address backend security and test suggestions

backend/app/api/api_v1/endpoints/setup.py

@@ -1,6 +1,11 @@
-from fastapi import APIRouter, HTTPException, status
+from typing import Optional
+
+from fastapi import APIRouter, Depends, HTTPException, Request, Security, status
+from fastapi.security import HTTPAuthorizationCredentials
 from pydantic import BaseModel, EmailStr
 
+from app.core.security import api_key_header, require_admin_auth, security_bearer
+
 router = APIRouter()
 
 # Simple in-memory storage for setup status (for Milestone 1)
@@ -33,6 +38,17 @@ class SystemConfigRequest(BaseModel):
     base_url: str
 
 
+async def require_setup_write_auth(
+    request: Request,
+    api_key: Optional[str] = Security(api_key_header),
+    bearer: Optional[HTTPAuthorizationCredentials] = Security(security_bearer),
+) -> dict:
+    """Allow unauthenticated first-time setup writes, then require admin auth."""
+    if not setup_status["is_setup_complete"]:
+        return {"auth_type": "initial_setup"}
+    return await require_admin_auth(request=request, api_key=api_key, bearer=bearer)
+
+
 @router.get("/status", response_model=SetupStatusResponse)
 async def get_setup_status():
     """Get the current setup status"""
@@ -43,7 +59,10 @@ async def get_setup_status():
 
 
 @router.post("/admin", status_code=201)
-async def setup_admin(request: AdminSetupRequest):
+async def setup_admin(
+    request: AdminSetupRequest,
+    _auth: dict = Depends(require_setup_write_auth),
+):
     """
     Setup admin user during initial system configuration.
     For Milestone 1, this simply stores the admin email in memory.
@@ -60,7 +79,10 @@ async def setup_admin(request: AdminSetupRequest):
 
 
 @router.post("/system", status_code=200)
-async def setup_system(request: SystemConfigRequest):
+async def setup_system(
+    request: SystemConfigRequest,
+    _auth: dict = Depends(require_setup_write_auth),
+):
     """
     Setup system configuration.
     For Milestone 1, this simply stores the app name in memory.