feat: add get_current_user auth dependency and GET /api/jobs list endpoint

app/api/auth.py

@@ -2,7 +2,7 @@ from __future__ import annotations
 import hashlib
 import hmac
 import time
-from fastapi import APIRouter, HTTPException
+from fastapi import APIRouter, Header, HTTPException
 from pydantic import BaseModel
 
 router = APIRouter(prefix="/api/auth", tags=["auth"])
@@ -27,7 +27,35 @@ async def verify_token(req: VerifyRequest):
         raise HTTPException(status_code=401, detail="Invalid or expired token")
     return {"email": req.email, "verified": True}
 
-def _generate_token(email: str) -> str:
-    hour = int(time.time() // 3600)
+async def get_current_user(authorization: str = Header(default=None)) -> str:
+    """FastAPI dependency: extract and verify email from Authorization header.
+
+    Expected format: Bearer <email>:<token>
+    Returns the verified email address.
+    """
+    if not authorization:
+        raise HTTPException(status_code=401, detail="Authorization header missing")
+    parts = authorization.split(" ", 1)
+    if len(parts) != 2 or parts[0] != "Bearer":
+        raise HTTPException(status_code=401, detail="Invalid authorization format")
+    payload = parts[1]
+    if ":" not in payload:
+        raise HTTPException(status_code=401, detail="Invalid token format")
+    email, token = payload.split(":", 1)
+    # Verify against current and previous hour (handle clock edge)
+    for offset in (0, -1):
+        expected = _generate_token_for_hour(email, offset)
+        if hmac.compare_digest(token, expected):
+            return email
+    raise HTTPException(status_code=401, detail="Invalid or expired token")
+
+
+def _generate_token_for_hour(email: str, hour_offset: int = 0) -> str:
+    """Generate token for a specific hour offset (0 = current, -1 = previous)."""
+    hour = int(time.time() // 3600) + hour_offset
     payload = f"{email}:{hour}:{SECRET}"
     return hashlib.sha256(payload.encode()).hexdigest()[:32]
+
+
+def _generate_token(email: str) -> str:
+    return _generate_token_for_hour(email, 0)

app/api/jobs.py

@@ -1,4 +1,5 @@
-from fastapi import APIRouter, HTTPException
+from fastapi import APIRouter, Depends, HTTPException
+from app.api.auth import get_current_user
 from app.database import Database
 from app.models import JobRequest
 
@@ -11,6 +12,21 @@ def init_router(db: Database) -> None:
     _db = db
 
 
+@router.get("")
+async def list_jobs(email: str = Depends(get_current_user)):
+    jobs = await _db.get_jobs_by_email(email)
+    return [
+        {
+            "id": j.id,
+            "status": j.status.value,
+            "aoi_name": j.request.aoi.name,
+            "created_at": j.created_at.isoformat(),
+            "indicator_count": len(j.request.indicator_ids),
+        }
+        for j in jobs
+    ]
+
+
 @router.post("", status_code=201)
 async def submit_job(request: JobRequest):
     job_id = await _db.create_job(request)

tests/test_api_auth.py

@@ -0,0 +1,57 @@
+"""Tests for auth middleware — get_current_user dependency."""
+import time
+import hashlib
+import pytest
+from httpx import AsyncClient, ASGITransport
+from app.main import create_app
+
+
+def _make_token(email: str) -> str:
+    """Mirror the backend token generation for test fixtures."""
+    secret = "aperture-mvp-secret-change-in-production"
+    hour = int(time.time() // 3600)
+    payload = f"{email}:{hour}:{secret}"
+    return hashlib.sha256(payload.encode()).hexdigest()[:32]
+
+
+@pytest.fixture
+async def client(tmp_path):
+    app = create_app(db_path=str(tmp_path / "test.db"), run_worker=False)
+    transport = ASGITransport(app=app)
+    async with AsyncClient(transport=transport, base_url="http://test") as c:
+        yield c
+
+
+@pytest.mark.asyncio
+async def test_auth_header_valid(client):
+    email = "user@example.com"
+    token = _make_token(email)
+    resp = await client.get(
+        "/api/jobs",
+        headers={"Authorization": f"Bearer {email}:{token}"},
+    )
+    assert resp.status_code == 200
+
+
+@pytest.mark.asyncio
+async def test_auth_header_missing(client):
+    resp = await client.get("/api/jobs")
+    assert resp.status_code == 401
+
+
+@pytest.mark.asyncio
+async def test_auth_header_bad_token(client):
+    resp = await client.get(
+        "/api/jobs",
+        headers={"Authorization": "Bearer user@example.com:badtoken"},
+    )
+    assert resp.status_code == 401
+
+
+@pytest.mark.asyncio
+async def test_auth_header_malformed(client):
+    resp = await client.get(
+        "/api/jobs",
+        headers={"Authorization": "Bearer garbage"},
+    )
+    assert resp.status_code == 401