first commit

backend/app/routes/assets.py

@@ -0,0 +1,69 @@
+from pathlib import Path
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, Response, UploadFile
+from fastapi.responses import FileResponse
+
+from app.auth import require_admin
+from app.config import Settings, get_settings
+from app.services import asset_service
+
+router = APIRouter(prefix="/api/assets", tags=["assets"])
+
+
+def get_assets_dir() -> Path:
+    return Path(get_settings().data_dir) / "assets"
+
+
+AssetsDir = Annotated[Path, Depends(get_assets_dir)]
+Admin = Annotated[None, Depends(require_admin)]
+AppSettings = Annotated[Settings, Depends(get_settings)]
+
+
+@router.post("/", status_code=201)
+async def upload_asset(
+    file: UploadFile,
+    _admin: Admin,
+    assets_dir: AssetsDir,
+    settings: AppSettings,
+) -> dict[str, str]:
+    content = await file.read()
+    try:
+        saved = asset_service.save_asset(
+            assets_dir,
+            file.filename or "upload",
+            content,
+            settings.allowed_upload_types,
+            settings.max_upload_bytes,
+        )
+    except ValueError as exc:
+        msg = str(exc)
+        if "File too large" in msg:
+            raise HTTPException(status_code=413, detail=msg) from None
+        raise HTTPException(status_code=415, detail=msg) from None
+    return {"filename": saved}
+
+
+@router.get("/{filename}")
+def serve_asset(
+    filename: str,
+    assets_dir: AssetsDir,
+) -> FileResponse:
+    file_path = (assets_dir / filename).resolve()
+    if not str(file_path).startswith(str(assets_dir.resolve())):
+        raise HTTPException(status_code=404, detail="Asset not found")
+    if not file_path.exists():
+        raise HTTPException(status_code=404, detail="Asset not found")
+    return FileResponse(file_path)
+
+
+@router.delete("/{filename}")
+def delete_asset(
+    filename: str,
+    _admin: Admin,
+    assets_dir: AssetsDir,
+) -> Response:
+    deleted = asset_service.delete_asset(assets_dir, filename)
+    if not deleted:
+        raise HTTPException(status_code=404, detail="Asset not found")
+    return Response(status_code=204)

backend/app/routes/auth.py

@@ -0,0 +1,14 @@
+from typing import Annotated
+
+from fastapi import APIRouter, Depends
+
+from app.auth import require_admin
+
+router = APIRouter(prefix="/api/auth", tags=["auth"])
+
+Admin = Annotated[None, Depends(require_admin)]
+
+
+@router.get("/verify")
+def verify_token(_: Admin) -> dict[str, bool]:
+    return {"valid": True}

backend/app/routes/segments.py

@@ -0,0 +1,93 @@
+import threading
+from pathlib import Path
+from typing import Annotated
+from uuid import UUID
+
+from fastapi import APIRouter, Depends, HTTPException, Response
+
+from app.auth import require_admin
+from app.config import get_settings
+from app.database import init_db
+from app.models import (
+    ReorderRequest,
+    SegmentCreateRequest,
+    SegmentResponse,
+    SegmentUpdateRequest,
+)
+from app.services import segment_service
+
+router = APIRouter(prefix="/api/segments", tags=["segments"])
+
+# Serialize writes to prevent sort_order race conditions in SQLite
+_write_lock = threading.Lock()
+
+
+def get_db_path() -> Path:
+    data_dir = get_settings().data_dir
+    db_path = Path(data_dir) / "handin.db"
+    init_db(db_path)
+    return db_path
+
+
+DbPath = Annotated[Path, Depends(get_db_path)]
+Admin = Annotated[None, Depends(require_admin)]
+
+
+@router.get("/")
+def list_segments(db_path: DbPath) -> list[SegmentResponse]:
+    segments = segment_service.list_segments(db_path)
+    return [SegmentResponse.model_validate(s.model_dump()) for s in segments]
+
+
+@router.post("/", status_code=201)
+def create_segment(
+    request: SegmentCreateRequest,
+    _: Admin,
+    db_path: DbPath,
+) -> SegmentResponse:
+    with _write_lock:
+        segment = segment_service.create_segment(db_path, request)
+    return SegmentResponse.model_validate(segment.model_dump())
+
+
+@router.put("/reorder")
+def reorder_segments(
+    request: ReorderRequest,
+    _: Admin,
+    db_path: DbPath,
+) -> list[SegmentResponse]:
+    with _write_lock:
+        try:
+            segments = segment_service.reorder_segments(db_path, request.segment_ids)
+        except ValueError as e:
+            raise HTTPException(status_code=400, detail=str(e)) from e
+    return [SegmentResponse.model_validate(s.model_dump()) for s in segments]
+
+
+@router.get("/{segment_id}")
+def get_segment(segment_id: UUID, db_path: DbPath) -> SegmentResponse:
+    segment = segment_service.get_segment(db_path, segment_id)
+    if segment is None:
+        raise HTTPException(status_code=404, detail="Segment not found")
+    return SegmentResponse.model_validate(segment.model_dump())
+
+
+@router.patch("/{segment_id}")
+def update_segment(
+    segment_id: UUID,
+    request: SegmentUpdateRequest,
+    _: Admin,
+    db_path: DbPath,
+) -> SegmentResponse:
+    segment = segment_service.update_segment(db_path, segment_id, request)
+    if segment is None:
+        raise HTTPException(status_code=404, detail="Segment not found")
+    return SegmentResponse.model_validate(segment.model_dump())
+
+
+@router.delete("/{segment_id}", status_code=204)
+def delete_segment(segment_id: UUID, _: Admin, db_path: DbPath) -> Response:
+    deleted = segment_service.delete_segment(db_path, segment_id)
+    if not deleted:
+        raise HTTPException(status_code=404, detail="Segment not found")
+    return Response(status_code=204)

backend/app/routes/site.py

@@ -0,0 +1,33 @@
+from pathlib import Path
+from typing import Annotated
+
+from fastapi import APIRouter, Depends
+
+from app.auth import require_admin
+from app.config import get_settings
+from app.models import SiteResponse, SiteUpdateRequest
+from app.routes.segments import get_db_path
+from app.services import site_service
+
+router = APIRouter(prefix="/api/site", tags=["site"])
+
+Admin = Annotated[None, Depends(require_admin)]
+DbPath = Annotated[Path, Depends(get_db_path)]
+
+
+@router.get("/")
+def get_site(db_path: DbPath) -> SiteResponse:
+    title = site_service.get_site_title(
+        db_path, default=get_settings().site_title
+    )
+    return SiteResponse(title=title)
+
+
+@router.put("/")
+def update_site(
+    request: SiteUpdateRequest,
+    _: Admin,
+    db_path: DbPath,
+) -> SiteResponse:
+    title = site_service.update_site_title(db_path, request.title)
+    return SiteResponse(title=title)