First commit

src/routers/credentials.py

@@ -0,0 +1,40 @@
+from typing import Optional
+
+from fastapi import APIRouter, Depends
+from sqlalchemy.orm import Session
+
+from core.auth import encrypt_secret
+from core.database import ApiCredential, get_db
+from core.dependencies import require_admin
+from core.schemas import CredentialRead, CredentialUpsert
+
+router = APIRouter(prefix="/api/admin/credentials", tags=["admin-credentials"])
+
+
+@router.get("", response_model=list[CredentialRead])
+async def list_credentials(
+    db: Session = Depends(get_db), _: dict = Depends(require_admin)
+):
+    return [CredentialRead(id=c.id, username=c.username) for c in db.query(ApiCredential).all()]
+
+
+@router.put("", response_model=CredentialRead)
+async def upsert_credential(
+    req: CredentialUpsert,
+    db: Session = Depends(get_db),
+    _: dict = Depends(require_admin),
+):
+    cred: Optional[ApiCredential] = db.query(ApiCredential).first()
+    if cred:
+        cred.username = req.username
+        cred.password_enc = encrypt_secret(req.password)
+        cred.session_id = None  # invalidate any cached session
+    else:
+        cred = ApiCredential(
+            username=req.username,
+            password_enc=encrypt_secret(req.password),
+        )
+        db.add(cred)
+    db.commit()
+    db.refresh(cred)
+    return CredentialRead(id=cred.id, username=cred.username)