init

backend/app/api/deps.py

@@ -0,0 +1,37 @@
+"""Shared dependencies: the database session and the optional shared secret."""
+
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import Depends, Header, HTTPException, status
+from sqlalchemy.orm import Session
+
+from app.config import env_settings
+from app.db import get_session
+from app.services.settings_service import load_settings
+from app.settings_schema import AppSettings
+
+DbSession = Annotated[Session, Depends(get_session)]
+
+
+def require_token(x_api_token: Annotated[str | None, Header()] = None) -> None:
+    """Guard every API call when `API_TOKEN` is set.
+
+    Off by default: on a laptop the backend is bound to localhost and a token is
+    friction. Set it the moment the container is reachable from anywhere else.
+    """
+    expected = env_settings().api_token
+    if not expected:
+        return
+    if x_api_token != expected:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED, detail="Bad or missing X-API-Token."
+        )
+
+
+def get_settings(session: DbSession) -> AppSettings:
+    return load_settings(session)
+
+
+Settings = Annotated[AppSettings, Depends(get_settings)]