feat: add local admin authentication

app/auth/admin.py

@@ -0,0 +1,12 @@
+import hmac
+
+from fastapi import HTTPException, Request, status
+
+
+def password_matches(submitted: str, configured: str) -> bool:
+    return hmac.compare_digest(submitted.encode("utf-8"), configured.encode("utf-8"))
+
+
+def require_admin(request: Request) -> None:
+    if request.session.get("admin_authenticated") is not True:
+        raise HTTPException(status_code=status.HTTP_303_SEE_OTHER, headers={"Location": "/login"})

app/auth/csrf.py

@@ -0,0 +1,18 @@
+import hmac
+import secrets
+
+from fastapi import HTTPException, Request, status
+
+
+def ensure_csrf_token(request: Request) -> str:
+    token = request.session.get("csrf_token")
+    if not isinstance(token, str):
+        token = secrets.token_urlsafe(32)
+        request.session["csrf_token"] = token
+    return token
+
+
+def validate_csrf(request: Request, submitted_token: str) -> None:
+    expected = request.session.get("csrf_token")
+    if not isinstance(expected, str) or not hmac.compare_digest(expected, submitted_token):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Invalid CSRF token")