# Task 3.1 Apply Report: Extract Shared Auth Dependencies

**Status:** Success

**Files Created (1):**
- `apps/api/src/auth/dependencies.py` — Added `get_owned_project()` dependency function

**Files Modified (7):**
- `apps/api/src/api/tool_instances.py` — Removed `_get_user` and `_get_owned_project` definitions; replaced with `get_current_user` and `get_owned_project` FastAPI dependencies
- `apps/api/src/api/git_repositories.py` — Same refactoring
- `apps/api/src/api/projects.py` — Same refactoring
- `apps/api/src/api/ssh_keys.py` — Removed `_get_user`; replaced with `get_current_user` dependency
- `apps/api/src/api/users.py` — Same as ssh_keys.py
- `apps/api/src/api/user_config.py` — Same as ssh_keys.py
- `apps/api/src/api/tool_types.py` — Same as ssh_keys.py

**Files NOT Modified (intentionally):**
- `api/config_profiles.py` — Has `_get_owned_profile` (domain-specific, not a generic auth dependency)
- `api/tool_configs.py` — No inline auth helpers to extract
- `api/config_folders.py` — No inline auth helpers to extract
- `api/terminal.py` — No inline auth helpers to extract; `_get_user_from_websocket` is websocket-specific

**Files Deleted:** None

**Quality Gate Results:**
- Python syntax check (`py_compile`) for all modified files: **PASS**
- `grep -rn "def _get_user" apps/api/src/api/`: **PASS** — Only `terminal.py` has `_get_user_from_websocket` (websocket-specific, not the duplicated helper)
- `grep -rn "def _get_owned_project" apps/api/src/api/`: **PASS** — Zero results
- `pytest`: Not available in environment (system Python, no venv), but all files compile cleanly

**Blockers/Deviations:**
- None. All duplicated auth helpers successfully extracted to `auth/dependencies.py`.
- The `_get_user_from_websocket` in `terminal.py` was intentionally left untouched as it serves a different purpose (WebSocket cookie parsing vs. HTTP dependency injection).

**Notes:**
- `get_current_user` already existed in `auth/dependencies.py`; it was leveraged directly
- `get_owned_project` was newly added as a FastAPI dependency that injects `Project` after verifying ownership
- All route handlers now use proper FastAPI dependency injection instead of inline async calls
- Variable naming changed from `user_id` (UUID) to `user` (User model) in route handlers, with `user.id` used where the UUID is needed