changes to the Authentik integration

app/auth.py

@@ -1,9 +1,10 @@
 # app/auth.py
 import os
+from functools import wraps
+
 from authlib.integrations.starlette_client import OAuth
 from starlette.config import Config
-from starlette.middleware.sessions import SessionMiddleware
-from fastapi import APIRouter, Request
+from fastapi import APIRouter, Request, status
 from starlette.responses import RedirectResponse
 
 config = Config(".env")
@@ -26,19 +27,31 @@ def get_current_user(request: Request):
 
 def require_login(func):
     """Decorator to require login for particular endpoints."""
+    @wraps(func)
     async def wrapper(request: Request, *args, **kwargs):
         if not request.session.get("user"):
-            return RedirectResponse(url="/login")
+            # Not logged in => redirect to /login
+            return RedirectResponse(url="/login", status_code=status.HTTP_302_FOUND)
+        # User is logged in => proceed
         return await func(request, *args, **kwargs)
     return wrapper
 
 @router.get("/login")
 async def login(request: Request):
+    """
+    Initiate Authentik login flow.
+    This calls oauth.authentik.authorize_redirect(...)
+    The resulting redirect_uri must match what's in Authentik's application config.
+    """
     redirect_uri = request.url_for("auth")
     return await oauth.authentik.authorize_redirect(request, redirect_uri)
 
 @router.get("/auth")
 async def auth(request: Request):
+    """
+    Authentik callback endpoint. Exchanges code for token,
+    puts user info in session, and redirects to /ui or wherever you want.
+    """
     token = await oauth.authentik.authorize_access_token(request)
     userinfo = token.get("userinfo")
     request.session["user"] = dict(userinfo)
@@ -46,11 +59,13 @@ async def auth(request: Request):
 
 @router.get("/logout")
 async def logout(request: Request):
+    """Clears session and redirects home."""
     request.session.pop("user", None)
     return RedirectResponse(url="/")
 
 @router.get("/private")
 @require_login
 async def private_page(request: Request):
-    user = request.session.get("user")
+    """A protected endpoint that requires login."""
+    user = request.session.get("user")  # e.g. {"email": "...", ...}
     return {"message": f"This is a protected page. Hello {user['email']}!"}