HexaWetter v1.2.0: Security, Admin, Radar, UI

api/app/auth.py

@@ -66,6 +66,14 @@ def decode_access_token(token: str) -> dict[str, Any]:
     return jwt.decode(token, ADMIN_JWT_SECRET, algorithms=["HS256"])
 
 
+def _unauthorized(detail: str) -> HTTPException:
+    return HTTPException(
+        status_code=status.HTTP_401_UNAUTHORIZED,
+        detail=detail,
+        headers={"WWW-Authenticate": "Bearer"},
+    )
+
+
 async def require_admin(
     request: Request,
     credentials: HTTPAuthorizationCredentials | None = Depends(bearer_scheme),
@@ -73,13 +81,13 @@ async def require_admin(
     if not admin_configured():
         raise HTTPException(status_code=503, detail="Admin access is not configured")
     if credentials is None or credentials.scheme.lower() != "bearer":
-        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Missing bearer token")
+        raise _unauthorized("Missing bearer token")
     try:
         payload = decode_access_token(credentials.credentials)
     except JWTError as exc:
-        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid or expired token") from exc
+        raise _unauthorized("Invalid or expired token") from exc
     if payload.get("sub") != ADMIN_USERNAME or payload.get("scope") != "admin":
-        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid token scope")
+        raise _unauthorized("Invalid token scope")
     return payload