Fixes #102: Защитить ручки Lecturer/Photo

Makefile

@@ -11,6 +11,12 @@ format:
 	source ./venv/bin/activate && autoflake -r --in-place --remove-all-unused-imports ./calendar_backend
 	source ./venv/bin/activate && isort ./calendar_backend
 	source ./venv/bin/activate && black ./calendar_backend
+	source ./venv/bin/activate && autoflake -r --in-place --remove-all-unused-imports ./tests
+	source ./venv/bin/activate && isort ./tests
+	source ./venv/bin/activate && black ./tests
+	source ./venv/bin/activate && autoflake -r --in-place --remove-all-unused-imports ./migrations
+	source ./venv/bin/activate && isort ./migrations
+	source ./venv/bin/activate && black ./migrations
 
 db:
 	docker run -d -p 5432:5432 -e POSTGRES_HOST_AUTH_METHOD=trust --name db-timetable_api postgres:15

calendar_backend/routes/lecturer/comment.py

@@ -10,7 +10,7 @@
 
 
 settings = get_settings()
-router = APIRouter(prefix="/lecturer/{lecturer_id}", tags=["Lecturer: Comment"])
+router = APIRouter(prefix="/lecturer/{lecturer_id}", tags=["Lecturer: Comment"], deprecated=True)
 
 
 @router.post("/comment/", response_model=CommentLecturer)

calendar_backend/routes/lecturer/comment_review.py

@@ -11,7 +11,7 @@
 from calendar_backend.routes.models import CommentLecturer
 
 
-router = APIRouter(prefix="/lecturer/{lecturer_id}/comment", tags=["Lecturer: Comment Review"])
+router = APIRouter(prefix="/lecturer/{lecturer_id}/comment", tags=["Lecturer: Comment Review"], deprecated=True)
 
 
 @router.get("/review/", response_model=list[CommentLecturer])

calendar_backend/routes/lecturer/photo.py

@@ -1,4 +1,5 @@
-from fastapi import APIRouter, File, UploadFile
+from auth_lib.fastapi import UnionAuth
+from fastapi import APIRouter, Depends, File, UploadFile
 from fastapi_sqlalchemy import db
 
 from calendar_backend.exceptions import ObjectNotFound
@@ -14,7 +15,11 @@
 
 
 @router.post("/photo", response_model=Photo)
-async def upload_photo(lecturer_id: int, photo: UploadFile = File(...)) -> Photo:
+async def upload_photo(
+    lecturer_id: int,
+    photo: UploadFile = File(...),
+    _=Depends(UnionAuth(scopes=["timetable.lecturer.photo.create"])),
+) -> Photo:
     """Загрузить фотографию преподавателя из локального файла
 
     Пример загрузки файла на питоне
@@ -50,7 +55,11 @@ async def get_lecturer_photos(lecturer_id: int, limit: int = 10, offset: int = 0
 
 
 @router.delete("/photo/{id}", response_model=None)
-async def delete_photo(id: int, lecturer_id: int) -> None:
+async def delete_photo(
+    id: int,
+    lecturer_id: int,
+    _=Depends(UnionAuth(scopes=["timetable.lecturer.photo.delete"])),
+) -> None:
     photo = DbPhoto.get(id, only_approved=False, session=db.session)
     if photo.lecturer_id != lecturer_id:
         raise ObjectNotFound(DbPhoto, id)

calendar_backend/settings.py

@@ -2,7 +2,7 @@
 from functools import lru_cache
 
 from auth_lib.fastapi import UnionAuthSettings
-from pydantic import AnyHttpUrl, ConfigDict, DirectoryPath, Json, PostgresDsn
+from pydantic import AnyHttpUrl, ConfigDict, DirectoryPath, PostgresDsn
 from pydantic_settings import BaseSettings
 
 

migrations/versions/63263ee9e08e_fix_photo_paths.py

@@ -6,7 +6,6 @@
 
 """
 
-import sqlalchemy as sa
 from alembic import op