Implements a persistent JSON storage layer with secure password hashing and atomic writes, replacing in-memory storage patterns.

New Module: src/data_store.py

• Comments API: load_comments(), save_comments(), add_comment(bill_id, author, text), get_comments_for_bill(bill_id)
• Users API: load_users(), save_users(), create_user(username, password, display_name=None), authenticate_user(username, password), update_password(username, new_password)
• Password hashing via passlib[bcrypt]
• Atomic writes using temp file + os.replace()
• Cross-platform file locking (fcntl/msvcrt) with threading lock fallback

Example Usage

from src.data_store import create_user, authenticate_user, add_comment

# Create user with auto-hashed password
user = create_user("alice", "secret123", display_name="Alice")

# Authenticate (supports legacy plaintext + bcrypt)
if authenticate_user("alice", "secret123"):
    add_comment("B001", "alice", "This bill needs amendment")

Other Changes

• data/comments.json.example, data/users.json.example — schema examples
• tests/test_data_store.py — 17 unit tests
• requirements.txt — added passlib[bcrypt]>=1.7.4
• README.md — API reference and migration notes
• .gitignore — Python/Node artifacts

Migration

Existing database/users.json with plaintext passwords continues to work. authenticate_user() auto-detects hash format. Use update_password() to upgrade to bcrypt.

This pull request was created as a result of the following prompt from Copilot chat.

User approved proceeding. Create a pull request that implements a JSON-backed data storage layer for bill comments and user accounts, and performs light repo cleanup and integration. The PR should include:

1. Add src/data_store.py implementing API:

   • load_comments(), save_comments(comments), add_comment(bill_id, author, text), get_comments_for_bill(bill_id)
   • load_users(), save_users(users), create_user(username, password, display_name=None), authenticate_user(username,password), update_password(username,new_password)
   • Uses passlib[bcrypt] for secure password hashing; uses atomic writes (temp file + os.replace) and file locking (fcntl/msvcrt fallback to in-process lock).
   • Ensures data directory exists and creates data/comments.json and data/users.json if missing.

2. Add example data files: data/comments.json.example and data/users.json.example

3. Add tests tests/test_data_store.py covering creating users, authenticating, adding comments, duplicate user creation.

4. Add requirements.txt entry for passlib[bcrypt] and update README.md with instructions and migration notes.

5. Minimal cleanup/linting to modified files.

Constraints:

• Do not change app behavior except storage backend and cleanup.
• Keep changes minimal and well-documented.

Deliverable: A PR on the repository with the title above, containing the new files and modifications. Include a clear PR description summarizing changes, migration steps, and how to run tests. Do not assume a specific base branch; leave base_ref unset if unknown.

The user (bradyd78) has explicitly approved proceeding and asked Copilot to open the PR and implement the changes. Proceed to create the branch, commit changes, and open the PR. If you need to run extra repo scans to find integration points for replacing storage calls in routes, do so and update those files accordingly. If you cannot complete automatic integration, include the new module and instructions for integration in the PR description.

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.