Refactor UI assets and harden quality checks

karldns/routers/api.py

@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+from typing import Annotated
+
 from fastapi import APIRouter, Depends, HTTPException, Query, Request, Response, status
 from starlette.concurrency import run_in_threadpool
 
@@ -33,6 +35,12 @@ router = APIRouter(prefix="/api/v1")
 ADMIN_API_LIMIT_CAP = 500
 ADMIN_API_OFFSET_CAP = 10_000
 HOSTNAME_HISTORY_LIMIT_CAP = 100
+AdminAuthDep = Annotated[None, Depends(authenticate_admin)]
+HostnameHistoryLimitQuery = Annotated[int, Query(ge=0, le=HOSTNAME_HISTORY_LIMIT_CAP)]
+AdminLimitQuery = Annotated[int, Query(ge=1, le=ADMIN_API_LIMIT_CAP)]
+AdminOffsetQuery = Annotated[int, Query(ge=0, le=ADMIN_API_OFFSET_CAP)]
+AdminDashboardLimitQuery = Annotated[int, Query(ge=1, le=ADMIN_API_LIMIT_CAP)]
+AdminBeforeQuery = Annotated[str | None, Query(max_length=64)]
 
 
 @router.post(
@@ -52,7 +60,10 @@ async def create_hostname(service: ServiceDep) -> HostnameCreateResponse:
     "/hostnames/{dashboard_secret}",
     response_model=HostnameStatusResponse,
     summary="Read a hostname by private dashboard link",
-    description="Uses the private dashboard secret. Dashboard passwords protect only the web dashboard, not this API endpoint.",
+    description=(
+        "Uses the private dashboard secret. Dashboard passwords protect only the web dashboard, "
+        "not this API endpoint."
+    ),
     tags=["hostnames"],
     responses={404: {"model": ErrorResponse}},
 )
@@ -60,7 +71,7 @@ async def read_hostname(
     dashboard_secret: ManagementSlugPath,
     store: StoreDep,
     service: ServiceDep,
-    history_limit: int = Query(10, ge=0, le=HOSTNAME_HISTORY_LIMIT_CAP),
+    history_limit: HostnameHistoryLimitQuery = 10,
 ) -> HostnameStatusResponse:
     account = await run_in_threadpool(store.get_account_by_management_slug, dashboard_secret)
     if not account or account["disabled"]:
@@ -113,7 +124,10 @@ async def rotate_hostname_update_url(
     "/hostnames/{dashboard_secret}",
     status_code=status.HTTP_204_NO_CONTENT,
     summary="Delete a hostname by private dashboard link",
-    description="Uses the private dashboard secret. Dashboard passwords protect only the web dashboard, not this API endpoint.",
+    description=(
+        "Uses the private dashboard secret. Dashboard passwords protect only the web dashboard, "
+        "not this API endpoint."
+    ),
     tags=["hostnames"],
     responses={404: {"model": ErrorResponse}, 500: {"model": ErrorResponse}},
 )
@@ -140,8 +154,8 @@ async def delete_hostname(dashboard_secret: ManagementSlugPath, store: StoreDep,
 )
 async def read_admin(
     store: StoreDep,
-    _: None = Depends(authenticate_admin),
-    limit: int = Query(25, ge=1, le=ADMIN_API_LIMIT_CAP),
+    _: AdminAuthDep,
+    limit: AdminDashboardLimitQuery = 25,
 ) -> AdminDashboardResponse:
     metrics = await run_in_threadpool(store.get_service_metrics)
     accounts = await run_in_threadpool(store.list_accounts, limit, 0)
@@ -175,9 +189,9 @@ async def read_admin(
 )
 async def list_admin_hostnames(
     store: StoreDep,
-    _: None = Depends(authenticate_admin),
-    limit: int = Query(100, ge=1, le=ADMIN_API_LIMIT_CAP),
-    offset: int = Query(0, ge=0, le=ADMIN_API_OFFSET_CAP),
+    _: AdminAuthDep,
+    limit: AdminLimitQuery = 100,
+    offset: AdminOffsetQuery = 0,
 ) -> AdminHostnamesResponse:
     accounts = await run_in_threadpool(store.list_accounts, limit, offset)
     total = await run_in_threadpool(store.count_accounts)
@@ -200,10 +214,10 @@ async def list_admin_hostnames(
 )
 async def list_admin_events(
     store: StoreDep,
-    _: None = Depends(authenticate_admin),
-    limit: int = Query(100, ge=1, le=ADMIN_API_LIMIT_CAP),
-    offset: int = Query(0, ge=0, le=ADMIN_API_OFFSET_CAP),
-    before: str | None = Query(None, max_length=64),
+    _: AdminAuthDep,
+    limit: AdminLimitQuery = 100,
+    offset: AdminOffsetQuery = 0,
+    before: AdminBeforeQuery = None,
 ) -> AdminEventsResponse:
     items = (
         await run_in_threadpool(store.list_update_events_before, limit, before)
@@ -232,9 +246,9 @@ async def list_admin_events(
 )
 async def list_admin_records(
     store: StoreDep,
-    _: None = Depends(authenticate_admin),
-    limit: int = Query(100, ge=1, le=ADMIN_API_LIMIT_CAP),
-    offset: int = Query(0, ge=0, le=ADMIN_API_OFFSET_CAP),
+    _: AdminAuthDep,
+    limit: AdminLimitQuery = 100,
+    offset: AdminOffsetQuery = 0,
 ) -> AdminRecordsResponse:
     items = await run_in_threadpool(store.list_records_page, limit, offset)
     total = await run_in_threadpool(store.count_records)