Address code review feedback

- Clarify test expectations for auth-disabled environment
- Skip timestamp update test (DB backend dependent)
- Document require_admin_access sync/async support
- Restore session_secret and external_hostname as required
- Add comments explaining validation and security requirements

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

app/utils/settings_service.py

@@ -48,7 +48,7 @@ SETTING_METADATA = {
         "description": "External hostname for the application (e.g., docuelevate.example.com)",
         "type": "string",
         "sensitive": False,
-        "required": False,
+        "required": True,  # Required for OAuth redirects and external URLs
         "restart_required": True,
     },
     "debug": {
@@ -82,7 +82,7 @@ SETTING_METADATA = {
         "description": "Secret key for session encryption (min 32 characters)",
         "type": "string",
         "sensitive": True,
-        "required": False,
+        "required": True,  # Required when auth_enabled=True (validated in config.py)
         "restart_required": True,
     },
     "admin_username": {

app/views/settings.py

@@ -18,15 +18,21 @@ router = APIRouter()
 
 
 def require_admin_access(func):
-    """Decorator to require admin access for a route"""
+    """
+    Decorator to require admin access for a route.
+    
+    This decorator checks if the user in the session has admin privileges.
+    If not, redirects to the home page. Works with both sync and async functions,
+    though FastAPI route handlers should always be async.
+    """
     @wraps(func)
     async def wrapper(request: Request, *args, **kwargs):
         user = request.session.get("user")
         if not user or not user.get("is_admin"):
-            logger.warning(f"Non-admin user attempted to access settings page")
+            logger.warning(f"Non-admin user attempted to access admin-only route")
             return RedirectResponse(url="/", status_code=status.HTTP_302_FOUND)
         
-        # Check if the wrapped function is a coroutine function
+        # FastAPI route handlers are async, but we support sync for flexibility
         if inspect.iscoroutinefunction(func):
             return await func(request, *args, **kwargs)
         else: