WIP checkpoint: Scaffold FastAPI backend project structure

backend/app/routers/worlds.py

@@ -8,23 +8,20 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import selectinload
 
 from app.database import get_db
+from app.dependencies import CurrentUser
 from app.models.world import World, WorldVisibility
 
 router = APIRouter()
 
-
-async def get_current_user():
-    """Placeholder dependency for current user auth."""
-    # TODO: Implement JWT auth dependency
-    return {"id": 1, "username": "testuser", "email": "test@example.com"}
+DbDep = Annotated[AsyncSession, Depends(get_db)]
 
 
 @router.get("/")
 async def list_worlds(
+    db: DbDep,
     skip: int = Query(0, ge=0),
     limit: int = Query(50, ge=1, le=100),
     visibility: WorldVisibility | None = None,
-    db: Annotated[AsyncSession, Depends(get_db)] = Depends(),
 ):
     """List worlds with optional visibility filter."""
     query = select(World).options(selectinload(World.owner))
@@ -49,7 +46,7 @@ async def list_worlds(
 @router.get("/{world_id}")
 async def get_world(
     world_id: int,
-    db: Annotated[AsyncSession, Depends(get_db)] = Depends(),
+    db: DbDep,
 ):
     """Get a single world by ID."""
     result = await db.execute(
@@ -71,8 +68,8 @@ async def get_world(
 @router.post("/")
 async def create_world(
     world_data: dict,
-    current_user=Depends(get_current_user),
-    db: Annotated[AsyncSession, Depends(get_db)] = Depends(),
+    current_user: CurrentUser,
+    db: DbDep,
 ):
     """Create a new world."""
     name = world_data.get("name")
@@ -82,7 +79,7 @@ async def create_world(
     world = World(
         name=name,
         description=world_data.get("description"),
-        owner_id=current_user["id"],
+        owner_id=current_user.id,
         visibility=WorldVisibility(
             world_data.get("visibility", "public")
         ),
@@ -105,8 +102,8 @@ async def create_world(
 async def update_world(
     world_id: int,
     world_data: dict,
-    current_user=Depends(get_current_user),
-    db: Annotated[AsyncSession, Depends(get_db)] = Depends(),
+    current_user: CurrentUser,
+    db: DbDep,
 ):
     """Update an existing world."""
     result = await db.execute(select(World).where(World.id == world_id))
@@ -114,6 +111,9 @@ async def update_world(
     if not world:
         raise HTTPException(status_code=404, detail="World not found")
 
+    if world.owner_id != current_user.id:
+        raise HTTPException(status_code=403, detail="Not owner of this world")
+
     if world_data.get("name"):
         world.name = world_data["name"]
     if world_data.get("description") is not None:
@@ -137,8 +137,8 @@ async def update_world(
 @router.delete("/{world_id}")
 async def delete_world(
     world_id: int,
-    current_user=Depends(get_current_user),
-    db: Annotated[AsyncSession, Depends(get_db)] = Depends(),
+    current_user: CurrentUser,
+    db: DbDep,
 ):
     """Delete a world."""
     result = await db.execute(select(World).where(World.id == world_id))
@@ -146,6 +146,9 @@ async def delete_world(
     if not world:
         raise HTTPException(status_code=404, detail="World not found")
 
+    if world.owner_id != current_user.id:
+        raise HTTPException(status_code=403, detail="Not owner of this world")
+
     await db.delete(world)
     await db.commit()
     return {"detail": "World deleted"}