feat: magic-link auth with access requests and RBAC

backend/app/auth/deps.py

@@ -0,0 +1,57 @@
+"""Session-cookie dependencies. Handlers stay thin; DB via get_session."""
+
+from __future__ import annotations
+
+from collections.abc import Iterator
+
+from fastapi import Depends, HTTPException, Request
+from sqlmodel import Session
+
+from app.db import get_session
+from app.models import User
+
+from . import service
+
+SESSION_COOKIE = "kirche_session"
+SESSION_MAX_AGE = int(service.SESSION_TTL.total_seconds())
+
+
+def get_db() -> Iterator[Session]:
+    yield from get_session()
+
+
+def get_optional_user(
+    request: Request, session: Session = Depends(get_db)
+) -> User | None:
+    session_id = request.cookies.get(SESSION_COOKIE)
+    if not session_id:
+        return None
+    record = service.get_valid_session(session, session_id)
+    if record is None:
+        return None
+    return service.get_user(session, record.user_id)
+
+
+def get_current_user(
+    request: Request, session: Session = Depends(get_db)
+) -> User:
+    user = get_optional_user(request, session)
+    if user is None:
+        raise HTTPException(status_code=401, detail="not authenticated")
+    return user
+
+
+def require_admin(user: User = Depends(get_current_user)) -> User:
+    if user.role != "admin":
+        raise HTTPException(status_code=403, detail="admin only")
+    return user
+
+
+def resolve_tenant(
+    user: User | None, explicit: str | None, default: str = "default"
+) -> str:
+    """Tenant comes from the session; the body/query param is a deprecated
+    fallback for unauthenticated callers."""
+    if user is not None:
+        return user.tenant_id
+    return explicit or default