#91 - Lock down public tryout endpoints — require auth - forgejo_admin/basketball-api

### Lineage `plan-2026-03-08-tryout-prep` → Phase 11 (discovered scope during 11a) ### Repo `forgejo_admin/basketball-api` ### User Story As an admin I want all roster/player endpoints to require authentication So that parent PII (email, phone) is not exposed to unauthenticated visitors now that tryouts are over and all users have Keycloak accounts ### Context During tryout day, the public roster endpoints were intentionally unauthenticated so parents could check the roster before having accounts. Tryouts are over. All 50 users have Keycloak accounts. There is no longer a reason to serve parent PII without auth. The public tryout endpoints in `routes/tryouts.py` currently have NO authentication: - `GET /api/roster/{tenant_slug}` — returns full roster with parent name, email, phone - `POST /api/roster/{tenant_slug}/check-in/{player_id}` — marks player checked in - `POST /api/roster/{tenant_slug}/assign-number/{player_id}` — assigns tryout number The check-in and assign-number endpoints are also obsolete (tryouts are over) but should still be locked down rather than removed, in case they're needed for future tryouts. The photo upload endpoint (`POST /upload/photo`) is also unauthenticated — should require auth too. ### File Targets Files to modify: - `src/basketball_api/routes/tryouts.py` — Add `get_current_user` dependency to all endpoints - `src/basketball_api/routes/upload.py` — Add `get_current_user` dependency to photo upload - `tests/` — Update any tests that call these endpoints without auth mocking Files NOT to touch: - `src/basketball_api/routes/players.py` — Already requires auth (PR #90) - `src/basketball_api/routes/teams.py` — Already requires auth - `src/basketball_api/routes/roster.py` — Already requires admin/coach role - `src/basketball_api/auth.py` — Auth middleware already works ### Acceptance Criteria - [ ] `GET /api/roster/{tenant_slug}` returns 401 without auth token - [ ] `GET /api/roster/{tenant_slug}` returns roster data with valid auth token (any role) - [ ] `POST /api/roster/{tenant_slug}/check-in/{player_id}` returns 401 without auth - [ ] `POST /api/roster/{tenant_slug}/assign-number/{player_id}` returns 401 without auth - [ ] `POST /upload/photo` returns 401 without auth - [ ] All existing authenticated endpoints still work ### Test Expectations - [ ] Existing tests updated to provide auth where needed - [ ] New tests verify 401 on unauthenticated access - Run command: `cd ~/basketball-api && python -m pytest tests/ -v` ### Constraints - Use `get_current_user` from `auth.py` (not `require_role`) — any authenticated user can access these - Do NOT remove the check-in or assign-number endpoints — just add auth - Keep the roster response shape identical — only the auth requirement changes - The westside-app frontend calls these endpoints server-side with `event.locals.accessToken` — verify the frontend passes the token ### Checklist - [ ] PR opened - [ ] Tests pass - [ ] No unrelated changes ### Related - `project-westside-basketball` - PR #90 (player profile endpoints — already auth-gated, discovered this gap during QA review)

forgejo_admin commented

2026-03-16 01:23:36 +00:00

Owner

Lineage

plan-2026-03-08-tryout-prep → Phase 11 (discovered scope during 11a)

Repo

forgejo_admin/basketball-api

User Story

As an admin
I want all roster/player endpoints to require authentication
So that parent PII (email, phone) is not exposed to unauthenticated visitors now that tryouts are over and all users have Keycloak accounts

Context

During tryout day, the public roster endpoints were intentionally unauthenticated so parents could check the roster before having accounts. Tryouts are over. All 50 users have Keycloak accounts. There is no longer a reason to serve parent PII without auth.

The public tryout endpoints in routes/tryouts.py currently have NO authentication:

GET /api/roster/{tenant_slug} — returns full roster with parent name, email, phone
POST /api/roster/{tenant_slug}/check-in/{player_id} — marks player checked in
POST /api/roster/{tenant_slug}/assign-number/{player_id} — assigns tryout number

The check-in and assign-number endpoints are also obsolete (tryouts are over) but should still be locked down rather than removed, in case they're needed for future tryouts.

The photo upload endpoint (POST /upload/photo) is also unauthenticated — should require auth too.

File Targets

Files to modify:

src/basketball_api/routes/tryouts.py — Add get_current_user dependency to all endpoints
src/basketball_api/routes/upload.py — Add get_current_user dependency to photo upload
tests/ — Update any tests that call these endpoints without auth mocking

Files NOT to touch:

src/basketball_api/routes/players.py — Already requires auth (PR #90)
src/basketball_api/routes/teams.py — Already requires auth
src/basketball_api/routes/roster.py — Already requires admin/coach role
src/basketball_api/auth.py — Auth middleware already works

Acceptance Criteria

GET /api/roster/{tenant_slug} returns 401 without auth token
GET /api/roster/{tenant_slug} returns roster data with valid auth token (any role)
POST /api/roster/{tenant_slug}/check-in/{player_id} returns 401 without auth
POST /api/roster/{tenant_slug}/assign-number/{player_id} returns 401 without auth
POST /upload/photo returns 401 without auth
All existing authenticated endpoints still work

Test Expectations

Existing tests updated to provide auth where needed
New tests verify 401 on unauthenticated access
Run command: cd ~/basketball-api && python -m pytest tests/ -v

Constraints

Use get_current_user from auth.py (not require_role) — any authenticated user can access these
Do NOT remove the check-in or assign-number endpoints — just add auth
Keep the roster response shape identical — only the auth requirement changes
The westside-app frontend calls these endpoints server-side with event.locals.accessToken — verify the frontend passes the token