- auth.py: JWT (python-jose) + bcrypt (passlib), get_current_user, require_admin - endpoints protégés via APIRouter(dependencies=[get_current_user]); /health public - /auth/login (rate-limit 5/min) + /auth/me - /admin/users CRUD + reset-password + /admin/journal (require_admin) - RGPD: /me/data-export (portabilité) + DELETE /me (oubli/anonymisation) - en-têtes de sécurité, CORS tous verbes + credentials - requirements: python-jose, passlib[bcrypt], bcrypt 4.0.1, python-multipart, slowapi
- config.py: connexion SQL via DB_* (driver 18, auth SQL), fallback Windows local - main.py: origines CORS via CORS_ORIGINS - Dockerfile (python 3.12 + msodbcsql18) + workflow Gitea Actions (build/push image)