add auth

backend/app/routers/media.py

@@ -5,9 +5,10 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy import select
 
 from app.database import get_db
-from app.models import Library, MediaItem, Tag
+from app.models import Library, MediaItem, Tag, User
 from app.schemas import MediaItemOut, TagIdList
 from app.services.thumbnails import get_or_create_thumbnail
+from app.auth import get_current_user, get_current_user_from_query_or_header
 
 router = APIRouter(prefix="/media", tags=["media"])
 
@@ -33,7 +34,11 @@ def _resolve_safe(lib: Library, item: MediaItem) -> Path:
 
 
 @router.get("/{media_id}", response_model=MediaItemOut)
-async def get_media_item(media_id: int, db: AsyncSession = Depends(get_db)):
+async def get_media_item(
+    media_id: int,
+    db: AsyncSession = Depends(get_db),
+    _user: User = Depends(get_current_user),
+):
     result = await db.execute(
         select(MediaItem).where(MediaItem.id == media_id)
     )
@@ -46,7 +51,11 @@ async def get_media_item(media_id: int, db: AsyncSession = Depends(get_db)):
 
 
 @router.get("/{media_id}/file")
-async def serve_file(media_id: int, db: AsyncSession = Depends(get_db)):
+async def serve_file(
+    media_id: int,
+    db: AsyncSession = Depends(get_db),
+    _user: User = Depends(get_current_user_from_query_or_header),
+):
     item, lib = await _get_item_and_lib(media_id, db)
     if item.missing:
         raise HTTPException(404, "File is missing from disk")
@@ -57,7 +66,11 @@ async def serve_file(media_id: int, db: AsyncSession = Depends(get_db)):
 
 
 @router.get("/{media_id}/thumbnail")
-async def serve_thumbnail(media_id: int, db: AsyncSession = Depends(get_db)):
+async def serve_thumbnail(
+    media_id: int,
+    db: AsyncSession = Depends(get_db),
+    _user: User = Depends(get_current_user_from_query_or_header),
+):
     item, lib = await _get_item_and_lib(media_id, db)
     abs_path = _resolve_safe(lib, item)
     thumb = get_or_create_thumbnail(media_id, str(abs_path), item.media_type)
@@ -67,7 +80,12 @@ async def serve_thumbnail(media_id: int, db: AsyncSession = Depends(get_db)):
 
 
 @router.put("/{media_id}/tags", response_model=MediaItemOut)
-async def set_tags(media_id: int, body: TagIdList, db: AsyncSession = Depends(get_db)):
+async def set_tags(
+    media_id: int,
+    body: TagIdList,
+    db: AsyncSession = Depends(get_db),
+    _user: User = Depends(get_current_user),
+):
     result = await db.execute(select(MediaItem).where(MediaItem.id == media_id))
     item = result.scalars().first()
     if not item: