Initial commit: svg backend

backend/app/api/routes/system.py

@@ -0,0 +1,76 @@
+from fastapi import APIRouter, Depends
+
+from app.core.config import settings
+from app.db.session import db_ping
+from app.schemas.manifest import ServiceManifestResponse
+from app.security.auth import require_api_key
+
+router = APIRouter()
+
+
+@router.get("/healthz")
+async def healthz():
+    return {"status": "ok"}
+
+
+@router.get(f"{settings.api_v1_prefix}/db/ping")
+async def ping_db(role: str = Depends(require_api_key)):
+    result = await db_ping()
+    return {
+        "database": "ok",
+        "result": result,
+        "host": settings.postgres_host,
+        "port": settings.postgres_port,
+        "db": settings.postgres_db,
+    }
+
+
+@router.get(f"{settings.api_v1_prefix}/ping")
+async def ping(role: str = Depends(require_api_key)):
+    return {
+        "message": "pong",
+        "prefix": settings.api_v1_prefix,
+        "role": role,
+    }
+
+
+@router.get(f"{settings.api_v1_prefix}/auth/me")
+async def auth_me(role: str = Depends(require_api_key)):
+    return {
+        "role": role,
+        "auth_header": settings.auth_header_name,
+    }
+
+
+@router.get(f"{settings.api_v1_prefix}/manifest", response_model=ServiceManifestResponse)
+async def get_manifest(role: str = Depends(require_api_key)):
+    return ServiceManifestResponse(
+        service=settings.app_name,
+        api_prefix=settings.api_v1_prefix,
+        auth_header_name=settings.auth_header_name,
+        svg_limits={
+            "max_file_size_bytes": settings.svg_max_file_size_bytes,
+            "max_elements": settings.svg_max_elements,
+        },
+        sanitization={
+            "allow_internal_use_references_only": settings.svg_allow_internal_use_references_only,
+            "forbid_foreign_object_v1": settings.svg_forbid_foreign_object_v1,
+            "forbid_style_v1": settings.svg_forbid_style_v1,
+            "forbid_image_v1": settings.svg_forbid_image_v1,
+            "allowed_data_attributes": [
+                "data-seat-id",
+                "data-sector-id",
+                "data-group-id",
+                "data-row",
+                "data-seat-number",
+            ],
+        },
+        extraction_contract={
+            "seat_fields": ["seat_id", "sector_id", "group_id", "row", "seat_number"],
+            "priority": [
+                "data-* attributes",
+                "inherited parent sector/group",
+                "fallback to element id",
+            ],
+        },
+    )