Nginx now listens for path /api and redirects internally, changed BaseURL to use /api, AND patched security authentication issue for POST and GET requests to the uvicorn service

backend/main.py

@@ -32,11 +32,11 @@ async def login_for_access_token(form_data: schemas.UserLogin, db: Session = Dep
     return {"access_token": access_token, "token_type": "bearer"}
 
 @app.get("/users", response_model=List[schemas.User])
-def read_users(db: Session = Depends(get_db)):
+def read_users(db: Session = Depends(get_db), current_user: models.User = Depends(auth.get_current_user)):
     return db.query(models.User).all()
 
 @app.post("/users", response_model=schemas.User)
-def create_user(user: schemas.UserCreate, db: Session = Depends(get_db)):
+def create_user(user: schemas.UserCreate, db: Session = Depends(get_db), current_user: models.User = Depends(auth.get_current_user)):
     db_user = models.User(
         id=user.id,
         name=user.name,
@@ -55,7 +55,7 @@ def create_user(user: schemas.UserCreate, db: Session = Depends(get_db)):
     return db_user
 
 @app.patch("/users/{user_id}", response_model=schemas.User)
-def update_user(user_id: str, user_update: schemas.UserUpdate, db: Session = Depends(get_db)):
+def update_user(user_id: str, user_update: schemas.UserUpdate, db: Session = Depends(get_db), current_user: models.User = Depends(auth.get_current_user)):
     db_user = db.query(models.User).filter(models.User.id == user_id).first()
     if not db_user:
         raise HTTPException(status_code=404, detail="User not found")
@@ -69,7 +69,7 @@ def update_user(user_id: str, user_update: schemas.UserUpdate, db: Session = Dep
     return db_user
 
 @app.post("/users/{user_id}/password")
-def change_password(user_id: str, payload: schemas.PasswordChange, db: Session = Depends(get_db)):
+def change_password(user_id: str, payload: schemas.PasswordChange, db: Session = Depends(get_db), current_user: models.User = Depends(auth.get_current_user)):
     db_user = db.query(models.User).filter(models.User.id == user_id).first()
     if not db_user:
         raise HTTPException(status_code=404, detail="User not found")
@@ -80,7 +80,7 @@ def change_password(user_id: str, payload: schemas.PasswordChange, db: Session =
     return {"message": "Password updated"}
 
 @app.delete("/users/{user_id}")
-def delete_user(user_id: str, db: Session = Depends(get_db)):
+def delete_user(user_id: str, db: Session = Depends(get_db), current_user: models.User = Depends(auth.get_current_user)):
     db_user = db.query(models.User).filter(models.User.id == user_id).first()
     if not db_user:
         raise HTTPException(status_code=404, detail="User not found")
@@ -93,11 +93,11 @@ def delete_user(user_id: str, db: Session = Depends(get_db)):
     return {"message": "User deleted"}
 
 @app.get("/tasks", response_model=List[schemas.Task])
-def read_tasks(db: Session = Depends(get_db)):
+def read_tasks(db: Session = Depends(get_db), current_user: models.User = Depends(auth.get_current_user)):
     return db.query(models.Task).all()
 
 @app.post("/tasks", response_model=schemas.Task)
-def create_task(task: schemas.TaskCreate, db: Session = Depends(get_db)):
+def create_task(task: schemas.TaskCreate, db: Session = Depends(get_db), current_user: models.User = Depends(auth.get_current_user)):
     task_id = task.id or f"t_{uuid.uuid4().hex[:8]}"
     db_task = models.Task(
         id=task_id,
@@ -125,7 +125,7 @@ def create_task(task: schemas.TaskCreate, db: Session = Depends(get_db)):
     return db_task
 
 @app.patch("/tasks/{task_id}", response_model=schemas.Task)
-def update_task(task_id: str, task_update: schemas.TaskUpdate, db: Session = Depends(get_db)):
+def update_task(task_id: str, task_update: schemas.TaskUpdate, db: Session = Depends(get_db), current_user: models.User = Depends(auth.get_current_user)):
     db_task = db.query(models.Task).filter(models.Task.id == task_id).first()
     if not db_task:
         raise HTTPException(status_code=404, detail="Task not found")
@@ -139,7 +139,7 @@ def update_task(task_id: str, task_update: schemas.TaskUpdate, db: Session = Dep
     return db_task
 
 @app.delete("/tasks/{task_id}")
-def delete_task(task_id: str, db: Session = Depends(get_db)):
+def delete_task(task_id: str, db: Session = Depends(get_db), current_user: models.User = Depends(auth.get_current_user)):
     db_task = db.query(models.Task).filter(models.Task.id == task_id).first()
     if not db_task:
         raise HTTPException(status_code=404, detail="Task not found")
@@ -148,11 +148,11 @@ def delete_task(task_id: str, db: Session = Depends(get_db)):
     db.commit()
     return {"message": "Task deleted"}
 @app.get("/audit", response_model=List[schemas.AuditLog])
-def read_audit(db: Session = Depends(get_db)):
+def read_audit(db: Session = Depends(get_db), current_user: models.User = Depends(auth.get_current_user)):
     return db.query(models.AuditLog).order_by(models.AuditLog.at.desc()).all()
 
 @app.post("/audit", response_model=schemas.AuditLog)
-def create_audit(audit: schemas.AuditLogBase, db: Session = Depends(get_db)):
+def create_audit(audit: schemas.AuditLogBase, db: Session = Depends(get_db), current_user: models.User = Depends(auth.get_current_user)):
     audit_id = f"a_{uuid.uuid4().hex[:8]}"
     db_audit = models.AuditLog(
         id=audit_id,