agatha
5fbbc1e67f
Protects image upload, delete, and tag-update endpoints behind Bearer token auth. Public read endpoints remain open. Angular SPA gains a login page, auth interceptor, and route guard for /upload. - JWTAuthProvider (HS256, sub/iat/exp, secrets.compare_digest) - POST /api/v1/auth/token login endpoint - require_auth FastAPI dependency on all write routes - AuthService, LoginComponent, authInterceptor, authGuard - Detail page hides write controls for unauthenticated visitors - 43 unit tests passing; integration tests require Docker stack Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
34 lines
914 B
Python
34 lines
914 B
Python
from fastapi import APIRouter, Depends, HTTPException
|
|
from pydantic import BaseModel
|
|
|
|
from app.auth.jwt_provider import JWTAuthProvider
|
|
from app.dependencies import get_jwt_auth
|
|
|
|
router = APIRouter(tags=["auth"])
|
|
|
|
|
|
class LoginRequest(BaseModel):
|
|
username: str
|
|
password: str
|
|
|
|
|
|
class TokenResponse(BaseModel):
|
|
access_token: str
|
|
token_type: str = "bearer"
|
|
expires_in: int
|
|
|
|
|
|
@router.post("/auth/token", response_model=TokenResponse)
|
|
async def login(body: LoginRequest, auth: JWTAuthProvider = Depends(get_jwt_auth)):
|
|
if not auth.verify_credentials(body.username, body.password):
|
|
raise HTTPException(
|
|
status_code=401,
|
|
detail={"detail": "Invalid credentials", "code": "invalid_credentials"},
|
|
)
|
|
token = auth.create_token()
|
|
return TokenResponse(
|
|
access_token=token,
|
|
token_type="bearer",
|
|
expires_in=auth._expiry_seconds,
|
|
)
|