feat: FastAPI-App mit API-Key- und Session-Auth

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

finance/app/main.py

@@ -0,0 +1,41 @@
+import hmac
+
+from fastapi import Depends, FastAPI, Form, Request
+from fastapi.responses import HTMLResponse, RedirectResponse
+
+from app import auth
+from app.config import get_settings
+
+app = FastAPI(title="Finanzberatungs-Tool")
+
+
+@app.get("/login", response_class=HTMLResponse)
+def login_form():
+    return """<form method=post action=/login>
+      <input name=username placeholder=Benutzer>
+      <input name=password type=password placeholder=Passwort>
+      <button>Anmelden</button></form>"""
+
+
+@app.post("/login")
+def login(username: str = Form(...), password: str = Form(...)):
+    s = get_settings()
+    if not (hmac.compare_digest(username, s.gui_user)
+            and auth.verify_password(password, s.gui_password_hash)):
+        return HTMLResponse("Login fehlgeschlagen", status_code=401)
+    resp = RedirectResponse("/", status_code=303)
+    resp.set_cookie(auth.COOKIE, auth.make_session_token(), httponly=True,
+                    max_age=auth.MAX_AGE, samesite="lax")
+    return resp
+
+
+@app.post("/logout")
+def logout():
+    resp = RedirectResponse("/login", status_code=303)
+    resp.delete_cookie(auth.COOKIE)
+    return resp
+
+
+@app.get("/api/accounts", dependencies=[Depends(auth.require_auth)])
+def _placeholder_accounts():  # wird in Task 9 durch Router ersetzt
+    return []