add auth

backend/app/main.py

@@ -3,6 +3,7 @@ from contextlib import asynccontextmanager
 from fastapi import FastAPI, Request
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse
+from sqlalchemy import select
 
 # uvicorn's dictConfig only configures uvicorn.* loggers; the root logger
 # ends up with no handler, so app.* records are silently discarded.
@@ -17,18 +18,45 @@ _app_logger.propagate = False
 
 log = logging.getLogger(__name__)
 
-from app.database import engine, Base
-from app.routers import libraries, media, tags, search
+from app.config import settings
+from app.database import engine, Base, SessionLocal
+from app.routers import libraries, media, tags, search, auth
 from app.services import watcher as watcher_service
+from app.auth import hash_password
 import app.models  # noqa: F401 — registers models with Base.metadata
 
 
+async def _ensure_admin_user():
+    from app.models import User
+
+    if not settings.admin_password:
+        log.warning("ADMIN_PASSWORD not set — no admin user will be created.")
+        return
+
+    async with SessionLocal() as db:
+        result = await db.execute(select(User).where(User.username == settings.admin_username))
+        if result.scalars().first():
+            log.info("Admin user '%s' already exists.", settings.admin_username)
+            return
+
+        user = User(
+            username=settings.admin_username,
+            password_hash=hash_password(settings.admin_password),
+            is_admin=True,
+        )
+        db.add(user)
+        await db.commit()
+        log.info("Created admin user '%s'.", settings.admin_username)
+
+
 @asynccontextmanager
 async def lifespan(app: FastAPI):
     log.info("Creating database tables...")
     async with engine.begin() as conn:
         await conn.run_sync(Base.metadata.create_all)
 
+    await _ensure_admin_user()
+
     log.info("Starting library watchers...")
     await watcher_service.start_all()
 
@@ -54,6 +82,7 @@ app.add_middleware(
     allow_headers=["*"],
 )
 
+app.include_router(auth.router, prefix="/api")
 app.include_router(libraries.router, prefix="/api")
 app.include_router(media.router, prefix="/api")
 app.include_router(tags.router, prefix="/api")