Admin mode. Data driven content sections. Bugfixes.

backend/app/api/events.py

@@ -4,9 +4,11 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.auth import get_current_admin_user
 from app.database import get_session
 from app.models import Event
 from app.schemas import EventCreate, EventUpdate, EventResponse
+from app.user_models import User
 
 router = APIRouter()
 
@@ -34,7 +36,9 @@ async def get_event(event_id: int, session: AsyncSession = Depends(get_session))
 
 @router.post("/", response_model=EventResponse, status_code=201)
 async def create_event(
-    payload: EventCreate, session: AsyncSession = Depends(get_session)
+    payload: EventCreate,
+    session: AsyncSession = Depends(get_session),
+    _: User = Depends(get_current_admin_user),
 ):
     event = Event(**payload.model_dump(), active=True)
     session.add(event)
@@ -48,6 +52,7 @@ async def update_event(
     event_id: int,
     payload: EventUpdate,
     session: AsyncSession = Depends(get_session),
+    _: User = Depends(get_current_admin_user),
 ):
     result = await session.execute(select(Event).where(Event.id == event_id))
     event = result.scalar_one_or_none()
@@ -61,7 +66,11 @@ async def update_event(
 
 
 @router.delete("/{event_id}", status_code=204)
-async def delete_event(event_id: int, session: AsyncSession = Depends(get_session)):
+async def delete_event(
+    event_id: int,
+    session: AsyncSession = Depends(get_session),
+    _: User = Depends(get_current_admin_user),
+):
     result = await session.execute(select(Event).where(Event.id == event_id))
     event = result.scalar_one_or_none()
     if not event: