NO TICKET: cover all endpoints with auth dependencies

api/asset.py

@@ -23,9 +23,8 @@
 from api.pagination import CustomPage
 from core.dependencies import (
     session_dependency,
-    viewer_function,
+    viewer_dependency,
     admin_dependency,
-    admin_function,
     editor_dependency,
 )
 from db import Thing
@@ -43,9 +42,7 @@
 )
 from services.exceptions_helper import PydanticStyleException
 
-router = APIRouter(
-    prefix="/asset", tags=["asset"], dependencies=[Depends(viewer_function)]
-)
+router = APIRouter(prefix="/asset", tags=["asset"])
 
 
 def database_error_handler(payload: CreateAsset, error: ProgrammingError) -> None:
@@ -80,10 +77,11 @@ def database_error_handler(payload: CreateAsset, error: ProgrammingError) -> Non
 @router.post(
     "/upload",
     status_code=HTTP_201_CREATED,
-    dependencies=[Depends(admin_function)],
 )
 async def upload_asset(
-    bucket=Depends(get_storage_bucket), file: UploadFile = File(...)
+    user: admin_dependency,
+    bucket=Depends(get_storage_bucket),
+    file: UploadFile = File(...),
 ) -> dict:
     uri, blob_name = gcs_upload(file, bucket)
     return {
@@ -148,6 +146,7 @@ async def add_asset(
 
 @router.get("")
 async def list_assets(
+    user: viewer_dependency,
     session: session_dependency,
     thing_id: int = None,
 ) -> CustomPage[AssetResponse]:
@@ -171,6 +170,7 @@ def transformer(records: list[Asset]):
 
 @router.get("/{asset_id}")
 async def get_asset(
+    user: viewer_dependency,
     asset_id: int,
     session: session_dependency,
     bucket=Depends(get_storage_bucket),
@@ -213,9 +213,9 @@ async def delete_asset(
 @router.delete(
     "/{asset_id}/remove",
     status_code=HTTP_204_NO_CONTENT,
-    dependencies=[Depends(admin_function)],
 )
 async def remove_asset(
+    user: admin_dependency,
     asset_id: int,
     session: session_dependency,
     bucket=Depends(get_storage_bucket),

api/author.py

@@ -13,11 +13,10 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 # ===============================================================================
-from fastapi import APIRouter, Depends
+from fastapi import APIRouter
 from sqlalchemy import select
-from sqlalchemy.orm import Session
 
-from db.engine import get_db_session
+from core.dependencies import viewer_dependency, session_dependency
 from db.publication import Author
 from schemas.publication import PublicationResponse
 
@@ -32,7 +31,7 @@
     response_model=list[PublicationResponse],
 )
 async def get_author_publications(
-    author_id: int, session: Session = Depends(get_db_session)
+    user: viewer_dependency, author_id: int, session: session_dependency
 ):
     """
     Retrieve all publications for a specific author.

api/geochronology.py

@@ -14,19 +14,18 @@
 # limitations under the License.
 # ===============================================================================
 from db.geochronology import GeochronologyAge
-from fastapi import APIRouter, Depends, status
+from fastapi import APIRouter, status
 from services.crud_helper import model_adder
-from db.engine import get_db_session
 from schemas.geochronology import CreateGeochronologyAge
-from sqlalchemy.orm import Session
 from sqlalchemy import select
+from core.dependencies import viewer_dependency, session_dependency
 
 router = APIRouter(prefix="/geochronology", tags=["geochronology"])
 
 
 @router.post("/age", tags=["geochronology"], status_code=status.HTTP_201_CREATED)
 async def create_age(
-    age: CreateGeochronologyAge, session: Session = Depends(get_db_session)
+    user: viewer_dependency, age: CreateGeochronologyAge, session: session_dependency
 ):
     """
     Create a new geochronology age entry.
@@ -38,7 +37,7 @@ async def create_age(
 
 @router.get("/age", tags=["geochronology"])
 async def get_geochronology_age(
-    method: str = "arar", session: Session = Depends(get_db_session)
+    user: viewer_dependency, session: session_dependency, method: str = "arar"
 ):
     """
     Retrieve geochronology age data.

api/geospatial.py

@@ -23,7 +23,7 @@
 
 # from starlette.responses import FileResponse
 
-from core.dependencies import session_dependency
+from core.dependencies import session_dependency, viewer_dependency
 from db import Group
 from schemas.thing import FeatureCollectionResponse
 from services.geospatial_helper import create_shapefile, get_thing_features
@@ -34,6 +34,7 @@
 
 @router.get("")
 async def get_geospatial(
+    user: viewer_dependency,
     session: session_dependency,
     thing_type: Annotated[List[str], Query(title="thing_type")] = None,
     group: Annotated[str | int, Query(title="group")] = None,
@@ -61,7 +62,7 @@ async def get_geospatial(
 
 @router.get("/project-area/{group_id}", summary="Get project area for group")
 async def get_project_area(
-    session: session_dependency, group_id: int
+    user: viewer_dependency, session: session_dependency, group_id: int
 ) -> FeatureCollectionResponse:
 
     group = simple_get_by_id(session, Group, group_id)

api/group.py

@@ -14,15 +14,15 @@
 # limitations under the License.
 # ===============================================================================
 
-from fastapi import Depends, APIRouter, Query
+from fastapi import APIRouter, Query
 from starlette.status import HTTP_201_CREATED, HTTP_204_NO_CONTENT
 
 from api.pagination import CustomPage
 from core.dependencies import (
     session_dependency,
     admin_dependency,
     editor_dependency,
-    viewer_function,
+    viewer_dependency,
 )
 from db.group import Group
 from schemas.group import UpdateGroup, CreateGroup, GroupResponse
@@ -32,9 +32,7 @@
     paginated_all_getter,
 )
 
-router = APIRouter(
-    prefix="/group", tags=["group"], dependencies=[Depends(viewer_function)]
-)
+router = APIRouter(prefix="/group", tags=["group"])
 
 # POST =========================================================================
 
@@ -69,7 +67,9 @@ async def create_group(
 # ============= Get =============================================
 @router.get("", summary="Get groups")
 async def get_groups(
-    session: session_dependency, filter_: str = Query(alias="filter", default=None)
+    user: viewer_dependency,
+    session: session_dependency,
+    filter_: str = Query(alias="filter", default=None),
 ) -> CustomPage[GroupResponse]:
     """
     Retrieve all groups from the database.
@@ -78,7 +78,9 @@ async def get_groups(
 
 
 @router.get("/{group_id}", summary="Get group by ID")
-async def get_group_by_id(group_id: int, session: session_dependency) -> GroupResponse:
+async def get_group_by_id(
+    user: viewer_dependency, group_id: int, session: session_dependency
+) -> GroupResponse:
     """
     Retrieve a group by ID from the database.
     """

api/observation.py

@@ -21,6 +21,7 @@
 from core.dependencies import (
     session_dependency,
     amp_admin_dependency,
+    amp_editor_dependency,
     amp_viewer_dependency,
 )
 from db import Observation
@@ -101,7 +102,7 @@ async def update_groundwater_level_observation(
     observation_id: int,
     obs_data: UpdateGroundwaterLevelObservation,
     session: session_dependency,
-    user: amp_admin_dependency,
+    user: amp_editor_dependency,
     request: Request,
 ) -> GroundwaterLevelObservationResponse:
     """
@@ -115,7 +116,7 @@ async def update_water_chemistry_observation(
     observation_id: int,
     obs_data: UpdateWaterChemistryObservation,
     session: session_dependency,
-    user: amp_admin_dependency,
+    user: amp_editor_dependency,
     request: Request,
 ) -> WaterChemistryObservationResponse:
     """

api/publication.py

@@ -18,7 +18,7 @@
 from schemas.publication import PublicationResponse, CreatePublication
 from services.publication_helper import add_publication
 from sqlalchemy.orm import Session
-
+from core.dependencies import admin_dependency
 
 router = APIRouter(
     prefix="/publication",
@@ -30,6 +30,7 @@
     "/add", response_model=PublicationResponse, status_code=status.HTTP_201_CREATED
 )
 async def post_publication(
+    user: admin_dependency,
     publication_data: CreatePublication,  # Replace with your actual schema
     session: Session = Depends(
         get_db_session

api/search.py

@@ -20,7 +20,7 @@
 from fastapi_pagination import paginate
 from fastapi_pagination.utils import disable_installed_extensions_check
 
-from core.dependencies import session_dependency
+from core.dependencies import session_dependency, viewer_dependency
 from db import (
     Contact,
     Email,
@@ -158,6 +158,7 @@ def _get_asset_results(session: Session, q: str, limit: int) -> list[dict]:
 
 @router.get("")
 async def search_api(
+    user: viewer_dependency,
     session: session_dependency,
     q: str,
     limit: int = 25,