icon" data-testid="empty-state-icon">📝</div>
+    <h3 data-testid="empty-state-title">No posts yet</h3>
+    <p data-testid="empty-state-description">Be the first to write a post!</p>
+    <a href="/web/posts/new" class="btn btn-primary" data-testid="btn-create-first-post">Create your first post</a>
+</div>
+{% endif %}
+{% endblock %}

app/presentation/templates/pages/post_detail.html

@@ -0,0 +1,85 @@
+{% extends "base.html" %}
+
+{% block title %}{{ post.title }} - Blog{% endblock %}
+{% block meta_description %}{{ post.content[:160] }}{% endblock %}
+{% block meta_keywords %}{{ post.tags|join(', ') }}{% endblock %}
+{% block meta_author %}{{ post.author_id }}{% endblock %}
+
+{% block canonical_url %}{{ request.base_url }}web/posts/{{ post.slug }}{% endblock %}
+
+{% block og_type %}article{% endblock %}
+{% block og_url %}{{ request.base_url }}web/posts/{{ post.slug }}{% endblock %}
+{% block og_title %}{{ post.title }}{% endblock %}
+{% block og_description %}{{ post.content[:160] }}{% endblock %}
+
+{% block twitter_title %}{{ post.title }}{% endblock %}
+{% block twitter_description %}{{ post.content[:160] }}{% endblock %}
+
+{% block content %}
+<article class="post-detail" data-testid="post-detail">
+    <header class="post-detail-header" data-testid="post-detail-header">
+        <h1 class="post-detail-title" data-testid="post-detail-title">{{ post.title }}</h1>
+        
+        <div class="post-detail-meta" data-testid="post-detail-meta">
+            <span class="post-card-meta-item" data-testid="post-detail-author">
+                <span class="avatar avatar-sm" data-testid="post-detail-author-avatar">{{ post.author_id[0]|upper }}</span>
+                <span data-testid="post-detail-author-name">{{ post.author_id }}</span>
+            </span>
+            <span class="post-card-meta-item" data-testid="post-detail-date">
+                {{ post.created_at.strftime('%B %d, %Y') }}
+            </span>
+            {% if post.published %}
+            <span class="badge badge-success" data-testid="post-detail-status">Published</span>
+            {% else %}
+            <span class="badge" data-testid="post-detail-status">Draft</span>
+            {% endif %}
+        </div>
+    </header>
+    
+    <div class="post-detail-content markdown-body" data-testid="post-detail-content">
+        {{ post.content|markdown|safe }}
+    </div>
+    
+    <footer class="post-detail-footer" data-testid="post-detail-footer">
+        <div class="post-detail-tags" data-testid="post-detail-tags">
+            {% for tag in post.tags %}
+            <span class="tag" data-testid="post-detail-tag-{{ loop.index }}">{{ tag }}</span>
+            {% endfor %}
+        </div>
+        
+        <div class="divider" data-testid="post-detail-divider"></div>
+        
+        <div class="flex justify-between items-center" data-testid="post-detail-actions">
+            <a href="/" class="btn" data-testid="btn-back-to-posts">
+                <svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" style="margin-right: 0.5rem;">
+                    <path d="M10 12L6 8L10 4" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+                </svg>
+                Back to posts
+            </a>
+            
+            {% if can_edit or can_delete %}
+            <div class="flex gap-2" data-testid="post-detail-edit-actions">
+                {% if can_edit %}
+                <a href="/web/posts/{{ post.slug }}/edit" class="btn" data-testid="btn-edit-post">
+                    <svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" style="margin-right: 0.5rem;">
+                        <path d="M11 2L14 5M2 14L3 10L12 1L15 4L6 13L2 14Z" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+                    </svg>
+                    Edit
+                </a>
+                {% endif %}
+                {% if can_delete %}
+                <form action="/web/posts/{{ post.slug }}/delete" method="POST" style="display: inline;" data-testid="form-delete-post">
+                    <button type="submit" class="btn btn-danger" data-testid="btn-delete-post" onclick="return confirm('Are you sure you want to delete this post?');">
+                        <svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" style="margin-right: 0.5rem;">
+                            <path d="M2 4h12M6 4V2a2 2 0 012-2h0a2 2 0 012 2v2m3 0v10a2 2 0 01-2 2H5a2 2 0 01-2-2V4h9z" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+                        </svg>
+                        Delete
+                    </button>
+                </form>
+                {% endif %}
+            </div>
+            {% endif %}
+        </div>
+    </footer>
+</article>
+{% endblock %}

app/presentation/templates/pages/post_form.html

@@ -0,0 +1,119 @@
+{% extends "base.html" %}
+
+{% block title %}{% if is_edit %}Edit Post{% else %}New Post{% endif %} - Blog{% endblock %}
+
+{% block extra_css %}
+<link rel="stylesheet" href="/static/css/easymde.min.css" data-testid="easymde-stylesheet">
+{% endblock %}
+
+{% block content %}
+<section class="page-header" data-testid="page-header-form">
+    <h1 class="page-title" data-testid="page-title-form">
+        {% if is_edit %}Edit Post{% else %}Create New Post{% endif %}
+    </h1>
+</section>
+
+<form
+    method="POST"
+    action="{% if is_edit %}/web/posts/{{ post.slug }}/edit{% else %}/web/posts/new{% endif %}"
+    class="card"
+    data-testid="form-post"
+>
+    <div class="card-body" data-testid="form-post-body">
+        <div class="form-group" data-testid="form-group-title">
+            <label for="title" class="form-label form-label-required" data-testid="label-title">
+                Title
+            </label>
+            <input
+                type="text"
+                id="title"
+                name="title"
+                class="input input-lg"
+                value="{% if post %}{{ post.title }}{% endif %}"
+                placeholder="Enter post title"
+                required
+                data-testid="input-title"
+            >
+            <span class="form-hint" data-testid="hint-title">A catchy title for your post</span>
+        </div>
+
+        <div class="form-group" data-testid="form-group-content">
+            <label for="content" class="form-label form-label-required" data-testid="label-content">
+                Content
+            </label>
+            <textarea
+                id="content"
+                name="content"
+                rows="12"
+                placeholder="Write your post content here..."
+                required
+                data-testid="textarea-content"
+            >{% if post %}{{ post.content }}{% endif %}</textarea>
+            <span class="form-hint" data-testid="hint-content">The main content of your post. Markdown is supported.</span>
+        </div>
+        
+        <div class="form-group" data-testid="form-group-tags">
+            <label for="tags" class="form-label" data-testid="label-tags">
+                Tags
+            </label>
+            <input 
+                type="text" 
+                id="tags" 
+                name="tags" 
+                class="input"
+                value="{% if post %}{{ post.tags|join(', ') }}{% endif %}"
+                placeholder="python, fastapi, tutorial"
+                data-testid="input-tags"
+            >
+            <span class="form-hint" data-testid="hint-tags">Comma-separated list of tags</span>
+        </div>
+        
+    </div>
+    
+    <div class="card-footer" data-testid="form-post-footer">
+        <div class="flex justify-between items-center" data-testid="form-actions">
+            <a href="{% if is_edit %}/web/posts/{{ post.slug }}{% else %}/web/{% endif %}" class="btn" data-testid="btn-cancel">
+                Cancel
+            </a>
+            
+            <div class="flex gap-2" data-testid="form-submit-actions">
+                <button type="submit" name="action" value="draft" class="btn" data-testid="btn-save-draft">
+                    Save as Draft
+                </button>
+                <button type="submit" name="action" value="publish" class="btn btn-primary" data-testid="btn-publish-post">
+                    {% if is_edit %}Update Post{% else %}Publish Post{% endif %}
+                </button>
+            </div>
+        </div>
+    </div>
+</form>
+{% endblock %}
+
+{% block extra_js %}
+<script src="/static/js/easymde.min.js" data-testid="easymde-script"></script>
+<script>
+(function() {
+    'use strict';
+    var easyMDE = new EasyMDE({
+        element: document.getElementById('content'),
+        spellChecker: false,
+        status: false,
+        minHeight: '300px',
+        placeholder: 'Write your post content here...',
+        toolbar: [
+            'bold', 'italic', 'heading', '|',
+            'code', 'quote', 'unordered-list', 'ordered-list', '|',
+            'link', 'image', 'table', 'horizontal-rule', '|',
+            'preview', 'side-by-side', 'fullscreen', '|',
+            'guide'
+        ]
+    });
+    var form = document.querySelector('form[data-testid="form-post"]');
+    if (form) {
+        form.addEventListener('submit', function() {
+            easyMDE.toTextArea();
+        });
+    }
+})();
+</script>
+{% endblock %}

app/presentation/templates/pages/profile.html

@@ -0,0 +1,125 @@
+{% extends "base.html" %}
+
+{% block title %}Profile - {{ user.username }}{% endblock %}
+
+{% block content %}
+<div class="page-header" data-testid="page-header-profile">
+    <h1 class="page-title" data-testid="page-title-profile">User Profile</h1>
+</div>
+
+<div class="card" data-testid="profile-card">
+    <div class="card-body" data-testid="profile-card-body">
+        <div class="profile-header" data-testid="profile-header">
+            <div class="avatar avatar-lg" data-testid="profile-avatar">
+                {{ user.username[0]|upper }}
+            </div>
+            <div class="profile-info" data-testid="profile-info">
+                <h2 class="profile-username" data-testid="profile-username">{{ user.username }}</h2>
+                <span class="badge {% if user_role == 'admin' %}badge-primary{% else %}badge-success{% endif %}" data-testid="profile-role">
+                    {{ user_role|upper }}
+                </span>
+            </div>
+        </div>
+
+        <div class="divider" data-testid="profile-divider"></div>
+
+        <div class="profile-details" data-testid="profile-details">
+            <div class="profile-field" data-testid="profile-field-email">
+                <span class="profile-label" data-testid="profile-label-email">Email:</span>
+                <span class="profile-value" data-testid="profile-value-email">{{ user.email or 'Not provided' }}</span>
+            </div>
+
+            <div class="profile-field" data-testid="profile-field-userid">
+                <span class="profile-label" data-testid="profile-label-userid">User ID:</span>
+                <span class="profile-value" data-testid="profile-value-userid">{{ user.user_id }}</span>
+            </div>
+
+            {% if user.first_name or user.last_name %}
+            <div class="profile-field" data-testid="profile-field-name">
+                <span class="profile-label" data-testid="profile-label-name">Name:</span>
+                <span class="profile-value" data-testid="profile-value-name">
+                    {{ user.first_name or '' }} {{ user.last_name or '' }}
+                </span>
+            </div>
+            {% endif %}
+        </div>
+    </div>
+
+    <div class="card-footer" data-testid="profile-card-footer">
+        <div class="flex justify-between items-center" data-testid="profile-actions">
+            <a href="/web/" class="btn" data-testid="btn-back-home">
+                <svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" style="margin-right: 0.5rem;">
+                    <path d="M10 12L6 8L10 4" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+                </svg>
+                Back to Home
+            </a>
+
+            {% if can_create %}
+            <a href="/web/posts/new" class="btn btn-primary" data-testid="btn-create-post-profile">
+                <svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" style="margin-right: 0.5rem;">
+                    <path d="M8 2v12M2 8h12" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+                </svg>
+                New Post
+            </a>
+            {% endif %}
+        </div>
+    </div>
+</div>
+
+<style>
+.profile-header {
+    display: flex;
+    align-items: center;
+    gap: 1.5rem;
+    margin-bottom: 1rem;
+}
+
+.profile-info {
+    display: flex;
+    flex-direction: column;
+    gap: 0.5rem;
+}
+
+.profile-username {
+    margin: 0;
+    font-size: 1.5rem;
+}
+
+.profile-details {
+    display: flex;
+    flex-direction: column;
+    gap: 1rem;
+}
+
+.profile-field {
+    display: flex;
+    gap: 0.5rem;
+}
+
+.profile-label {
+    font-weight: 600;
+    color: var(--color-text-light);
+    min-width: 80px;
+}
+
+.profile-value {
+    color: var(--color-text);
+}
+
+@media (max-width: 768px) {
+    .profile-header {
+        flex-direction: column;
+        text-align: center;
+    }
+
+    .profile-field {
+        flex-direction: column;
+        gap: 0.25rem;
+    }
+
+    .profile-label {
+        min-width: auto;
+    }
+}
+</style>
+{% endblock %}

app/presentation/templates/partials/footer.html

@@ -0,0 +1,14 @@
+<footer class="site-footer" data-testid="site-footer">
+    <div class="container" data-testid="footer-container">
+        <div class="footer-copyright" data-testid="footer-copyright">
+            <span data-testid="copyright-text">© 2026 Blog. All rights reserved.</span>
+        </div>
+        
+        <nav class="footer-links" data-testid="footer-nav" aria-label="Footer navigation">
+            <a href="/about" class="footer-link" data-testid="footer-link-about">About</a>
+            <a href="/privacy" class="footer-link" data-testid="footer-link-privacy">Privacy</a>
+            <a href="/terms" class="footer-link" data-testid="footer-link-terms">Terms</a>
+            <a href="/api/docs" class="footer-link" data-testid="footer-link-api">API</a>
+        </nav>
+    </div>
+</footer>

app/presentation/templates/partials/header.html

@@ -0,0 +1,337 @@
+<header class="site-header" data-testid="site-header">
+    <div class="container" data-testid="header-container">
+        <a href="/web/" class="site-logo" data-testid="nav-logo">
+            <svg width="32" height="32" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg" data-testid="logo-icon">
+                <rect width="32" height="32" rx="6" fill="var(--color-primary)"/>
+                <path d="M8 12h16M8 16h12M8 20h8" stroke="white" stroke-width="2" stroke-linecap="round"/>
+            </svg>
+            <span data-testid="logo-text">Blog</span>
+        </a>
+
+        {% include "partials/nav.html" %}
+
+        <div class="header-actions" data-testid="header-actions">
+            <button
+                type="button"
+                class="mobile-menu-btn"
+                data-testid="mobile-menu-toggle"
+                aria-label="Toggle menu"
+                aria-expanded="false"
+                aria-controls="mobile-nav"
+            >
+                <svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg" class="menu-icon-open">
+                    <path d="M3 12h18M3 6h18M3 18h18" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+                </svg>
+                <svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg" class="menu-icon-close" style="display: none;">
+                    <path d="M18 6L6 18M6 6l12 12" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+                </svg>
+            </button>
+            <button 
+                type="button" 
+                class="theme-toggle" 
+                data-testid="theme-toggle"
+                aria-label="Toggle dark mode"
+                title="Toggle dark mode"
+            >
+                <svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg" data-testid="theme-light-icon" style="display: none;">
+                    <path d="M10 2v2M10 16v2M4.22 4.22l1.42 1.42M14.36 14.36l1.42 1.42M2 10h2M16 10h2M4.22 15.78l1.42-1.42M14.36 5.64l1.42-1.42" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+                    <circle cx="10" cy="10" r="3" stroke="currentColor" stroke-width="2"/>
+                </svg>
+                <svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg" data-testid="theme-dark-icon" style="display: none;">
+                    <path d="M17.293 13.293A8 8 0 116.707 2.707a8.003 8.003 0 0010.586 10.586z" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+                </svg>
+            </button>
+            
+            {% if user %}
+            <div class="user-menu" data-testid="user-menu">
+                <button 
+                    type="button" 
+                    class="user-menu-toggle"
+                    data-testid="user-menu-toggle"
+                    aria-haspopup="true"
+                    aria-expanded="false"
+                >
+                    <span class="avatar avatar-sm" data-testid="user-avatar">{{ user.username[0]|upper }}</span>
+                    <span class="user-name" data-testid="user-name">{{ user.username }}</span>
+                    <svg width="12" height="12" viewBox="0 0 12 12" fill="none" xmlns="http://www.w3.org/2000/svg" style="margin-left: 0.25rem;">
+                        <path d="M2 4L6 8L10 4" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+                    </svg>
+                </button>
+                <div class="user-menu-dropdown" data-testid="user-menu-dropdown">
+                    <a href="/web/profile" class="user-menu-item" data-testid="user-menu-profile">
+                        <svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" style="margin-right: 0.5rem;">
+                            <circle cx="8" cy="6" r="3" stroke="currentColor" stroke-width="2"/>
+                            <path d="M2 14c0-3 3-5 6-5s6 2 6 5" stroke="currentColor" stroke-width="2" stroke-linecap="round"/>
+                        </svg>
+                        Profile
+                    </a>
+                    {% if can_create %}
+                    <a href="/web/posts/new" class="user-menu-item" data-testid="user-menu-new-post">
+                        <svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" style="margin-right: 0.5rem;">
+                            <path d="M8 2v12M2 8h12" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+                        </svg>
+                        New Post
+                    </a>
+                    {% endif %}
+                    <div class="user-menu-divider" data-testid="user-menu-divider"></div>
+                    <a href="/auth/logout" class="user-menu-item user-menu-item-danger" data-testid="user-menu-logout">
+                        <svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" style="margin-right: 0.5rem;">
+                            <path d="M10 12h2a2 2 0 002-2V6a2 2 0 00-2-2h-2M6 12l-3-3m0 0l3-3m-3 3h8" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+                        </svg>
+                        Sign Out
+                    </a>
+                </div>
+            </div>
+            {% else %}
+            <a href="/auth/login" class="btn btn-primary btn-sm" data-testid="btn-login">
+                Sign In
+            </a>
+            {% endif %}
+        </div>
+    </div>
+</header>
+
+<style>
+.user-menu {
+    position: relative;
+}
+
+.user-menu-toggle {
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+    padding: 0.375rem 0.75rem;
+    background: transparent;
+    border: 1px solid var(--color-border);
+    border-radius: 6px;
+    color: var(--color-text);
+    cursor: pointer;
+    transition: all 0.2s ease;
+}
+
+.user-menu-toggle:hover {
+    background-color: var(--color-hover);
+    border-color: var(--color-secondary-dark-2);
+}
+
+.user-name {
+    font-weight: 500;
+    font-size: 0.875rem;
+}
+
+.user-menu-dropdown {
+    position: absolute;
+    top: 100%;
+    right: 0;
+    margin-top: 0.5rem;
+    min-width: 180px;
+    background-color: var(--color-box-body);
+    border: 1px solid var(--color-border);
+    border-radius: 8px;
+    box-shadow: 0 4px 12px var(--color-shadow);
+    opacity: 0;
+    visibility: hidden;
+    transform: translateY(-10px);
+    transition: all 0.2s ease;
+    z-index: 1000;
+}
+
+.user-menu:hover .user-menu-dropdown,
+.user-menu-toggle:focus + .user-menu-dropdown,
+.user-menu-dropdown:hover {
+    opacity: 1;
+    visibility: visible;
+    transform: translateY(0);
+}
+
+.user-menu-item {
+    display: flex;
+    align-items: center;
+    padding: 0.75rem 1rem;
+    color: var(--color-text);
+    text-decoration: none;
+    font-size: 0.875rem;
+    transition: background-color 0.2s ease;
+}
+
+.user-menu-item:first-child {
+    border-radius: 8px 8px 0 0;
+}
+
+.user-menu-item:last-child {
+    border-radius: 0 0 8px 8px;
+}
+
+.user-menu-item:hover {
+    background-color: var(--color-hover);
+    text-decoration: none;
+}
+
+.user-menu-item-danger {
+    color: var(--color-red);
+}
+
+.user-menu-item-danger:hover {
+    background-color: var(--color-error-bg);
+}
+
+.user-menu-divider {
+    height: 1px;
+    background-color: var(--color-border);
+    margin: 0.25rem 0;
+}
+
+@media (max-width: 768px) {
+    .user-name {
+        display: none;
+    }
+
+    .mobile-menu-btn {
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        width: 2.5rem;
+        height: 2.5rem;
+        padding: 0;
+        background: transparent;
+        border: 1px solid var(--color-border);
+        border-radius: 6px;
+        color: var(--color-text);
+        cursor: pointer;
+        transition: all 0.2s ease;
+    }
+
+    .mobile-menu-btn:hover {
+        background-color: var(--color-hover);
+    }
+
+    .mobile-menu-btn[aria-expanded="true"] {
+        background-color: var(--color-primary);
+        border-color: var(--color-primary);
+        color: var(--color-primary-contrast);
+    }
+
+    .mobile-nav {
+        display: none;
+        position: fixed;
+        top: 4rem;
+        left: 0;
+        right: 0;
+        bottom: 0;
+        background-color: var(--color-body);
+        z-index: 99;
+        padding: 2rem;
+        overflow-y: auto;
+    }
+
+    .mobile-nav.is-open {
+        display: block;
+    }
+
+    .mobile-nav .nav-link {
+        display: block;
+        padding: 1rem 0;
+        font-size: 1.25rem;
+        border-bottom: 1px solid var(--color-border);
+        border-bottom-color: transparent;
+    }
+
+    .mobile-nav .nav-link:last-child {
+        border-bottom: none;
+    }
+}
+
+@media (min-width: 769px) {
+    .mobile-menu-btn {
+        display: none;
+    }
+
+    .mobile-nav {
+        display: none !important;
+    }
+}
+</style>
+
+<!-- Mobile Navigation Menu -->
+<nav class="mobile-nav" id="mobile-nav" data-testid="mobile-nav" aria-label="Mobile navigation">
+    <a href="/web/" class="nav-link {% if active_page == 'home' %}active{% endif %}" data-testid="mobile-nav-link-home">
+        Home
+    </a>
+    <a href="/web/posts" class="nav-link {% if active_page == 'posts' %}active{% endif %}" data-testid="mobile-nav-link-posts">
+        Posts
+    </a>
+    <a href="/web/about" class="nav-link {% if active_page == 'about' %}active{% endif %}" data-testid="mobile-nav-link-about">
+        About
+    </a>
+</nav>
+
+<script>
+(function() {
+    'use strict';
+
+    const menuBtn = document.querySelector('[data-testid="mobile-menu-toggle"]');
+    const mobileNav = document.getElementById('mobile-nav');
+    const menuIconOpen = menuBtn?.querySelector('.menu-icon-open');
+    const menuIconClose = menuBtn?.querySelector('.menu-icon-close');
+
+    function toggleMenu() {
+        if (!mobileNav || !menuBtn) return;
+
+        const isOpen = mobileNav.classList.toggle('is-open');
+        menuBtn.setAttribute('aria-expanded', isOpen ? 'true' : 'false');
+
+        if (menuIconOpen && menuIconClose) {
+            menuIconOpen.style.display = isOpen ? 'none' : 'block';
+            menuIconClose.style.display = isOpen ? 'block' : 'none';
+        }
+
+        // Prevent body scroll when menu is open
+        document.body.style.overflow = isOpen ? 'hidden' : '';
+    }
+
+    function closeMenu() {
+        if (!mobileNav || !menuBtn) return;
+
+        mobileNav.classList.remove('is-open');
+        menuBtn.setAttribute('aria-expanded', 'false');
+
+        if (menuIconOpen && menuIconClose) {
+            menuIconOpen.style.display = 'block';
+            menuIconClose.style.display = 'none';
+        }
+
+        document.body.style.overflow = '';
+    }
+
+    if (menuBtn) {
+        menuBtn.addEventListener('click', function(e) {
+            e.preventDefault();
+            e.stopPropagation();
+            toggleMenu();
+        });
+    }
+
+    // Close menu when clicking on a link
+    if (mobileNav) {
+        mobileNav.querySelectorAll('a').forEach(function(link) {
+            link.addEventListener('click', closeMenu);
+        });
+    }
+
+    // Close menu on escape key
+    document.addEventListener('keydown', function(e) {
+        if (e.key === 'Escape' && mobileNav?.classList.contains('is-open')) {
+            closeMenu();
+        }
+    });
+
+    // Close menu when clicking outside
+    document.addEventListener('click', function(e) {
+        if (mobileNav?.classList.contains('is-open') &&
+            !mobileNav.contains(e.target) &&
+            !menuBtn?.contains(e.target)) {
+            closeMenu();
+        }
+    });
+})();
+</script>

app/presentation/templates/partials/nav.html

@@ -0,0 +1,11 @@
+<nav class="main-nav" data-testid="main-nav" aria-label="Main navigation">
+    <a href="/web/" class="nav-link {% if active_page == 'home' %}active{% endif %}" data-testid="nav-link-home">
+        Home
+    </a>
+    <a href="/web/posts" class="nav-link {% if active_page == 'posts' %}active{% endif %}" data-testid="nav-link-posts">
+        Posts
+    </a>
+    <a href="/web/about" class="nav-link {% if active_page == 'about' %}active{% endif %}" data-testid="nav-link-about">
+        About
+    </a>
+</nav>

app/presentation/web/AGENTS.md

@@ -0,0 +1,51 @@
+# Web UI Knowledge Base
+
+**Generated:** 2026-05-03 22:15 UTC  
+**Commit:** 41f2a3d  
+**Branch:** feature/tests
+
+## Overview
+
+FastAPI Jinja2 web UI layer with Keycloak auth integration, flash messages, and theme support.
+
+## Structure
+
+```
+app/presentation/web/
+├── __init__.py
+├── auth.py           # Keycloak OAuth login/logout/callback
+├── deps.py           # Web dependency injection (current_user, require_auth)
+├── error_handlers.py # HTTP exception handlers for web routes
+├── flash.py          # Flash message middleware
+└── routes.py         # All web page routes (largest file in project)
+```
+
+## Where to Look
+
+| Task | Location |
+|------|----------|
+| Add a new page | `routes.py` |
+| Change auth flow | `auth.py` |
+| Change flash messages | `flash.py` |
+| Change error pages | `error_handlers.py` |
+| Change DI for web | `deps.py` |
+
+## Conventions
+
+- **Templates**: Jinja2 in `app/presentation/templates/`
+- **data-testid attributes REQUIRED** on all interactive elements
+- **Theme support**: Light/dark via `data-theme` on `<html>`, LocalStorage persistence
+- **Auth**: HTTP-only cookie `access_token`, Keycloak integration
+- **Mock data**: Routes currently use `MockPost`/`MOCK_POSTS` — integrate real use cases when ready
+
+## Anti-Patterns
+
+- Do NOT use inline comments — self-documenting code only
+- Do NOT add external CDN dependencies — all assets must be in `static/`
+- Do NOT bypass `filter_visible_posts()` for draft access control
+
+## Notes
+
+- `routes.py` is the largest file in the project (519 lines) — consider splitting by concern
+- `home`, `list_posts`, `post_detail`, `new_post_form`, `edit_post_form`, `create_post`, `update_post`, `delete_post`, `profile`, `about` are all defined in `routes.py`
+- Web routers are imported directly in `main.py`, bypassing `app/presentation/__init__.py`

app/presentation/web/__init__.py

@@ -0,0 +1,15 @@
+"""Web UI layer for blog application.
+
+This package provides HTML endpoints and templates for the blog web interface,
+separate from the JSON API layer. Uses Jinja2 templates with Gitea-inspired
+theme support and comprehensive data-testid attributes for testing.
+
+The web layer follows the same DDD principles as the API layer and will
+be integrated with use cases in future iterations.
+"""
+
+from app.presentation.web.auth import router as auth_router
+from app.presentation.web.error_handlers import register_error_handlers
+from app.presentation.web.routes import router
+
+__all__ = ["router", "auth_router", "register_error_handlers"]

app/presentation/web/auth.py

@@ -0,0 +1,343 @@
+"""Web authentication routes for blog application.
+
+This module provides OAuth2/OIDC authentication flow with Keycloak
+for the web UI. Uses HTTP-only cookies for token storage.
+"""
+
+from typing import Any
+
+import httpx
+from fastapi import APIRouter, HTTPException, Request, Response
+from fastapi.responses import RedirectResponse
+
+from app.infrastructure.config.settings import settings
+
+router = APIRouter(prefix="/auth", tags=["auth"])
+
+
+def get_keycloak_login_url(redirect_uri: str) -> str:
+    """Build Keycloak authorization URL.
+
+    Args:
+        redirect_uri: Callback URL after Keycloak authentication.
+
+    Returns:
+        Full Keycloak authorization endpoint URL.
+    """
+    base_url = f"{settings.kc.server_url}/realms/{settings.kc.realm}"
+    return (
+        f"{base_url}/protocol/openid-connect/auth"
+        f"?client_id={settings.kc.client_id}"
+        f"&response_type=code"
+        f"&redirect_uri={redirect_uri}"
+        f"&scope=openid"
+    )
+
+
+def get_keycloak_logout_url(redirect_uri: str) -> str:
+    """Build Keycloak logout URL.
+
+    Args:
+        redirect_uri: URL to redirect after logout.
+
+    Returns:
+        Full Keycloak logout endpoint URL.
+    """
+    base_url = f"{settings.kc.server_url}/realms/{settings.kc.realm}"
+    return (
+        f"{base_url}/protocol/openid-connect/logout"
+        f"?client_id={settings.kc.client_id}"
+        f"&post_logout_redirect_uri={redirect_uri}"
+    )
+
+
+async def exchange_code_for_token(code: str, redirect_uri: str) -> dict[str, Any]:
+    """Exchange authorization code for access token.
+
+    Args:
+        code: Authorization code from Keycloak.
+        redirect_uri: Callback URL used during login.
+
+    Returns:
+        Token response containing access_token, refresh_token, etc.
+
+    Raises:
+        HTTPException: If token exchange fails.
+    """
+    token_url = f"{settings.kc.server_url}/realms/{settings.kc.realm}/protocol/openid-connect/token"
+
+    data = {
+        "grant_type": "authorization_code",
+        "code": code,
+        "client_id": settings.kc.client_id,
+        "client_secret": settings.kc.client_secret,
+        "redirect_uri": redirect_uri,
+    }
+
+    async with httpx.AsyncClient() as client:
+        response = await client.post(token_url, data=data)
+
+    if response.status_code != 200:
+        raise HTTPException(status_code=400, detail="Failed to exchange code for token")
+
+    result: dict[str, Any] = response.json()
+    return result
+
+
+@router.get("/login")
+async def login(request: Request) -> RedirectResponse:
+    """Redirect to Keycloak login page or dev login in development mode.
+
+    In development mode redirects to the local dev login page
+    instead of the external Keycloak server.
+
+    Args:
+        request: HTTP request object.
+
+    Returns:
+        RedirectResponse to Keycloak or dev login endpoint.
+    """
+    if settings.is_dev:
+        return RedirectResponse(url="/auth/dev-login")
+
+    callback_url = str(request.base_url).rstrip("/") + "/auth/callback"
+    login_url = get_keycloak_login_url(callback_url)
+    return RedirectResponse(url=login_url)
+
+
+@router.get("/callback")
+async def callback(request: Request, code: str | None = None) -> Response:
+    """Handle OAuth callback from Keycloak.
+
+    Exchanges authorization code for tokens and sets HTTP-only cookie.
+
+    Args:
+        request: HTTP request object.
+        code: Authorization code from Keycloak.
+
+    Returns:
+        RedirectResponse to home page with token cookie set.
+
+    Raises:
+        HTTPException: If code is missing or token exchange fails.
+    """
+    if not code:
+        raise HTTPException(status_code=400, detail="Authorization code not provided")
+
+    callback_url = str(request.base_url).rstrip("/") + "/auth/callback"
+    token_data = await exchange_code_for_token(code, callback_url)
+    access_token = token_data.get("access_token")
+
+    if not access_token:
+        raise HTTPException(status_code=400, detail="No access token received")
+
+    response = RedirectResponse(url="/web/", status_code=302)
+    response.set_cookie(
+        key="access_token",
+        value=access_token,
+        httponly=True,
+        secure=not settings.is_dev,  # Secure in production
+        samesite="lax",
+        max_age=token_data.get("expires_in", 3600),
+    )
+
+    return response
+
+
+@router.get("/logout")
+async def logout(request: Request) -> Response:
+    """Logout user and clear token cookie.
+
+    In development mode redirects directly to home page.
+    In production redirects to Keycloak logout endpoint.
+
+    Args:
+        request: HTTP request object.
+
+    Returns:
+        RedirectResponse with cookie cleared.
+    """
+    home_url = str(request.base_url).rstrip("/") + "/web/"
+    response = RedirectResponse(url=home_url)
+    response.delete_cookie(key="access_token")
+
+    if not settings.is_dev:
+        logout_url = get_keycloak_logout_url(home_url)
+        response = RedirectResponse(url=logout_url)
+        response.delete_cookie(key="access_token")
+
+    return response
+
+
+@router.get("/dev-login")
+async def dev_login(request: Request) -> Response:
+    """Show dev login page for development mode.
+
+    Only available in development mode. Provides a simple form
+    to select role and log in without a real Keycloak server.
+
+    Args:
+        request: HTTP request object.
+
+    Returns:
+        HTMLResponse with dev login form.
+
+    Raises:
+        HTTPException: If accessed outside development mode.
+    """
+    if not settings.is_dev:
+        raise HTTPException(status_code=404, detail="Not found")
+
+    from fastapi.responses import HTMLResponse
+
+    return HTMLResponse(
+        content="""<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Dev Login - Blog</title>
+    <style>
+        :root {
+            --bg: #f5f5f5;
+            --card: #fff;
+            --text: #333;
+            --border: #ddd;
+            --primary: #0366d6;
+            --primary-text: #fff;
+            --error: #d73a49;
+        }
+        @media (prefers-color-scheme: dark) {
+            :root {
+                --bg: #0d1117;
+                --card: #161b22;
+                --text: #c9d1d9;
+                --border: #30363d;
+                --primary: #58a6ff;
+                --primary-text: #0d1117;
+            }
+        }
+        * { box-sizing: border-box; }
+        body {
+            margin: 0;
+            padding: 2rem;
+            font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+            background: var(--bg);
+            color: var(--text);
+            display: flex;
+            justify-content: center;
+            align-items: center;
+            min-height: 100vh;
+        }
+        .card {
+            background: var(--card);
+            border: 1px solid var(--border);
+            border-radius: 8px;
+            padding: 2rem;
+            max-width: 400px;
+            width: 100%;
+            box-shadow: 0 4px 12px rgba(0,0,0,0.1);
+        }
+        h1 { margin: 0 0 0.5rem; font-size: 1.5rem; }
+        .badge {
+            display: inline-block;
+            background: var(--error);
+            color: #fff;
+            padding: 0.25rem 0.5rem;
+            border-radius: 4px;
+            font-size: 0.75rem;
+            font-weight: 600;
+            margin-bottom: 1.5rem;
+        }
+        label {
+            display: block;
+            margin-bottom: 0.5rem;
+            font-weight: 500;
+            font-size: 0.875rem;
+        }
+        input, select {
+            width: 100%;
+            padding: 0.625rem 0.75rem;
+            border: 1px solid var(--border);
+            border-radius: 6px;
+            background: var(--bg);
+            color: var(--text);
+            font-size: 0.9375rem;
+            margin-bottom: 1rem;
+        }
+        button {
+            width: 100%;
+            padding: 0.75rem;
+            background: var(--primary);
+            color: var(--primary-text);
+            border: none;
+            border-radius: 6px;
+            font-size: 1rem;
+            font-weight: 600;
+            cursor: pointer;
+        }
+        button:hover { opacity: 0.9; }
+        .hint {
+            margin-top: 1.5rem;
+            font-size: 0.8125rem;
+            color: var(--text);
+            opacity: 0.7;
+        }
+    </style>
+</head>
+<body>
+    <div class="card">
+        <h1>Development Login</h1>
+        <span class="badge">DEV ONLY</span>
+        <form method="POST" action="/auth/dev-login">
+            <label for="username">Username</label>
+            <input type="text" id="username" name="username" value="Dev User" required>
+            <label for="role">Role</label>
+            <select id="role" name="role">
+                <option value="user">User</option>
+                <option value="user2">Test User</option>
+                <option value="admin">Admin</option>
+                <option value="guest">Guest (unauthenticated)</option>
+            </select>
+            <button type="submit">Sign In</button>
+        </form>
+        <p class="hint">This bypasses Keycloak for local development only.</p>
+    </div>
+</body>
+</html>"""
+    )
+
+
+@router.post("/dev-login")
+async def dev_login_submit(request: Request) -> Response:
+    """Handle dev login form submission.
+
+    Sets a dev-specific cookie that MockKeycloakClient recognizes.
+
+    Args:
+        request: HTTP request object with form data.
+
+    Returns:
+        RedirectResponse to home page with dev token cookie set.
+
+    Raises:
+        HTTPException: If accessed outside development mode.
+    """
+    if not settings.is_dev:
+        raise HTTPException(status_code=404, detail="Not found")
+
+    form = await request.form()
+    role = str(form.get("role", "user")).strip()
+    token = f"dev-token-{role}"
+
+    response = RedirectResponse(url="/web/", status_code=302)
+    response.set_cookie(
+        key="access_token",
+        value=token,
+        httponly=True,
+        secure=False,
+        samesite="lax",
+        max_age=86400,
+    )
+
+    return response

app/presentation/web/deps.py

@@ -0,0 +1,225 @@
+"""Web dependencies for authentication and authorization.
+
+This module provides FastAPI dependencies for web UI authentication
+including user extraction from cookies and role checking.
+"""
+
+from typing import Annotated
+
+from fastapi import Cookie, Depends, HTTPException, Request
+
+from app.domain.roles import Role, get_effective_role
+from app.infrastructure.auth import KeycloakAuthClient, MockKeycloakClient, TokenInfo
+from app.infrastructure.config.settings import settings
+
+
+async def get_keycloak_client(
+    request: Request,
+) -> KeycloakAuthClient | MockKeycloakClient:
+    """Get Keycloak client from DI container via request state.
+
+    In development mode returns MockKeycloakClient for local testing.
+
+    Args:
+        request: FastAPI request object.
+
+    Returns:
+        KeycloakAuthClient or MockKeycloakClient instance from container.
+    """
+    client: KeycloakAuthClient | MockKeycloakClient = await request.state.dishka_container.get(
+        KeycloakAuthClient
+    )
+    return client
+
+
+async def get_optional_user(
+    request: Request,
+    access_token: Annotated[str | None, Cookie()] = None,
+) -> TokenInfo | None:
+    """Get current user from cookie if authenticated.
+
+    Args:
+        request: FastAPI request object.
+        access_token: Access token from HTTP-only cookie.
+
+    Returns:
+        TokenInfo if user is authenticated, None otherwise.
+    """
+    if not access_token:
+        return None
+
+    try:
+        keycloak_client = await get_keycloak_client(request)
+        token_info = await keycloak_client.introspect_token(access_token)
+
+        if not token_info.is_valid:
+            return None
+
+        return token_info
+    except Exception as e:
+        import logging
+
+        logging.getLogger(__name__).warning(f"Token validation error: {e}")
+        return None
+
+
+async def get_current_user(
+    request: Request,
+    access_token: Annotated[str | None, Cookie()] = None,
+) -> TokenInfo:
+    """Get current user or raise HTTPException.
+
+    Args:
+        request: HTTP request object.
+        access_token: Access token from HTTP-only cookie.
+
+    Returns:
+        Validated TokenInfo for current user.
+
+    Raises:
+        HTTPException: If user is not authenticated.
+    """
+    user = await get_optional_user(request, access_token)
+
+    if not user:
+        login_url = "/auth/dev-login" if settings.is_dev else "/auth/login"
+        raise HTTPException(
+            status_code=307,
+            headers={"Location": login_url},
+        )
+
+    return user
+
+
+OptionalUserDep = Annotated[TokenInfo | None, Depends(get_optional_user)]
+CurrentUserDep = Annotated[TokenInfo, Depends(get_current_user)]
+
+
+def get_user_role(user: TokenInfo | None) -> Role:
+    """Get effective role from user token.
+
+    Args:
+        user: User token info or None for guest.
+
+    Returns:
+        Effective role for the user.
+    """
+    if not user:
+        return Role.GUEST
+
+    return get_effective_role(user.roles)
+
+
+def require_role(required_role: Role):  # type: ignore[no-untyped-def]
+    """Create dependency that requires specific role or higher.
+
+    Args:
+        required_role: Minimum required role.
+
+    Returns:
+        Dependency function for role checking.
+    """
+
+    async def role_checker(user: OptionalUserDep) -> TokenInfo:
+        """Check if user has required role.
+
+        Args:
+            user: Current user from dependency.
+
+        Returns:
+            User token info if authorized.
+
+        Raises:
+            HTTPException: If user lacks required role.
+        """
+        if not user:
+            login_url = "/auth/dev-login" if settings.is_dev else "/auth/login"
+            raise HTTPException(
+                status_code=307,
+                headers={"Location": login_url},
+            )
+
+        user_role = get_user_role(user)
+        role_hierarchy = [Role.GUEST, Role.USER, Role.ADMIN]
+
+        user_level = role_hierarchy.index(user_role)
+        required_level = role_hierarchy.index(required_role)
+
+        if user_level < required_level:
+            raise HTTPException(
+                status_code=403,
+                detail=f"Role '{required_role.value}' or higher required",
+            )
+
+        return user
+
+    return role_checker
+
+
+RequireUserDep = Annotated[TokenInfo, Depends(require_role(Role.USER))]
+RequireAdminDep = Annotated[TokenInfo, Depends(require_role(Role.ADMIN))]
+
+
+def can_edit_post(user: TokenInfo | None, post_author_id: str) -> bool:
+    """Check if user can edit a post.
+
+    Args:
+        user: Current user or None.
+        post_author_id: ID of the post author.
+
+    Returns:
+        True if user can edit the post.
+    """
+    if not user:
+        return False
+
+    user_role = get_user_role(user)
+
+    return user_role == Role.ADMIN or (user_role == Role.USER and user.user_id == post_author_id)
+
+
+def can_delete_post(user: TokenInfo | None, post_author_id: str) -> bool:
+    """Check if user can delete a post.
+
+    Args:
+        user: Current user or None.
+        post_author_id: ID of the post author.
+
+    Returns:
+        True if user can delete the post.
+    """
+    return can_edit_post(user, post_author_id)
+
+
+def can_see_draft(user: TokenInfo | None, post_author_id: str) -> bool:
+    """Check if user can see a draft post.
+
+    Args:
+        user: Current user or None.
+        post_author_id: ID of the post author.
+
+    Returns:
+        True if user can see the draft.
+    """
+    if not user:
+        return False
+
+    user_role = get_user_role(user)
+
+    return user_role == Role.ADMIN or (user_role == Role.USER and user.user_id == post_author_id)
+
+
+def can_create_post(user: TokenInfo | None) -> bool:
+    """Check if user can create a post.
+
+    Args:
+        user: Current user or None.
+
+    Returns:
+        True if user can create posts.
+    """
+    if not user:
+        return False
+
+    user_role = get_user_role(user)
+    return user_role in (Role.USER, Role.ADMIN)

app/presentation/web/error_handlers.py

@@ -0,0 +1,194 @@
+"""Error handlers and middleware for web UI.
+
+This module provides custom error pages and flash message middleware
+for the web interface.
+"""
+
+from typing import Any
+
+from fastapi import HTTPException, Request
+from fastapi.responses import HTMLResponse, RedirectResponse
+from fastapi.templating import Jinja2Templates
+
+from app.presentation.web.flash import FlashManager, get_flash_messages
+
+templates = Jinja2Templates(directory="app/presentation/templates")
+
+
+async def setup_flash_manager(request: Request) -> None:
+    """Setup flash manager on request state.
+
+    Args:
+        request: FastAPI request object.
+    """
+    request.state.flash_manager = FlashManager(request)
+
+
+async def add_flash_to_response(request: Request, response: HTMLResponse) -> None:
+    """Add flash cookie to response if needed.
+
+    Args:
+        request: FastAPI request object.
+        response: FastAPI response object.
+    """
+    if hasattr(request.state, "flash_manager"):
+        request.state.flash_manager.set_cookie(response)
+
+
+def get_template_context(request: Request) -> dict[str, Any]:
+    """Get base template context with flash messages.
+
+    Args:
+        request: FastAPI request object.
+
+    Returns:
+        Template context dictionary.
+    """
+    from app.presentation.web.deps import can_create_post, get_user_role
+
+    user = getattr(request.state, "user", None)
+    user_role = get_user_role(user)
+
+    return {
+        "request": request,
+        "user": user,
+        "user_role": user_role.value if user_role else None,
+        "can_create": can_create_post(user),
+        "flash_messages": get_flash_messages(request),
+    }
+
+
+async def http_exception_handler(request: Request, exc: HTTPException) -> HTMLResponse:
+    """Handle HTTP exceptions with custom error pages.
+
+    Args:
+        request: FastAPI request object.
+        exc: HTTPException instance.
+
+    Returns:
+        HTMLResponse with error page.
+    """
+    # Handle redirects (307, 308)
+    if exc.status_code in (307, 308):
+        location = exc.headers.get("Location") if exc.headers else None
+        if location:
+            return RedirectResponse(url=location, status_code=exc.status_code)  # type: ignore[return-value]
+
+    error_pages = {
+        403: ("Access Denied", "You don't have permission to access this page."),
+        404: ("Page Not Found", "The page you're looking for doesn't exist."),
+        500: ("Server Error", "Something went wrong on our end. Please try again later."),
+    }
+
+    error_title, error_message = error_pages.get(
+        exc.status_code, ("Error", exc.detail or "An unexpected error occurred.")
+    )
+
+    context = get_template_context(request)
+    context.update(
+        {
+            "error_code": exc.status_code,
+            "error_title": error_title,
+            "error_message": error_message,
+        }
+    )
+
+    return templates.TemplateResponse(
+        request,
+        "pages/error.html",
+        context,
+        status_code=exc.status_code,
+    )
+
+
+async def not_found_handler(request: Request, exc: HTTPException) -> HTMLResponse:
+    """Handle 404 Not Found errors.
+
+    Args:
+        request: FastAPI request object.
+        exc: HTTPException instance.
+
+    Returns:
+        HTMLResponse with 404 page.
+    """
+    context = get_template_context(request)
+    context.update(
+        {
+            "error_code": 404,
+            "error_title": "Page Not Found",
+            "error_message": "The page you're looking for doesn't exist or has been moved.",
+        }
+    )
+
+    return templates.TemplateResponse(
+        request,
+        "pages/error.html",
+        context,
+        status_code=404,
+    )
+
+
+async def forbidden_handler(request: Request, exc: HTTPException) -> HTMLResponse:
+    """Handle 403 Forbidden errors.
+
+    Args:
+        request: FastAPI request object.
+        exc: HTTPException instance.
+
+    Returns:
+        HTMLResponse with 403 page.
+    """
+    context = get_template_context(request)
+    context.update(
+        {
+            "error_code": 403,
+            "error_title": "Access Denied",
+            "error_message": "You don't have permission to access this resource. Please sign in or contact an administrator.",
+        }
+    )
+
+    return templates.TemplateResponse(
+        request,
+        "pages/error.html",
+        context,
+        status_code=403,
+    )
+
+
+async def server_error_handler(request: Request, exc: Exception) -> HTMLResponse:
+    """Handle 500 Internal Server Error.
+
+    Args:
+        request: FastAPI request object.
+        exc: Exception instance.
+
+    Returns:
+        HTMLResponse with 500 page.
+    """
+    context = get_template_context(request)
+    context.update(
+        {
+            "error_code": 500,
+            "error_title": "Server Error",
+            "error_message": "Something went wrong on our end. Please try again later or contact support if the problem persists.",
+        }
+    )
+
+    return templates.TemplateResponse(
+        request,
+        "pages/error.html",
+        context,
+        status_code=500,
+    )
+
+
+def register_error_handlers(app: Any) -> None:
+    """Register error handlers with FastAPI app.
+
+    Args:
+        app: FastAPI application instance.
+    """
+    app.add_exception_handler(404, not_found_handler)
+    app.add_exception_handler(403, forbidden_handler)
+    app.add_exception_handler(500, server_error_handler)
+    app.add_exception_handler(HTTPException, http_exception_handler)

app/presentation/web/flash.py

@@ -0,0 +1,175 @@
+"""Flash messages middleware for web UI.
+
+This module provides flash message functionality for the web interface,
+allowing temporary messages to be passed between requests (e.g., after redirect).
+Uses signed cookies for security.
+"""
+
+from fastapi import Request, Response
+from itsdangerous import URLSafeSerializer
+
+from app.infrastructure.config.settings import settings
+
+FLASH_COOKIE_NAME = "flash_messages"
+_SECRET_KEY = (
+    settings.security.secret_key.get_secret_value()
+    if hasattr(settings.security.secret_key, "get_secret_value")
+    else settings.security.secret_key
+)
+SERIALIZER = URLSafeSerializer(_SECRET_KEY)
+
+
+class FlashMessage:
+    """Flash message model.
+
+    Represents a single flash message with type and content.
+
+    Attributes:
+        message: The message text.
+        category: Message category (success, error, warning, info).
+    """
+
+    def __init__(self, message: str, category: str = "info") -> None:
+        """Initialize flash message.
+
+        Args:
+            message: The message text.
+            category: Message category (success, error, warning, info).
+        """
+        self.message = message
+        self.category = category
+
+    def to_dict(self) -> dict[str, str]:
+        """Convert to dictionary.
+
+        Returns:
+            Dictionary with message and category.
+        """
+        return {"message": self.message, "category": self.category}
+
+
+class FlashManager:
+    """Manager for flash messages.
+
+    Handles storing and retrieving flash messages from cookies.
+    Messages are cleared after being read.
+
+    Attributes:
+        request: FastAPI request object.
+        messages: List of current messages.
+    """
+
+    CATEGORIES = {
+        "success": "success",
+        "error": "error",
+        "warning": "warning",
+        "info": "info",
+    }
+
+    def __init__(self, request: Request) -> None:
+        """Initialize flash manager.
+
+        Args:
+            request: FastAPI request object.
+        """
+        self.request = request
+        self.messages: list[FlashMessage] = []
+        self._load_messages()
+
+    def _load_messages(self) -> None:
+        """Load messages from cookie."""
+        cookie_value = self.request.cookies.get(FLASH_COOKIE_NAME)
+        if cookie_value:
+            try:
+                data = SERIALIZER.loads(cookie_value)
+                if isinstance(data, list):
+                    self.messages = [FlashMessage(msg["message"], msg["category"]) for msg in data]
+            except Exception:
+                self.messages = []
+
+    def add(self, message: str, category: str = "info") -> None:
+        """Add a flash message.
+
+        Args:
+            message: The message text.
+            category: Message category (success, error, warning, info).
+        """
+        self.messages.append(FlashMessage(message, category))
+
+    def get_messages(self) -> list[dict[str, str]]:
+        """Get all messages and clear them.
+
+        Returns:
+            List of message dictionaries.
+        """
+        result = [msg.to_dict() for msg in self.messages]
+        self.messages = []
+        return result
+
+    def has_messages(self) -> bool:
+        """Check if there are any messages.
+
+        Returns:
+            True if there are messages.
+        """
+        return len(self.messages) > 0
+
+    def set_cookie(self, response: Response) -> None:
+        """Set flash cookie on response.
+
+        Args:
+            response: FastAPI response object.
+        """
+        if self.messages:
+            data = [msg.to_dict() for msg in self.messages]
+            cookie_value = SERIALIZER.dumps(data)
+            response.set_cookie(
+                key=FLASH_COOKIE_NAME,
+                value=cookie_value,
+                httponly=True,
+                secure=not settings.is_dev,
+                samesite="lax",
+                max_age=300,  # 5 minutes
+            )
+        else:
+            response.delete_cookie(key=FLASH_COOKIE_NAME)
+
+
+def flash(request: Request, message: str, category: str = "info") -> None:
+    """Add flash message to request state.
+
+    Convenience function to add flash message.
+    Must be called before response is created.
+
+    Args:
+        request: FastAPI request object.
+        message: The message text.
+        category: Message category.
+    """
+    if not hasattr(request.state, "flash_manager"):
+        request.state.flash_manager = FlashManager(request)
+    request.state.flash_manager.add(message, category)
+
+
+def get_flash_messages(request: Request) -> list[dict[str, str]]:
+    """Get flash messages from request.
+
+    Args:
+        request: FastAPI request object.
+
+    Returns:
+        List of flash message dictionaries.
+    """
+    if hasattr(request.state, "flash_manager"):
+        return request.state.flash_manager.get_messages()  # type: ignore[no-any-return]
+    return []
+
+
+async def setup_flash_manager(request: Request) -> None:
+    """Setup flash manager on request state.
+
+    Args:
+        request: FastAPI request object.
+    """
+    if not hasattr(request.state, "flash_manager"):
+        request.state.flash_manager = FlashManager(request)

app/presentation/web/routes.py

@@ -0,0 +1,544 @@
+"""Web UI routes for blog application with real use case integration.
+
+This module provides HTML endpoints for the blog web interface
+with role-based access control, user authentication, and full
+integration with the application's use cases and domain layer.
+"""
+
+from typing import Any
+
+from dishka.integrations.fastapi import DishkaRoute, FromDishka
+from fastapi import APIRouter, HTTPException, Request
+from fastapi.responses import HTMLResponse, RedirectResponse
+from fastapi.templating import Jinja2Templates
+from markdown_it import MarkdownIt
+from pygments import highlight
+from pygments.formatters import HtmlFormatter
+from pygments.lexers import get_lexer_by_name
+from pygments.util import ClassNotFound
+
+from app.application.dtos import CreatePostDTO, UpdatePostDTO
+from app.application.use_cases import (
+    CreatePostUseCase,
+    DeletePostUseCase,
+    GetPostUseCase,
+    ListPostsUseCase,
+    PublishPostUseCase,
+    UpdatePostUseCase,
+)
+from app.domain.exceptions import (
+    AlreadyExistsException,
+    NotFoundException,
+    ValidationException,
+)
+from app.domain.roles import Role, get_effective_role
+from app.infrastructure.auth import TokenInfo
+from app.presentation.web.deps import (
+    OptionalUserDep,
+    RequireUserDep,
+    can_create_post,
+    can_delete_post,
+    can_edit_post,
+    can_see_draft,
+)
+from app.presentation.web.flash import flash
+
+router = APIRouter(prefix="/web", tags=["web"], route_class=DishkaRoute)
+templates = Jinja2Templates(directory="app/presentation/templates")
+
+
+_md = MarkdownIt("commonmark", {"html": False}).enable("table")
+
+
+def _highlight_code(code: str, lang: str, _: Any) -> str:
+    try:
+        lexer = get_lexer_by_name(lang)
+    except ClassNotFound:
+        lexer = get_lexer_by_name("text")
+    formatter = HtmlFormatter(nowrap=True)
+    result: str = highlight(code, lexer, formatter)
+    return result
+
+
+def markdown_filter(value: str) -> str:
+    md = MarkdownIt("commonmark", {"html": False, "highlight": _highlight_code}).enable("table")
+    return str(md.render(value))
+
+
+templates.env.filters["markdown"] = markdown_filter
+
+
+_DEFAULT_PAGE_SIZE = 10
+
+
+def _get_user_role(user: TokenInfo | None) -> Role:
+    """Get effective role from user token.
+
+    Args:
+        user: User token info or None for guest.
+
+    Returns:
+        Effective role for the user.
+    """
+    if not user:
+        return Role.GUEST
+    return get_effective_role(user.roles)
+
+
+def _get_base_context(user: TokenInfo | None) -> dict[str, Any]:
+    """Get base template context with user info and permissions.
+
+    Args:
+        user: Current user or None for guest.
+
+    Returns:
+        Dictionary with user, user_role, and can_create flags.
+    """
+    user_role = _get_user_role(user)
+
+    return {
+        "user": user,
+        "user_role": user_role.value if user_role else None,
+        "can_create": can_create_post(user),
+    }
+
+
+async def _get_visible_posts(
+    list_use_case: ListPostsUseCase,
+    user: TokenInfo | None,
+    limit: int,
+    offset: int,
+) -> tuple[list[Any], bool]:
+    """Fetch posts visible to the user with pagination.
+
+    For guests: only published posts.
+    For users: published posts plus own drafts.
+    For admins: all posts.
+
+    Args:
+        list_use_case: Use case for listing posts.
+        user: Current user or None for guest.
+        limit: Maximum number of posts to return.
+        offset: Number of posts to skip.
+
+    Returns:
+        Tuple of (visible posts, has_next flag).
+    """
+    user_role = _get_user_role(user)
+
+    if user_role == Role.ADMIN:
+        posts = await list_use_case.all_posts()
+        posts = sorted(posts, key=lambda p: p.created_at, reverse=True)
+        total = len(posts)
+        posts = posts[offset : offset + limit]
+        has_next = offset + limit < total
+        return posts, has_next
+
+    published = await list_use_case.published_posts(limit=limit + 1, offset=offset)
+    has_next = len(published) > limit
+    published = published[:limit]
+
+    if user_role == Role.USER and user is not None:
+        own = await list_use_case.by_author(user.user_id)
+        published_ids = {p.id for p in published}
+        own_drafts = [p for p in own if p.id not in published_ids and not p.published]
+        merged = list(published) + own_drafts
+        merged.sort(key=lambda p: p.created_at, reverse=True)
+        return merged[:limit], has_next
+
+    return published, has_next
+
+
+@router.get("/", response_class=HTMLResponse)
+async def home(
+    request: Request,
+    user: OptionalUserDep,
+    list_use_case: FromDishka[ListPostsUseCase],
+) -> HTMLResponse:
+    """Render the home page with list of posts.
+
+    Args:
+        request: The HTTP request object for template context.
+        user: Current user from dependency.
+        list_use_case: Use case for listing posts.
+
+    Returns:
+        HTMLResponse with rendered posts list template.
+    """
+    page_str = request.query_params.get("page", "1")
+    page = max(1, int(page_str) if page_str.isdigit() else 1)
+    offset = (page - 1) * _DEFAULT_PAGE_SIZE
+
+    visible_posts, has_next = await _get_visible_posts(
+        list_use_case, user, _DEFAULT_PAGE_SIZE, offset
+    )
+
+    context = _get_base_context(user)
+    return templates.TemplateResponse(
+        request,
+        "pages/index.html",
+        {
+            **context,
+            "posts": visible_posts,
+            "active_page": "home",
+            "current_page": page,
+            "has_prev": page > 1,
+            "has_next": has_next,
+        },
+    )
+
+
+@router.get("/posts", response_class=HTMLResponse)
+async def list_posts(
+    request: Request,
+    user: OptionalUserDep,
+    list_use_case: FromDishka[ListPostsUseCase],
+) -> HTMLResponse:
+    """Render the posts listing page.
+
+    Args:
+        request: The HTTP request object for template context.
+        user: Current user from dependency.
+        list_use_case: Use case for listing posts.
+
+    Returns:
+        HTMLResponse with rendered posts list template.
+    """
+    page_str = request.query_params.get("page", "1")
+    page = max(1, int(page_str) if page_str.isdigit() else 1)
+    offset = (page - 1) * _DEFAULT_PAGE_SIZE
+
+    visible_posts, has_next = await _get_visible_posts(
+        list_use_case, user, _DEFAULT_PAGE_SIZE, offset
+    )
+
+    context = _get_base_context(user)
+    return templates.TemplateResponse(
+        request,
+        "pages/index.html",
+        {
+            **context,
+            "posts": visible_posts,
+            "active_page": "posts",
+            "current_page": page,
+            "has_prev": page > 1,
+            "has_next": has_next,
+        },
+    )
+
+
+@router.get("/posts/new", response_class=HTMLResponse)
+async def new_post_form(
+    request: Request,
+    user: RequireUserDep,
+) -> HTMLResponse:
+    """Render the new post creation form.
+
+    Args:
+        request: The HTTP request object for template context.
+        user: Current user (required).
+
+    Returns:
+        HTMLResponse with rendered post form template.
+    """
+    context = _get_base_context(user)
+
+    return templates.TemplateResponse(
+        request,
+        "pages/post_form.html",
+        {
+            **context,
+            "is_edit": False,
+            "post": None,
+            "active_page": "posts",
+        },
+    )
+
+
+@router.post("/posts/new")
+async def create_post(
+    request: Request,
+    user: RequireUserDep,
+    create_use_case: FromDishka[CreatePostUseCase],
+    publish_use_case: FromDishka[PublishPostUseCase],
+) -> RedirectResponse:
+    """Handle new post creation form submission.
+
+    Args:
+        request: The HTTP request object containing form data.
+        user: Current user (required).
+        create_use_case: Use case for creating posts.
+        publish_use_case: Use case for publishing posts.
+
+    Returns:
+        RedirectResponse to the new post or form page.
+    """
+    form = await request.form()
+    title = str(form.get("title", "")).strip()
+    content = str(form.get("content", "")).strip()
+    tags_str = str(form.get("tags", "")).strip()
+    action = str(form.get("action", "draft")).strip()
+
+    tags = [t.strip() for t in tags_str.split(",") if t.strip()]
+
+    try:
+        dto = CreatePostDTO(
+            title=title,
+            content=content,
+            author_id=user.user_id,
+            tags=tags,
+        )
+        result = await create_use_case.execute(dto)
+
+        user_role = _get_user_role(user)
+        if action == "publish":
+            await publish_use_case.publish(result.id, user.user_id, user_role)
+            flash(request, "Post published successfully!", "success")
+        else:
+            flash(request, "Post saved as draft!", "success")
+
+        return RedirectResponse(url=f"/web/posts/{result.slug}", status_code=303)
+    except AlreadyExistsException as exc:
+        flash(request, str(exc), "error")
+        return RedirectResponse(url="/web/posts/new", status_code=303)
+    except ValidationException as exc:
+        flash(request, str(exc), "error")
+        return RedirectResponse(url="/web/posts/new", status_code=303)
+
+
+@router.get("/posts/{post_slug}", response_class=HTMLResponse)
+async def post_detail(
+    request: Request,
+    post_slug: str,
+    user: OptionalUserDep,
+    get_use_case: FromDishka[GetPostUseCase],
+) -> HTMLResponse:
+    """Render a single post detail page.
+
+    Args:
+        request: The HTTP request object for template context.
+        post_slug: The URL-friendly slug of the post to display.
+        user: Current user from dependency.
+        get_use_case: Use case for retrieving posts.
+
+    Returns:
+        HTMLResponse with rendered post detail template.
+
+    Raises:
+        HTTPException: If post not found or not visible to user.
+    """
+    try:
+        post = await get_use_case.by_slug(post_slug)
+    except NotFoundException:
+        raise HTTPException(status_code=404, detail="Post not found") from None
+
+    if not post.published and not can_see_draft(user, post.author_id):
+        raise HTTPException(status_code=404, detail="Post not found")
+
+    context = _get_base_context(user)
+
+    return templates.TemplateResponse(
+        request,
+        "pages/post_detail.html",
+        {
+            **context,
+            "post": post,
+            "active_page": "posts",
+            "can_edit": can_edit_post(user, post.author_id),
+            "can_delete": can_delete_post(user, post.author_id),
+        },
+    )
+
+
+@router.get("/posts/{post_slug}/edit", response_class=HTMLResponse)
+async def edit_post_form(
+    request: Request,
+    post_slug: str,
+    user: RequireUserDep,
+    get_use_case: FromDishka[GetPostUseCase],
+) -> HTMLResponse:
+    """Render the post edit form.
+
+    Args:
+        request: The HTTP request object for template context.
+        post_slug: The URL-friendly slug of the post to edit.
+        user: Current user (required).
+        get_use_case: Use case for retrieving posts.
+
+    Returns:
+        HTMLResponse with rendered post form template.
+
+    Raises:
+        HTTPException: If post not found or user cannot edit it.
+    """
+    try:
+        post = await get_use_case.by_slug(post_slug)
+    except NotFoundException:
+        raise HTTPException(status_code=404, detail="Post not found") from None
+
+    if not can_edit_post(user, post.author_id):
+        raise HTTPException(status_code=403, detail="Not authorized to edit this post")
+
+    context = _get_base_context(user)
+
+    return templates.TemplateResponse(
+        request,
+        "pages/post_form.html",
+        {
+            **context,
+            "is_edit": True,
+            "post": post,
+            "active_page": "posts",
+        },
+    )
+
+
+@router.post("/posts/{post_slug}/edit")
+async def update_post(
+    request: Request,
+    post_slug: str,
+    user: RequireUserDep,
+    get_use_case: FromDishka[GetPostUseCase],
+    update_use_case: FromDishka[UpdatePostUseCase],
+    publish_use_case: FromDishka[PublishPostUseCase],
+) -> RedirectResponse:
+    """Handle post update form submission.
+
+    Args:
+        request: The HTTP request object containing form data.
+        post_slug: The URL-friendly slug of the post to update.
+        user: Current user (required).
+        get_use_case: Use case for retrieving posts.
+        update_use_case: Use case for updating posts.
+        publish_use_case: Use case for publishing posts.
+
+    Returns:
+        RedirectResponse to the updated post or form page.
+    """
+    form = await request.form()
+    title = str(form.get("title", "")).strip()
+    content = str(form.get("content", "")).strip()
+    tags_str = str(form.get("tags", "")).strip()
+    action = str(form.get("action", "draft")).strip()
+
+    tags = [t.strip() for t in tags_str.split(",") if t.strip()]
+
+    try:
+        post = await get_use_case.by_slug(post_slug)
+    except NotFoundException:
+        raise HTTPException(status_code=404, detail="Post not found") from None
+
+    if not can_edit_post(user, post.author_id):
+        raise HTTPException(status_code=403, detail="Not authorized to edit this post")
+
+    try:
+        dto = UpdatePostDTO(
+            title=title if title else None,
+            content=content if content else None,
+            tags=tags if tags else None,
+        )
+        user_role = _get_user_role(user)
+        result = await update_use_case.execute(post.id, dto, user.user_id, user_role)
+
+        if action == "publish":
+            if not result.published:
+                await publish_use_case.publish(result.id, user.user_id, user_role)
+        else:
+            if result.published:
+                await publish_use_case.unpublish(result.id, user.user_id, user_role)
+
+        flash(request, "Post updated successfully!", "success")
+        return RedirectResponse(url=f"/web/posts/{result.slug}", status_code=303)
+    except (AlreadyExistsException, ValidationException) as exc:
+        flash(request, str(exc), "error")
+        return RedirectResponse(url=f"/web/posts/{post_slug}/edit", status_code=303)
+
+
+@router.post("/posts/{post_slug}/delete")
+async def delete_post(
+    request: Request,
+    post_slug: str,
+    user: RequireUserDep,
+    get_use_case: FromDishka[GetPostUseCase],
+    delete_use_case: FromDishka[DeletePostUseCase],
+) -> RedirectResponse:
+    """Handle post deletion.
+
+    Args:
+        request: The HTTP request object.
+        post_slug: The URL-friendly slug of the post to delete.
+        user: Current user (required).
+        get_use_case: Use case for retrieving posts.
+        delete_use_case: Use case for deleting posts.
+
+    Returns:
+        RedirectResponse redirecting to the home page.
+    """
+    try:
+        post = await get_use_case.by_slug(post_slug)
+    except NotFoundException:
+        raise HTTPException(status_code=404, detail="Post not found") from None
+
+    if not can_delete_post(user, post.author_id):
+        raise HTTPException(status_code=403, detail="Not authorized to delete this post")
+
+    try:
+        user_role = _get_user_role(user)
+        await delete_use_case.execute(post.id, user.user_id, user_role)
+        flash(request, "Post deleted successfully!", "success")
+    except NotFoundException:
+        flash(request, "Post not found.", "error")
+
+    return RedirectResponse(url="/web/", status_code=303)
+
+
+@router.get("/profile", response_class=HTMLResponse)
+async def profile(
+    request: Request,
+    user: RequireUserDep,
+) -> HTMLResponse:
+    """Render user profile page.
+
+    Args:
+        request: The HTTP request object for template context.
+        user: Current user (required).
+
+    Returns:
+        HTMLResponse with rendered profile template.
+    """
+    context = _get_base_context(user)
+
+    return templates.TemplateResponse(
+        request,
+        "pages/profile.html",
+        {
+            **context,
+            "active_page": "profile",
+        },
+    )
+
+
+@router.get("/about", response_class=HTMLResponse)
+async def about(
+    request: Request,
+    user: OptionalUserDep,
+) -> HTMLResponse:
+    """Render the about page.
+
+    Args:
+        request: The HTTP request object for template context.
+        user: Current user from dependency.
+
+    Returns:
+        HTMLResponse with rendered about page template.
+    """
+    context = _get_base_context(user)
+
+    return templates.TemplateResponse(
+        request,
+        "pages/about.html",
+        {
+            **context,
+            "active_page": "about",
+        },
+    )

docs/api/endpoints.md

@@ -1,17 +0,0 @@
-# API Endpoints
-
-## Overview
-
-| Method | Endpoint | Description |
-|--------|----------|-------------|
-| GET | `/` | Health check |
-
-## Health Check
-
-```http
-GET /
-```
-
-**Response:** `200 OK`
-
-Returns application status.

docs/api/index.md

@@ -1,13 +0,0 @@
-# API Reference
-
-This section contains auto-generated API documentation from source code docstrings.
-
-## Modules
-
-::: app.main
-    handler: python
-    options:
-      members:
-        - lifespan
-        - app_factory
-        - main

docs/development/codestyle.md

@@ -1,43 +0,0 @@
-# Code Style
-
-## Linting & Formatting
-
-```bash
-# Run all linters
-uv run ruff check . --fix
-uv run ruff format .
-uv run isort . --profile black --filter-files
-
-# Type checking
-uv run mypy .
-```
-
-## Documentation
-
-```bash
-# Check docstring style
-uv run pydocstyle app/
-
-# Check documentation coverage
-uv run interrogate app/ -v
-
-# Build documentation
-uv run mkdocs build
-
-# Serve documentation locally
-uv run mkdocs serve
-```
-
-## Pre-commit Hooks
-
-This project uses pre-commit hooks to ensure code quality:
-
-- ruff check
-- ruff format
-- isort
-- mypy
-
-Install hooks:
-```bash
-uv run pre-commit install
-```

docs/development/setup.md

@@ -1,31 +0,0 @@
-# Setup Guide
-
-## Prerequisites
-
-- Python 3.13+
-- uv package manager
-
-## Installation
-
-```bash
-# Clone repository
-git clone https://github.com/pyaqa/blog.git
-cd blog
-
-# Install dependencies
-uv sync
-
-# Run tests
-uv run pytest
-
-# Start development server
-uv run python -m app.main
-```
-
-## Development Server
-
-The server runs on `http://0.0.0.0:8000` by default.
-
-Access interactive API docs at:
-- Swagger UI: `http://localhost:8000/docs`
-- ReDoc: `http://localhost:8000/redoc`

docs/index.md

@@ -1,28 +0,0 @@
-# Blog API
-
-Welcome to the Blog API documentation.
-
-## Features
-
-- FastAPI-based REST API
-- Python 3.13+
-- Async support
-- Type hints throughout
-
-## Quick Start
-
-```bash
-# Install dependencies
-uv sync
-
-# Run development server
-uv run python -m app.main
-```
-
-## API Endpoints
-
-See [API Reference](api/endpoints.md) for detailed endpoint documentation.
-
-## Development
-
-See [Development Guide](development/setup.md) for setup instructions.

mkdocs.yml

@@ -1,50 +0,0 @@
-site_name: Blog API Documentation
-site_description: FastAPI Blog Application Documentation
-site_author: Blog Team
-repo_url: https://github.com/pyaqa/blog
-
-theme:
-  name: mkdocs
-  palette:
-    - scheme: default
-      primary: indigo
-      accent: indigo
-      toggle:
-        icon: material/brightness-7
-        name: Switch to dark mode
-    - scheme: slate
-      primary: indigo
-      accent: indigo
-      toggle:
-        icon: material/brightness-4
-        name: Switch to light mode
-
-plugins:
-  - search
-  - mkdocstrings:
-      handlers:
-        python:
-          options:
-            docstring_style: google
-            show_root_heading: true
-            show_source: true
-            show_bases: true
-
-markdown_extensions:
-  - pymdownx.highlight:
-      anchor_linenums: true
-  - pymdownx.inlinehilite
-  - pymdownx.snippets
-  - pymdownx.superfences
-  - admonition
-  - pymdownx.details
-  - tables
-
-nav:
-  - Home: index.md
-  - API Reference:
-      - Overview: api/index.md
-      - Endpoints: api/endpoints.md
-  - Development:
-      - Setup: development/setup.md
-      - Code Style: development/codestyle.md

pyproject.toml

@@ -9,14 +9,35 @@ dependencies = [
     "pydantic>=2.13.2",
     "pydantic-settings>=2.14.0",
     "uvicorn>=0.44.0",
+    "sqlalchemy>=2.0.0",
+    "aiosqlite>=0.21.0",
+    "asyncpg>=0.30.0",
+    "dishka>=1.5.0",
+    "httpx>=0.28.0",
+    "jinja2>=3.1.6",
+    "itsdangerous>=2.2.0",
+    "markdown-it-py>=4.0.0",
+    "mdit-py-plugins>=0.5.0",
+    "pygments>=2.20.0",
 ]
 
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["app"]
+
 [dependency-groups]
 dev = [
     {include-group = "lints"},
     {include-group = "tests"},
     {include-group = "types"},
+    "playwright>=1.59.0",
     "pre-commit>=4.5.1",
+    "pytest-playwright>=0.7.2",
+    "python-multipart>=0.0.27",
+    "types-pygments>=2.20.0.20260408",
 ]
 tests = [
     "httpx>=0.28.1",
@@ -24,29 +45,45 @@ tests = [
     "pytest>=9.0.3",
     "pytest-asyncio>=1.3.0",
     "pytest-cov>=7.1.0",
+    "pytfm",
 ]
 lints = [
-    "black>=23.7.0",
     "ruff>=0.15.11",
     "isort>=8.0.1",
 ]
 types = [
-    "mimesis>=19.1.0",
     "mypy>=1.20.1",
 ]
 
+[project.scripts]
+blog = "app.main:main"
+
+[tool.uv.sources]
+pytfm = { workspace = true }
+
 [tool.pytest.ini_options]
 asyncio_mode = "auto"
-asyncio_default_fixture_loop_scope = "function"
+addopts = "--cov=app --cov-fail-under=70 --cov-report=term-missing --cov-report=html"
-addopts = "--cov=src --cov-report=term"
 pythonpath = "."
 testpaths = "tests"
 xfail_strict = true
+markers = [
+    "e2e: End-to-end tests requiring running server",
+]
 
 [tool.mypy]
 strict = true
+exclude = ["tests/e2e"]
 plugins = ["pydantic.mypy"]
 
+[tool.ruff]
+target-version = "py313"
+line-length = 100
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "W", "B", "C4", "SIM"]
+ignore = ["E501"]
+
 [tool.isort]
 profile = "black"
 filter_files = true

scripts/README.md

@@ -1,65 +0,0 @@
-# Development Scripts
-
-## clean_cache.sh
-
-Clean all Python cache files:
-
-```bash
-bash scripts/clean_cache.sh
-```
-
-Removes:
-- `__pycache__/` directories
-- `*.pyc`, `*.pyo` files
-- `.pytest_cache/`
-- `.mypy_cache/`
-- `.ruff_cache/`
-- `.coverage`
-- `htmlcov/`
-
-## update_readme.py
-
-Update README.md with latest project information:
-
-```bash
-uv run python scripts/update_readme.py
-```
-
-Check if update needed (for CI):
-
-```bash
-uv run python scripts/update_readme.py --check
-```
-
-## post-commit
-
-Git hook for auto-updating README after commits.
-
-Install:
-
-```bash
-cp scripts/post-commit .git/hooks/post-commit
-chmod +x .git/hooks/post-commit
-```
-
-## Disable Python Cache During Development
-
-Set environment variables before running Python:
-
-```bash
-# Option 1: Export variables
-export PYTHONDONTWRITEBYTECODE=1
-export UV_NO_CACHE=1
-
-# Option 2: Use with command
-PYTHONDONTWRITEBYTECODE=1 uv run python -m app.main
-
-# Option 3: Add to .env (not committed)
-echo "PYTHONDONTWRITEBYTECODE=1" >> .env
-```
-
-Or use the clean script periodically:
-
-```bash
-bash scripts/clean_cache.sh
-```

scripts/clean_cache.sh

@@ -1,22 +0,0 @@
-#!/bin/bash
-
-set -e
-
-echo "Cleaning Python cache files..."
-
-find . -type d -name "__pycache__" -exec rm -rf {} + 2>/dev/null || true
-
-find . -type f -name "*.pyc" -delete 2>/dev/null || true
-
-find . -type f -name "*.pyo" -delete 2>/dev/null || true
-
-rm -rf .pytest_cache/ 2>/dev/null || true
-
-rm -rf .mypy_cache/ 2>/dev/null || true
-
-rm -rf .ruff_cache/ 2>/dev/null || true
-
-rm -f .coverage 2>/dev/null || true
-rm -rf htmlcov/ 2>/dev/null || true
-
-echo "✓ Cache cleaned"

scripts/commit-msg

@@ -1,64 +0,0 @@
-#!/bin/bash
-
-set -e
-
-COMMIT_MSG_FILE="$1"
-if [ -z "$COMMIT_MSG_FILE" ]; then
-    echo "Checking for cache files in staged changes..."
-    
-    CACHE_FILES=$(git diff --cached --name-only | grep -E "__pycache__|\.pyc$|\.pyo$" || true)
-    
-    if [ -n "$CACHE_FILES" ]; then
-        echo "❌ Attempting to commit Python cache files!"
-        echo ""
-        echo "Files:"
-        echo "$CACHE_FILES"
-        echo ""
-        echo "Run: bash scripts/clean_cache.sh"
-        echo "Or: git reset HEAD <files>"
-        exit 1
-    fi
-    
-    echo "✓ No cache files in staged changes"
-    exit 0
-fi
-
-COMMIT_MSG=$(cat "$COMMIT_MSG_FILE")
-
-if ! echo "$COMMIT_MSG" | grep -qE "^(feat|fix|docs|style|refactor|test|chore): [a-z].{0,49}$"; then
-    echo "❌ Invalid commit message format!"
-    echo ""
-    echo "Current message: $COMMIT_MSG"
-    echo ""
-    echo "Expected format: <type>: <short description>"
-    echo ""
-    echo "Types:"
-    echo "  feat     - New feature"
-    echo "  fix      - Bug fix"
-    echo "  docs     - Documentation"
-    echo "  style    - Code style"
-    echo "  refactor - Refactoring"
-    echo "  test     - Tests"
-    echo "  chore    - Maintenance"
-    echo ""
-    echo "Rules:"
-    echo "  - Max 50 characters"
-    echo "  - Lowercase after type"
-    echo "  - Imperative mood (add, not added)"
-    echo "  - No period at end"
-    echo ""
-    echo "Good examples:"
-    echo "  feat: add user authentication"
-    echo "  fix: resolve database timeout"
-    echo "  docs: update API docs"
-    echo ""
-    exit 1
-fi
-
-if echo "$COMMIT_MSG" | grep -qE "\.$"; then
-    echo "❌ Commit message should not end with a period"
-    exit 1
-fi
-
-echo "✓ Commit message valid: $COMMIT_MSG"
-exit 0

scripts/post-commit

@@ -1,18 +0,0 @@
-#!/bin/bash
-# Post-commit hook: Update README.md automatically
-
-set -e
-
-echo "Updating README.md..."
-
-# Run README update script
-uv run python scripts/update_readme.py
-
-# Check if README changed
-if ! git diff --quiet README.md; then
-    echo "✓ README.md was updated"
-    echo "  Review changes and commit if needed:"
-    echo "  git add README.md && git commit -m 'docs: update README [skip ci]'"
-else
-    echo "✓ README.md is up to date"
-fi

scripts/update_readme.py

@@ -1,358 +0,0 @@
-#!/usr/bin/env python3
-
-import re
-import subprocess
-import tomllib
-from datetime import datetime
-from pathlib import Path
-from typing import Any
-
-
-def get_project_root() -> Path:
-    return Path(__file__).parent.parent
-
-
-def get_pyproject() -> dict[str, Any]:
-    root = get_project_root()
-    with open(root / "pyproject.toml", "rb") as f:
-        return tomllib.load(f)
-
-
-def get_latest_commits(count: int = 10) -> list[dict[str, str]]:
-    result = subprocess.run(
-        ["git", "log", "--format=%H|%s|%ad|%an", "--date=short", f"-n{count}"],
-        capture_output=True,
-        text=True,
-        cwd=get_project_root(),
-    )
-
-    commits = []
-    for line in result.stdout.strip().split("\n"):
-        if line:
-            parts = line.split("|")
-            if len(parts) >= 4:
-                commits.append(
-                    {
-                        "hash": parts[0][:7],
-                        "message": parts[1],
-                        "date": parts[2],
-                        "author": parts[3],
-                    }
-                )
-    return commits
-
-
-def get_last_tag() -> str | None:
-    result = subprocess.run(
-        ["git", "describe", "--tags", "--abbrev=0"],
-        capture_output=True,
-        text=True,
-        cwd=get_project_root(),
-    )
-    return result.stdout.strip() if result.returncode == 0 else None
-
-
-def get_ignored_files() -> set[str]:
-    gitignore_path = get_project_root() / ".gitignore"
-    ignored = set()
-    if gitignore_path.exists():
-        for line in gitignore_path.read_text().splitlines():
-            line = line.strip()
-            if line and not line.startswith("#"):
-                ignored.add(line.rstrip("/"))
-    return ignored
-
-
-def commit_has_tracked_changes(commit_hash: str) -> bool:
-    result = subprocess.run(
-        ["git", "diff-tree", "--no-commit-id", "--name-only", "-r", commit_hash],
-        capture_output=True,
-        text=True,
-        cwd=get_project_root(),
-    )
-    if not result.stdout.strip():
-        return False
-
-    ignored = get_ignored_files()
-    for file_path in result.stdout.strip().split("\n"):
-        if not file_path:
-            continue
-        parts = file_path.split("/")
-        is_ignored = False
-        for i in range(len(parts)):
-            path_part = "/".join(parts[: i + 1])
-            for pattern in ignored:
-                if pattern.endswith("*"):
-                    if path_part.startswith(pattern[:-1]):
-                        is_ignored = True
-                        break
-                elif path_part == pattern or parts[-1] == pattern:
-                    is_ignored = True
-                    break
-            if is_ignored:
-                break
-        if not is_ignored:
-            return True
-    return False
-
-
-def commit_has_skip_ci_message(commit_hash: str) -> bool:
-    result = subprocess.run(
-        ["git", "log", "-1", "--format=%s", commit_hash],
-        capture_output=True,
-        text=True,
-        cwd=get_project_root(),
-    )
-    msg = result.stdout.strip().lower()
-    return "[skip ci]" in msg or "[skip-ci]" in msg or "[ci skip]" in msg
-
-
-def commit_only_changes_readme(commit_hash: str) -> bool:
-    result = subprocess.run(
-        ["git", "diff-tree", "--no-commit-id", "--name-only", "-r", commit_hash],
-        capture_output=True,
-        text=True,
-        cwd=get_project_root(),
-    )
-    files = [f.strip() for f in result.stdout.strip().split("\n") if f.strip()]
-    return files == ["README.md"]
-
-
-def get_commits_since_tag(tag: str | None) -> list[dict[str, str]]:
-    if tag:
-        result = subprocess.run(
-            ["git", "log", "--format=%H|%s|%ad|%an", "--date=short", f"{tag}..HEAD"],
-            capture_output=True,
-            text=True,
-            cwd=get_project_root(),
-        )
-    else:
-        result = subprocess.run(
-            ["git", "log", "--format=%H|%s|%ad|%an", "--date=short", "-n10"],
-            capture_output=True,
-            text=True,
-            cwd=get_project_root(),
-        )
-
-    commits = []
-    for line in result.stdout.strip().split("\n"):
-        if line:
-            parts = line.split("|")
-            if len(parts) >= 4:
-                commit_hash = parts[0]
-                if commit_has_skip_ci_message(commit_hash):
-                    continue
-                if commit_only_changes_readme(commit_hash):
-                    continue
-                if not commit_has_tracked_changes(commit_hash):
-                    continue
-                commits.append(
-                    {
-                        "hash": commit_hash[:7],
-                        "message": parts[1],
-                        "date": parts[2],
-                        "author": parts[3],
-                    }
-                )
-    return commits
-
-
-def categorize_commits(commits: list[dict[str, str]]) -> dict[str, list[str]]:
-    categories: dict[str, list[str]] = {
-        "Added": [],
-        "Changed": [],
-        "Fixed": [],
-        "Removed": [],
-        "Other": [],
-    }
-
-    for commit in commits:
-        msg = commit["message"].lower()
-        entry = f"- {commit['message']} ({commit['hash']})"
-
-        if msg.startswith("feat") or "add" in msg:
-            categories["Added"].append(entry)
-        elif msg.startswith("fix") or "fix" in msg:
-            categories["Fixed"].append(entry)
-        elif msg.startswith("change") or "update" in msg:
-            categories["Changed"].append(entry)
-        elif msg.startswith("remove") or "delete" in msg:
-            categories["Removed"].append(entry)
-        else:
-            categories["Other"].append(entry)
-
-    return categories
-
-
-def format_changelog(commits: list[dict[str, str]], version: str = "v0.1.0") -> str:
-    categorized = categorize_commits(commits)
-    today = datetime.now().strftime("%Y-%m-%d")
-
-    lines = [f"### [{version}] - {today}"]
-
-    for section, entries in categorized.items():
-        if entries:
-            lines.append(f"\n#### {section}")
-            lines.extend(entries)
-
-    return "\n".join(lines)
-
-
-def get_dependencies(pyproject: dict[str, Any]) -> dict[str, list[str]]:
-    deps: dict[str, list[str]] = {
-        "runtime": [],
-        "tests": [],
-        "lints": [],
-        "types": [],
-        "docs": [],
-    }
-
-    for dep in pyproject.get("project", {}).get("dependencies", []):
-        deps["runtime"].append(dep)
-
-    dep_groups = pyproject.get("dependency-groups", {})
-
-    if "tests" in dep_groups:
-        for dep in dep_groups["tests"]:
-            if isinstance(dep, str):
-                deps["tests"].append(dep)
-
-    if "lints" in dep_groups:
-        for dep in dep_groups["lints"]:
-            if isinstance(dep, str):
-                deps["lints"].append(dep)
-
-    if "types" in dep_groups:
-        for dep in dep_groups["types"]:
-            if isinstance(dep, str):
-                deps["types"].append(dep)
-
-    if "docs" in dep_groups:
-        for dep in dep_groups["docs"]:
-            if isinstance(dep, str):
-                deps["docs"].append(dep)
-
-    return deps
-
-
-def get_available_commands() -> list[dict[str, str]]:
-    commands = [
-        {"cmd": "uv sync", "desc": "Install dependencies"},
-        {"cmd": "uv run python -m app.main", "desc": "Start development server"},
-        {
-            "cmd": "uv run pytest --cov=app --cov-fail-under=70",
-            "desc": "Run tests with coverage",
-        },
-        {"cmd": "uv run ruff check . --fix", "desc": "Run linters"},
-        {"cmd": "uv run ruff format .", "desc": "Format code"},
-        {
-            "cmd": "uv run isort . --profile black --filter-files",
-            "desc": "Sort imports",
-        },
-        {"cmd": "uv run mypy .", "desc": "Type checking"},
-        {"cmd": "uv run mkdocs build", "desc": "Build documentation"},
-        {"cmd": "uv run mkdocs serve", "desc": "Serve documentation locally"},
-    ]
-    return commands
-
-
-def update_dependencies_section(content: str, deps: dict[str, list[str]]) -> str:
-    section_pattern = r"(## Dependencies\n.*?)(\n## |\Z)"
-
-    deps_text = "## Dependencies\n\n"
-
-    if deps["runtime"]:
-        deps_text += "### Runtime\n"
-        for dep in sorted(deps["runtime"]):
-            deps_text += f"- {dep}\n"
-        deps_text += "\n"
-
-    if deps["tests"]:
-        deps_text += "### Development\n"
-        deps_text += "- **Tests**: " + ", ".join(sorted(deps["tests"])) + "\n"
-    if deps["lints"]:
-        deps_text += "- **Lint**: " + ", ".join(sorted(deps["lints"])) + "\n"
-    if deps["types"]:
-        deps_text += "- **Types**: " + ", ".join(sorted(deps["types"])) + "\n"
-    if deps["docs"]:
-        deps_text += "- **Docs**: " + ", ".join(sorted(deps["docs"])) + "\n"
-
-    deps_text += "\n"
-
-    replacement = f"{deps_text}\\2"
-    return re.sub(section_pattern, replacement, content, flags=re.DOTALL)
-
-
-def update_commands_section(content: str, commands: list[dict[str, str]]) -> str:
-    section_pattern = r"(## Available Commands\n.*?\|.*?\n\|---\|.*?\n)(.*?)(\n## |\Z)"
-
-    commands_table = "| Command | Description |\n|---------|-------------|\n"
-    for cmd in commands:
-        commands_table += f"| `{cmd['cmd']}` | {cmd['desc']} |\n"
-
-    commands_table += "\n"
-
-    replacement = f"\\1{commands_table}\\3"
-    return re.sub(section_pattern, replacement, content, flags=re.DOTALL)
-
-
-def update_changelog_section(content: str, changelog: str) -> str:
-    section_pattern = r"(## Changelog\n)(.*?)(\Z)"
-
-    replacement = f"\\1\n{changelog}\n\\3"
-    return re.sub(section_pattern, replacement, content, flags=re.DOTALL)
-
-
-def update_readme(check_only: bool = False) -> bool:
-    readme_path = get_project_root() / "README.md"
-
-    if not readme_path.exists():
-        print("README.md not found")
-        return False
-
-    content = readme_path.read_text()
-    original_content = content
-
-    pyproject = get_pyproject()
-    commits = get_commits_since_tag(get_last_tag())
-    deps = get_dependencies(pyproject)
-    commands = get_available_commands()
-
-    version = get_last_tag() or "v0.1.0"
-    changelog = format_changelog(commits, version)
-
-    content = update_changelog_section(content, changelog)
-    content = update_dependencies_section(content, deps)
-    content = update_commands_section(content, commands)
-
-    if check_only:
-        needs_update = content != original_content
-        if needs_update:
-            print("README.md needs update")
-        else:
-            print("README.md is up to date")
-        return needs_update
-
-    if content != original_content:
-        readme_path.write_text(content)
-        print("README.md updated successfully")
-        return True
-    else:
-        print("No changes needed")
-        return False
-
-
-def main() -> None:
-    import sys
-
-    check_only = "--check" in sys.argv
-
-    updated = update_readme(check_only=check_only)
-
-    if check_only and updated:
-        sys.exit(1)
-    sys.exit(0)
-
-
-if __name__ == "__main__":
-    main()

static/css/base.css

@@ -0,0 +1,158 @@
+/* Base styles for blog application
+ * 
+ * This file provides reset, typography, and base styles
+ * using CSS variables from theme files.
+ */
+
+/* Reset */
+*,
+*::before,
+*::after {
+  box-sizing: border-box;
+  margin: 0;
+  padding: 0;
+}
+
+html {
+  font-size: 16px;
+  line-height: 1.5;
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
+}
+
+body {
+  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+  background-color: var(--color-body);
+  color: var(--color-text);
+  min-height: 100vh;
+  display: flex;
+  flex-direction: column;
+}
+
+/* Typography */
+h1, h2, h3, h4, h5, h6 {
+  color: var(--color-text-dark);
+  font-weight: 600;
+  line-height: 1.25;
+  margin-bottom: 1rem;
+}
+
+h1 { font-size: 2rem; }
+h2 { font-size: 1.75rem; }
+h3 { font-size: 1.5rem; }
+h4 { font-size: 1.25rem; }
+h5 { font-size: 1.125rem; }
+h6 { font-size: 1rem; }
+
+p {
+  margin-bottom: 1rem;
+  color: var(--color-text);
+}
+
+a {
+  color: var(--color-primary);
+  text-decoration: none;
+  transition: color 0.2s ease;
+}
+
+a:hover {
+  color: var(--color-primary-hover);
+  text-decoration: underline;
+}
+
+/* Lists */
+ul, ol {
+  margin-bottom: 1rem;
+  padding-left: 1.5rem;
+}
+
+li {
+  margin-bottom: 0.25rem;
+}
+
+/* Code */
+code {
+  font-family: "SF Mono", Monaco, "Cascadia Code", "Roboto Mono", Consolas, monospace;
+  font-size: 0.875em;
+  background-color: var(--color-code-bg);
+  color: var(--color-text);
+  padding: 0.125rem 0.375rem;
+  border-radius: 3px;
+}
+
+pre {
+  background-color: var(--color-code-bg);
+  padding: 1rem;
+  border-radius: 6px;
+  overflow-x: auto;
+  margin-bottom: 1rem;
+}
+
+pre code {
+  background: none;
+  padding: 0;
+}
+
+/* Selection */
+::selection {
+  background-color: var(--color-primary-alpha-30);
+  color: var(--color-text-dark);
+}
+
+/* Focus styles */
+:focus-visible {
+  outline: 2px solid var(--color-primary);
+  outline-offset: 3px;
+}
+
+/* Enhanced link focus for accessibility */
+a:focus-visible,
+.btn:focus-visible,
+.nav-link:focus-visible {
+  outline: 2px solid var(--color-primary);
+  outline-offset: 4px;
+}
+
+/* Scrollbar */
+::-webkit-scrollbar {
+  width: 10px;
+  height: 10px;
+}
+
+::-webkit-scrollbar-track {
+  background: var(--color-secondary-light-4);
+}
+
+::-webkit-scrollbar-thumb {
+  background: var(--color-secondary-dark-4);
+  border-radius: 5px;
+}
+
+::-webkit-scrollbar-thumb:hover {
+  background: var(--color-secondary-dark-5);
+}
+
+/* Utility classes */
+.text-light {
+  color: var(--color-text-light);
+}
+
+.text-muted {
+  color: var(--color-text-light-3);
+}
+
+.text-center {
+  text-align: center;
+}
+
+.sr-only {
+  position: absolute;
+  width: 1px;
+  height: 1px;
+  padding: 0;
+  margin: -1px;
+  overflow: hidden;
+  clip: rect(0, 0, 0, 0);
+  white-space: nowrap;
+  border: 0;
+}