From f1ebe745c0867c8372240690067b837e320f05c0 Mon Sep 17 00:00:00 2001
From: Andrii Pasternak <andriipasternak31@gmail.com>
Date: Sat, 25 Apr 2026 22:57:29 +0100
Subject: [PATCH] fix(auth): require auth on /api/docs endpoints (#452)

Add Depends(get_current_user) to the three handlers in
src/backend/routers/docs.py so the file no longer violates
Architectural Invariant #8.

Note: this router is not currently registered in main.py, so
the endpoints are not reachable on the running API. The fix is
applied to the file as written so the invariant validator stops
flagging it and so the file is correct if it is ever remounted.

Closes #452
---
 src/backend/routers/docs.py | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/src/backend/routers/docs.py b/src/backend/routers/docs.py
index 44d75b21b..cd7019c70 100644
--- a/src/backend/routers/docs.py
+++ b/src/backend/routers/docs.py
@@ -6,11 +6,14 @@
 - Serving markdown content
 - Documentation index
 """
-from fastapi import APIRouter, HTTPException
+from fastapi import APIRouter, Depends, HTTPException
 from fastapi.responses import FileResponse, JSONResponse
 from pathlib import Path
 import json
 
+from models import User
+from dependencies import get_current_user
+
 router = APIRouter(prefix="/api/docs", tags=["Documentation"])
 
 # Documentation directory - relative to trinity root
@@ -31,7 +34,7 @@ def get_docs_dir() -> Path:
 
 
 @router.get("/index")
-async def get_docs_index():
+async def get_docs_index(current_user: User = Depends(get_current_user)):
     """Get documentation index/navigation structure."""
     docs_dir = get_docs_dir()
     if not docs_dir:
@@ -49,7 +52,10 @@ async def get_docs_index():
 
 
 @router.get("/content/{slug:path}")
-async def get_doc_content(slug: str):
+async def get_doc_content(
+    slug: str,
+    current_user: User = Depends(get_current_user),
+):
     """Get documentation content by slug (supports .md and .json files)."""
     docs_dir = get_docs_dir()
     if not docs_dir:
@@ -100,7 +106,7 @@ async def get_doc_content(slug: str):
 
 
 @router.get("/list")
-async def list_docs():
+async def list_docs(current_user: User = Depends(get_current_user)):
     """List all available documentation files."""
     docs_dir = get_docs_dir()
     if not docs_dir: