Phase 2: Docker and OIDC auth

backend/src/media_library_viewer_api/main.py

@@ -2,25 +2,41 @@
 
 from __future__ import annotations
 
+import logging
+import time
 from contextlib import asynccontextmanager
 
 import uvicorn
-from fastapi import FastAPI
+from fastapi import FastAPI, Request
 from fastapi.middleware.cors import CORSMiddleware
 
-from media_library_viewer_api.routers import dashboard, monitoring, media, files, jobs
+from media_library_viewer_api.auth import require_jwt_auth, validate_auth_settings
+from media_library_viewer_api.config import get_settings
+from media_library_viewer_api.logging_utils import configure_logging, describe_settings
+from media_library_viewer_api.routers import dashboard, monitoring, media, files, jobs, users
+from media_library_viewer_api.dependencies import get_mail_queue
+
+logger = logging.getLogger(__name__)
 
 
 @asynccontextmanager
 async def lifespan(app: FastAPI):
     """Application lifespan — startup/shutdown."""
+    settings = get_settings()
+    configure_logging(settings.log_level)
+    validate_auth_settings(settings)
+    logger.info("Backend startup complete: %s", describe_settings(settings))
+    mail_queue = get_mail_queue()
+    mail_queue.start()
     yield
+    mail_queue.stop()
+    logger.info("Backend shutdown complete")
 
 
 app = FastAPI(
     title="Media Library Viewer API",
     version="0.1.0",
-    description="Backend API for Jellyfin media browsing, SSH file inspection, and server monitoring.",
+    description="Backend API for Jellyfin media browsing, SSH file inspection, server monitoring, and JWT-protected access.",
     lifespan=lifespan,
 )
 
@@ -38,17 +54,45 @@ app.add_middleware(
     allow_headers=["*"],
 )
 
+@app.middleware("http")
+async def enforce_jwt_auth(request: Request, call_next):
+    return await require_jwt_auth(request, call_next)
+
+@app.middleware("http")
+async def log_requests(request: Request, call_next):
+    """Log every API request with timing and outcome."""
+    start = time.perf_counter()
+    client_host = request.client.host if request.client else "unknown"
+    logger.info("request start %s %s client=%s", request.method, request.url.path, client_host)
+    try:
+        response = await call_next(request)
+    except Exception:
+        logger.exception("request error %s %s client=%s", request.method, request.url.path, client_host)
+        raise
+    elapsed_ms = (time.perf_counter() - start) * 1000.0
+    logger.info(
+        "request end %s %s status=%s elapsed_ms=%.1f",
+        request.method,
+        request.url.path,
+        response.status_code,
+        elapsed_ms,
+    )
+    return response
+
+
 # Register routers
 app.include_router(dashboard.router)
 app.include_router(monitoring.router)
 app.include_router(media.router)
 app.include_router(files.router)
 app.include_router(jobs.router)
+app.include_router(users.router)
 
 
 @app.get("/api/health")
 def health_check() -> dict[str, str]:
     """Simple health check endpoint."""
+    logger.debug("health check requested")
     return {"status": "ok"}