working with login and building inventory

trade-hub/backend/app/api.py

@@ -1,25 +1,50 @@
-"""FastAPI routes for the Star Citizen inventory (scunpacked data)."""
+"""FastAPI routes for the Star Citizen inventory (scunpacked data).
+
+The catalog endpoints below are read-only. Accounts and personal inventories
+are served by the auth and inventory routers and persisted in PostgreSQL.
+"""
 import math
+from contextlib import asynccontextmanager
 
 from fastapi import FastAPI, HTTPException, Query
 from fastapi.middleware.cors import CORSMiddleware
 
-from app import loader
+from app import config
+from app.auth import router as auth_router
+from app.catalog import store
+from app.db import db_healthy, init_db
+from app.inventory import router as inventory_router
+
+
+@asynccontextmanager
+async def lifespan(_app: FastAPI):
+    if config.AUTO_INIT_DB:
+        init_db(wait_seconds=config.DB_WAIT_SECONDS)
+    yield
+
 
 app = FastAPI(
     title="Star Citizen Inventory API",
-    description="Read-only item inventory built from scunpacked game data.",
-    version="1.0.0",
+    description="Read-only item catalog built from scunpacked game data, plus "
+    "per-user accounts and personal inventories.",
+    version="1.1.0",
+    lifespan=lifespan,
 )
 
-# Read-only public GET API; permissive CORS keeps local development easy.
-app.add_middleware(
-    CORSMiddleware,
-    allow_origins=["*"],
-    allow_methods=["GET"],
-)
+# Same-origin deployment by default. Cross-origin access must be opted into
+# explicitly, because credentialed cookies and a wildcard origin are
+# incompatible (and unsafe).
+if config.CORS_ORIGINS:
+    app.add_middleware(
+        CORSMiddleware,
+        allow_origins=config.CORS_ORIGINS,
+        allow_credentials=True,
+        allow_methods=["GET", "POST", "PATCH", "DELETE"],
+        allow_headers=["Content-Type"],
+    )
 
-store = loader.load_store()
+app.include_router(auth_router)
+app.include_router(inventory_router)
 
 VALID_CATEGORIES = {"ships", "ship-items", "fps-items"}
 
@@ -53,7 +78,7 @@ def _filter_items(category, search, manufacturer, item_type, size):
 
 @app.get("/healthz")
 def healthz():
-    return {"status": "ok", "counts": store.counts}
+    return {"status": "ok", "counts": store.counts, "db": db_healthy()}
 
 
 @app.get("/api/v1/stats")