Restructure admin app separate of user api.

passkey/fastapi/mainapp.py

@@ -1,4 +1,3 @@
-import contextlib
 import logging
 import os
 from contextlib import asynccontextmanager
@@ -8,8 +7,7 @@ from fastapi import Cookie, FastAPI, HTTPException, Query, Request, Response
 from fastapi.responses import FileResponse, JSONResponse
 from fastapi.staticfiles import StaticFiles
 
-from ..authsession import get_session
-from . import authz, ws
+from . import admin, authz, ws
 from .api import register_api_routes
 from .reset import register_reset_routes
 
@@ -51,6 +49,8 @@ async def lifespan(app: FastAPI):  # pragma: no cover - startup path
 
 
 app = FastAPI(lifespan=lifespan)
+app.mount("/auth/ws", ws.app)
+app.mount("/auth/admin", admin.app)
 
 
 # Global exception handlers
@@ -67,10 +67,6 @@ async def general_exception_handler(request: Request, exc: Exception):
     return JSONResponse(status_code=500, content={"detail": "Internal server error"})
 
 
-# Mount the WebSocket subapp
-app.mount("/auth/ws", ws.app)
-
-
 @app.get("/auth/forward-auth")
 async def forward_authentication(request: Request, perm=Query(None), auth=Cookie(None)):
     """A validation endpoint to use with Caddy forward_auth or Nginx auth_request.
@@ -104,27 +100,6 @@ async def redirect_to_index():
     return FileResponse(STATIC_DIR / "index.html")
 
 
-@app.get("/auth/admin")
-async def serve_admin(auth=Cookie(None)):
-    """Serve the admin app entry point if an authenticated session exists.
-
-    If no valid authenticated session cookie is present, return a 401 with the
-    main app's index.html so the frontend can initiate login/registration flow.
-    """
-    if auth:
-        with contextlib.suppress(ValueError):
-            s = await get_session(auth)
-            if s.info and s.info.get("type") == "authenticated":
-                return FileResponse(STATIC_DIR / "admin" / "index.html")
-
-    # Not authenticated: serve main index with 401
-    return FileResponse(
-        STATIC_DIR / "index.html",
-        status_code=401,
-        headers={"WWW-Authenticate": "Bearer"},
-    )
-
-
 # Register API routes
 register_api_routes(app)
 register_reset_routes(app)