Add auth status detection to SPA

- Backend: GET /api/v2/auth/me returns authenticated, is_admin,
  is_grading_assistant for the current session
- Frontend: auth API client, Pinia auth store, hydrated on app mount

Author: Nils Bars

spa-frontend/src/App.vue

@@ -1,9 +1,11 @@
 <script setup lang="ts">
 import { onMounted, watchEffect } from 'vue';
 import DefaultLayout from './layouts/DefaultLayout.vue';
+import { useAuthStore } from './stores/auth';
 import { useNavStore } from './stores/nav';
 import { useTheme } from './theme/useTheme';
 
+const auth = useAuthStore();
 const nav = useNavStore();
 const theme = useTheme();
 
@@ -13,7 +15,7 @@ watchEffect(() => {
 
 onMounted(async () => {
   theme.init();
-  await nav.hydrate();
+  await Promise.all([auth.hydrate(), nav.hydrate()]);
 });
 </script>
 

spa-frontend/src/api/auth.ts

@@ -0,0 +1,11 @@
+import { apiGet } from './client';
+
+export interface AuthStatus {
+  authenticated: boolean;
+  is_admin: boolean;
+  is_grading_assistant: boolean;
+}
+
+export function getAuthStatus(): Promise<AuthStatus> {
+  return apiGet<AuthStatus>('/api/v2/auth/me');
+}

spa-frontend/src/stores/auth.ts

@@ -0,0 +1,32 @@
+import { defineStore } from 'pinia';
+import { getAuthStatus } from '../api/auth';
+
+interface State {
+  authenticated: boolean;
+  isAdmin: boolean;
+  isGradingAssistant: boolean;
+  hydrated: boolean;
+}
+
+export const useAuthStore = defineStore('auth', {
+  state: (): State => ({
+    authenticated: false,
+    isAdmin: false,
+    isGradingAssistant: false,
+    hydrated: false,
+  }),
+
+  actions: {
+    async hydrate() {
+      try {
+        const status = await getAuthStatus();
+        this.authenticated = status.authenticated;
+        this.isAdmin = status.is_admin;
+        this.isGradingAssistant = status.is_grading_assistant;
+      } catch {
+        // Leave defaults — not authenticated.
+      }
+      this.hydrated = true;
+    },
+  },
+});

webapp/ref/frontend_api/__init__.py

@@ -40,5 +40,6 @@ def spa_api_error(
 
 
 # Importing the submodules registers their routes on `refbp`.
+from . import auth  # noqa: E402,F401
 from . import scoreboard  # noqa: E402,F401
 from . import students  # noqa: E402,F401

webapp/ref/frontend_api/auth.py

@@ -0,0 +1,41 @@
+"""SPA endpoint for checking the current user's authentication status."""
+
+from flask_login import current_user
+
+from ref import limiter, refbp
+from ref.frontend_api import SPA_READ_LIMIT
+
+
+@refbp.route("/api/v2/auth/me", methods=("GET",))
+@limiter.limit(SPA_READ_LIMIT)
+def spa_api_auth_me():
+    """Return the authentication status of the current session.
+
+    Shape (authenticated):
+
+        {
+          "authenticated": true,
+          "is_admin": true,
+          "is_grading_assistant": false
+        }
+
+    Shape (not authenticated):
+
+        {
+          "authenticated": false,
+          "is_admin": false,
+          "is_grading_assistant": false
+        }
+    """
+    if current_user.is_authenticated:
+        return {
+            "authenticated": True,
+            "is_admin": current_user.is_admin,
+            "is_grading_assistant": current_user.is_grading_assistant,
+        }, 200
+
+    return {
+        "authenticated": False,
+        "is_admin": False,
+        "is_grading_assistant": False,
+    }, 200