warp-server 0.2.0__tar.gz → 0.2.3__tar.gz

{warp_server-0.2.0 → warp_server-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: warp-server
-Version: 0.2.0
+Version: 0.2.3
 Summary: WARP signature server API
 Requires-Python: >=3.12
 Requires-Dist: aiosqlite>=0.20
@@ -145,6 +145,25 @@ Log in with your username and API key. The UI lets you:
 - Create API keys
 - Browse functions and commits
 
+## Configuration
+
+The server is configured via environment variables, all prefixed with `WARP_`.
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `WARP_DEBUG` | `false` | Enable debug mode: exposes Swagger UI at `/docs`. |
+| `WARP_DATABASE_URL` | `sqlite+aiosqlite:///./warp.db` | SQLAlchemy async database URL. |
+| `WARP_HOST` | `127.0.0.1` | Bind address. |
+| `WARP_PORT` | `8000` | Listen port. |
+| `WARP_LOG_LEVEL` | `info` | Uvicorn log level (`debug`, `info`, `warning`, `error`). |
+| `WARP_RELOAD` | `false` | Enable auto-reload on file changes (dev only). |
+| `WARP_CORS_ORIGINS` | `[]` | JSON list of allowed CORS origins, e.g. `'["https://app.example.com"]'`. |
+| `WARP_TRUSTED_PROXIES` | `[]` | JSON list of trusted reverse-proxy IPs allowed to set `X-Forwarded-For`. |
+| `WARP_MAX_LOGIN_ATTEMPTS` | `5` | Failed attempts before an IP or user account is locked. |
+| `WARP_LOCKOUT_DURATION_MINUTES` | `30` | Minutes before a locked IP or account is automatically unlocked. |
+
+> **Warning:** `WARP_DEBUG=true` exposes Swagger UI at `/docs` and ReDoc at `/redoc`. Never enable it in production.
+
 ## Docker
 
 ```bash

{warp_server-0.2.0 → warp_server-0.2.3}/README.md

@@ -129,6 +129,25 @@ Log in with your username and API key. The UI lets you:
 - Create API keys
 - Browse functions and commits
 
+## Configuration
+
+The server is configured via environment variables, all prefixed with `WARP_`.
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `WARP_DEBUG` | `false` | Enable debug mode: exposes Swagger UI at `/docs`. |
+| `WARP_DATABASE_URL` | `sqlite+aiosqlite:///./warp.db` | SQLAlchemy async database URL. |
+| `WARP_HOST` | `127.0.0.1` | Bind address. |
+| `WARP_PORT` | `8000` | Listen port. |
+| `WARP_LOG_LEVEL` | `info` | Uvicorn log level (`debug`, `info`, `warning`, `error`). |
+| `WARP_RELOAD` | `false` | Enable auto-reload on file changes (dev only). |
+| `WARP_CORS_ORIGINS` | `[]` | JSON list of allowed CORS origins, e.g. `'["https://app.example.com"]'`. |
+| `WARP_TRUSTED_PROXIES` | `[]` | JSON list of trusted reverse-proxy IPs allowed to set `X-Forwarded-For`. |
+| `WARP_MAX_LOGIN_ATTEMPTS` | `5` | Failed attempts before an IP or user account is locked. |
+| `WARP_LOCKOUT_DURATION_MINUTES` | `30` | Minutes before a locked IP or account is automatically unlocked. |
+
+> **Warning:** `WARP_DEBUG=true` exposes Swagger UI at `/docs` and ReDoc at `/redoc`. Never enable it in production.
+
 ## Docker
 
 ```bash

{warp_server-0.2.0 → warp_server-0.2.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "warp-server"
-version = "0.2.0"
+version = "0.2.3"
 description = "WARP signature server API"
 readme = "README.md"
 requires-python = ">=3.12"

{warp_server-0.2.0 → warp_server-0.2.3}/src/warp_server/auth.py

@@ -1,5 +1,5 @@
 import hashlib
-from datetime import datetime, timezone
+from datetime import datetime, timedelta, timezone
 
 from fastapi import Depends, HTTPException, Request, Security, status
 from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
@@ -19,11 +19,50 @@ def hash_api_key(raw_key: str) -> str:
 
 
 def _client_ip(request: Request) -> str:
-    """Extract client IP, respecting X-Forwarded-For behind a reverse proxy."""
-    forwarded = request.headers.get("x-forwarded-for")
-    if forwarded:
-        return forwarded.split(",")[0].strip()
-    return request.client.host if request.client else "unknown"
+    """Extract client IP. Only trust X-Forwarded-For from configured trusted proxies."""
+    direct_ip = request.client.host if request.client else "unknown"
+    if settings.trusted_proxies and direct_ip in settings.trusted_proxies:
+        forwarded = request.headers.get("x-forwarded-for")
+        if forwarded:
+            return forwarded.split(",")[0].strip()
+    return direct_ip
+
+
+def _is_locked(attempt: LoginAttempt) -> bool:
+    """Return True if the attempt record is still within the lockout window."""
+    if not attempt.locked:
+        return False
+    if attempt.locked_at is None:
+        return True
+    locked_at = attempt.locked_at
+    if locked_at.tzinfo is None:
+        locked_at = locked_at.replace(tzinfo=timezone.utc)
+    unlock_at = locked_at + timedelta(minutes=settings.lockout_duration_minutes)
+    if datetime.now(timezone.utc) >= unlock_at:
+        # Auto-unlock: lockout window has expired
+        attempt.locked = 0
+        attempt.failed_count = 0
+        attempt.locked_at = None
+        return False
+    return True
+
+
+def _is_user_locked(user: User) -> bool:
+    """Return True if the user account is still within the lockout window."""
+    if not user.locked:
+        return False
+    if user.locked_at is None:
+        return True
+    locked_at = user.locked_at
+    if locked_at.tzinfo is None:
+        locked_at = locked_at.replace(tzinfo=timezone.utc)
+    unlock_at = locked_at + timedelta(minutes=settings.lockout_duration_minutes)
+    if datetime.now(timezone.utc) >= unlock_at:
+        user.locked = 0
+        user.failed_login_count = 0
+        user.locked_at = None
+        return False
+    return True
 
 
 async def _get_attempt(db: AsyncSession, ip: str) -> LoginAttempt:
@@ -81,9 +120,9 @@ async def get_current_user(
 
     ip = _client_ip(request)
 
-    # Check if IP is locked
+    # Check if IP is locked (with auto-unlock)
     attempt = await _get_attempt(db, ip)
-    if attempt.locked:
+    if _is_locked(attempt):
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail="Too many failed attempts. IP locked.",
@@ -99,7 +138,6 @@ async def get_current_user(
             status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid API key"
         )
 
-    # Resolve user early so we can track per-user failures
     result = await db.execute(select(User).where(User.id == api_key.user_id))
     user = result.scalar_one_or_none()
     if user is None:
@@ -107,8 +145,8 @@ async def get_current_user(
             status_code=status.HTTP_401_UNAUTHORIZED, detail="User not found"
         )
 
-    # Check if user account is locked
-    if user.locked:
+    # Check if user account is locked (with auto-unlock)
+    if _is_user_locked(user):
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail="User account locked.",
@@ -124,7 +162,6 @@ async def get_current_user(
                 status_code=status.HTTP_401_UNAUTHORIZED, detail="API key expired"
             )
 
-    # Update last_used_at
     api_key.last_used_at = datetime.now(timezone.utc)
     await _record_success(db, ip, user)
     return user

{warp_server-0.2.0 → warp_server-0.2.3}/src/warp_server/cli.py

@@ -300,6 +300,101 @@ def source_list():
     _run(_list())
 
 
+@source.command("add-user")
+@click.option("--source", "source_name", required=True, help="Source name or UUID.")
+@click.option("--user-id", required=True, type=int, help="User ID to add.")
+def source_add_user(source_name, user_id):
+    """Add a user to a source (grants push access)."""
+
+    async def _add():
+        from uuid import UUID as _UUID
+
+        await _ensure_tables()
+        async with async_session() as db:
+            # Resolve source
+            try:
+                source_uuid = _UUID(source_name)
+                result = await db.execute(
+                    select(Source).where(Source.id == source_uuid)
+                )
+            except ValueError:
+                result = await db.execute(
+                    select(Source).where(Source.name == source_name)
+                )
+            src = result.scalar_one_or_none()
+            if src is None:
+                click.echo(f"Source '{source_name}' not found.", err=True)
+                raise SystemExit(1)
+
+            # Check user exists
+            result = await db.execute(select(User).where(User.id == user_id))
+            if result.scalar_one_or_none() is None:
+                click.echo(f"User {user_id} not found.", err=True)
+                raise SystemExit(1)
+
+            # Check not already a member
+            result = await db.execute(
+                select(SourceUser).where(
+                    SourceUser.source_id == src.id, SourceUser.user_id == user_id
+                )
+            )
+            if result.scalar_one_or_none() is not None:
+                click.echo(
+                    f"User {user_id} is already a member of source '{src.name}'."
+                )
+                return
+
+            db.add(SourceUser(source_id=src.id, user_id=user_id))
+            await db.commit()
+            click.echo(f"Added user {user_id} to source '{src.name}' ({src.id}).")
+
+    _run(_add())
+
+
+@source.command("remove-user")
+@click.option("--source", "source_name", required=True, help="Source name or UUID.")
+@click.option("--user-id", required=True, type=int, help="User ID to remove.")
+def source_remove_user(source_name, user_id):
+    """Remove a user from a source (revokes push access)."""
+
+    async def _remove():
+        from uuid import UUID as _UUID
+
+        await _ensure_tables()
+        async with async_session() as db:
+            try:
+                source_uuid = _UUID(source_name)
+                result = await db.execute(
+                    select(Source).where(Source.id == source_uuid)
+                )
+            except ValueError:
+                result = await db.execute(
+                    select(Source).where(Source.name == source_name)
+                )
+            src = result.scalar_one_or_none()
+            if src is None:
+                click.echo(f"Source '{source_name}' not found.", err=True)
+                raise SystemExit(1)
+
+            result = await db.execute(
+                select(SourceUser).where(
+                    SourceUser.source_id == src.id, SourceUser.user_id == user_id
+                )
+            )
+            su = result.scalar_one_or_none()
+            if su is None:
+                click.echo(
+                    f"User {user_id} is not a member of source '{src.name}'.", err=True
+                )
+                raise SystemExit(1)
+
+            await db.delete(su)
+            await db.commit()
+            click.echo(f"Removed user {user_id} from source '{src.name}'.")
+
+    _run(_remove())
+
+
 # ── Quick bootstrap ──────────────────────────────────────────────────
 
 

{warp_server-0.2.0 → warp_server-0.2.3}/src/warp_server/config.py

@@ -3,13 +3,16 @@ from pydantic_settings import BaseSettings
 
 class Settings(BaseSettings):
     database_url: str = "sqlite+aiosqlite:///./warp.db"
-    secret_key: str = "change-me-in-production"
     host: str = "127.0.0.1"
     port: int = 8000
     log_level: str = "info"
     cors_origins: list[str] = []
     max_login_attempts: int = 5
+    lockout_duration_minutes: int = 30
     reload: bool = False
+    debug: bool = False
+    # IPs of trusted reverse proxies allowed to set X-Forwarded-For
+    trusted_proxies: list[str] = []
 
     model_config = {"env_prefix": "WARP_"}
 

{warp_server-0.2.0 → warp_server-0.2.3}/src/warp_server/main.py

@@ -37,7 +37,14 @@ async def lifespan(app: FastAPI):
     await engine.dispose()
 
 
-app = FastAPI(title="warp-server", version="0.1.0", lifespan=lifespan)
+app = FastAPI(
+    title="warp-server",
+    version="0.1.0",
+    lifespan=lifespan,
+    docs_url="/docs" if settings.debug else None,
+    redoc_url="/redoc" if settings.debug else None,
+    openapi_url="/openapi.json" if settings.debug else None,
+)
 
 
 @app.middleware("http")
@@ -55,16 +62,6 @@ async def log_request_duration(request: Request, call_next):
     return response
 
 
-@asynccontextmanager
-async def lifespan(app: FastAPI):
-    async with engine.begin() as conn:
-        await conn.run_sync(Base.metadata.create_all)
-    yield
-    await engine.dispose()
-
-
-app = FastAPI(title="warp-server", version="0.1.0", lifespan=lifespan)
-
 app.include_router(status.router)
 app.include_router(auth.router)
 app.include_router(users.router)
@@ -83,8 +80,8 @@ _static_dir = Path(__file__).parent / "static"
 app.add_middleware(
     CORSMiddleware,
     allow_origins=settings.cors_origins,
-    allow_methods=["*"],
-    allow_headers=["*"],
+    allow_methods=["GET", "POST", "DELETE", "PATCH", "PUT"],
+    allow_headers=["Authorization", "Content-Type"],
 )
 
 if _static_dir.is_dir():

{warp_server-0.2.0 → warp_server-0.2.3}/src/warp_server/routers/commits.py

@@ -24,7 +24,11 @@ def _commit_mdl(c: Commit) -> CommitMdl:
 
 
 @router.post("/query", response_model=PaginatedResponse[CommitMdl])
-async def query_commits(body: CommitQueryRequest, db: AsyncSession = Depends(get_db)):
+async def query_commits(
+    body: CommitQueryRequest,
+    db: AsyncSession = Depends(get_db),
+    user: User = Depends(get_current_user),
+):
     query = select(Commit)
     if body.source_id:
         query = query.where(Commit.source_id == body.source_id)
@@ -45,7 +49,11 @@ async def query_commits(body: CommitQueryRequest, db: AsyncSession = Depends(get
 
 
 @router.get("/{commit_id}", response_model=CommitMdl)
-async def get_commit(commit_id: int, db: AsyncSession = Depends(get_db)):
+async def get_commit(
+    commit_id: int,
+    db: AsyncSession = Depends(get_db),
+    user: User = Depends(get_current_user),
+):
     result = await db.execute(select(Commit).where(Commit.id == commit_id))
     commit = result.scalar_one_or_none()
     if commit is None:
@@ -64,7 +72,6 @@ async def delete_commit(
     if commit is None:
         raise HTTPException(status_code=404, detail="Commit not found")
 
-    # Must be admin or in source users
     if user.role != "Admin":
         su = await db.execute(
             select(SourceUser).where(
@@ -73,7 +80,7 @@ async def delete_commit(
             )
         )
         if su.scalar_one_or_none() is None:
-            raise HTTPException(status_code=401, detail="Not authorized")
+            raise HTTPException(status_code=403, detail="Not authorized")
 
     await db.delete(commit)
     await db.commit()

{warp_server-0.2.0 → warp_server-0.2.3}/src/warp_server/routers/functions.py

@@ -1,9 +1,10 @@
 from collections import defaultdict
 
-from fastapi import APIRouter, Depends, HTTPException, Response
+from fastapi import APIRouter, Body, Depends, HTTPException, Response
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from warp_server.auth import get_current_user
 from warp_server.database import get_db
 from warp_server.models import (
     Function,
@@ -11,6 +12,7 @@ from warp_server.models import (
     FunctionConstraint,
     SourceTag,
     Symbol,
+    User,
 )
 from warp_server.models import Type as TypeModel
 from warp_server.schemas import (
@@ -64,7 +66,9 @@ def _build_function_query(body: FunctionQueryRequest):
 
 @router.post("/query")
 async def query_functions(
-    body: FunctionQueryRequest, db: AsyncSession = Depends(get_db)
+    body: FunctionQueryRequest,
+    db: AsyncSession = Depends(get_db),
+    user: User = Depends(get_current_user),
 ):
     query = _build_function_query(body)
 
@@ -92,9 +96,11 @@ async def query_functions(
 
 @router.post("/query/source")
 async def query_functions_source(
-    body: FunctionQueryRequest, db: AsyncSession = Depends(get_db)
+    body: FunctionQueryRequest | None = Body(default=None),
+    db: AsyncSession = Depends(get_db),
+    user: User = Depends(get_current_user),
 ):
-    query = _build_function_query(body)
+    query = _build_function_query(body or FunctionQueryRequest())
     results = await db.execute(query)
     funcs = results.scalars().all()
     mapping: dict[str, list[str]] = defaultdict(list)
@@ -104,7 +110,11 @@ async def query_functions_source(
 
 
 @router.post("/data")
-async def get_function_datas(body: DataIdsRequest, db: AsyncSession = Depends(get_db)):
+async def get_function_datas(
+    body: DataIdsRequest,
+    db: AsyncSession = Depends(get_db),
+    user: User = Depends(get_current_user),
+):
     if not body.ids:
         return Response(content=b"", media_type="application/octet-stream")
     results = await db.execute(select(Function).where(Function.id.in_(body.ids)))
@@ -115,7 +125,11 @@ async def get_function_datas(body: DataIdsRequest, db: AsyncSession = Depends(ge
 
 
 @router.get("/{function_id}", response_model=FunctionMdl)
-async def get_function_by_id(function_id: int, db: AsyncSession = Depends(get_db)):
+async def get_function_by_id(
+    function_id: int,
+    db: AsyncSession = Depends(get_db),
+    user: User = Depends(get_current_user),
+):
     result = await db.execute(select(Function).where(Function.id == function_id))
     f = result.scalar_one_or_none()
     if f is None:
@@ -124,7 +138,11 @@ async def get_function_by_id(function_id: int, db: AsyncSession = Depends(get_db
 
 
 @router.get("/{function_id}/comments", response_model=list[FunctionCommentMdl])
-async def get_function_comments(function_id: int, db: AsyncSession = Depends(get_db)):
+async def get_function_comments(
+    function_id: int,
+    db: AsyncSession = Depends(get_db),
+    user: User = Depends(get_current_user),
+):
     result = await db.execute(
         select(FunctionComment).where(FunctionComment.function_id == function_id)
     )
@@ -138,7 +156,9 @@ async def get_function_comments(function_id: int, db: AsyncSession = Depends(get
 
 @router.get("/{function_id}/constraints", response_model=list[FunctionConstraintMdl])
 async def get_function_constraints(
-    function_id: int, db: AsyncSession = Depends(get_db)
+    function_id: int,
+    db: AsyncSession = Depends(get_db),
+    user: User = Depends(get_current_user),
 ):
     result = await db.execute(
         select(FunctionConstraint).where(FunctionConstraint.function_id == function_id)
@@ -152,7 +172,11 @@ async def get_function_constraints(
 
 
 @router.get("/{function_id}/data")
-async def get_function_data(function_id: int, db: AsyncSession = Depends(get_db)):
+async def get_function_data(
+    function_id: int,
+    db: AsyncSession = Depends(get_db),
+    user: User = Depends(get_current_user),
+):
     result = await db.execute(select(Function).where(Function.id == function_id))
     f = result.scalar_one_or_none()
     if f is None:
@@ -161,7 +185,11 @@ async def get_function_data(function_id: int, db: AsyncSession = Depends(get_db)
 
 
 @router.get("/{function_id}/symbol", response_model=SymbolMdl)
-async def get_function_symbol(function_id: int, db: AsyncSession = Depends(get_db)):
+async def get_function_symbol(
+    function_id: int,
+    db: AsyncSession = Depends(get_db),
+    user: User = Depends(get_current_user),
+):
     result = await db.execute(select(Function).where(Function.id == function_id))
     f = result.scalar_one_or_none()
     if f is None:
@@ -180,7 +208,11 @@ async def get_function_symbol(function_id: int, db: AsyncSession = Depends(get_d
 
 
 @router.get("/{function_id}/type", response_model=TypeMdl)
-async def get_function_type(function_id: int, db: AsyncSession = Depends(get_db)):
+async def get_function_type(
+    function_id: int,
+    db: AsyncSession = Depends(get_db),
+    user: User = Depends(get_current_user),
+):
     result = await db.execute(select(Function).where(Function.id == function_id))
     f = result.scalar_one_or_none()
     if f is None:

{warp_server-0.2.0 → warp_server-0.2.3}/src/warp_server/routers/search.py

@@ -4,10 +4,12 @@ from fastapi import APIRouter, Depends
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from warp_server.auth import get_current_user
 from warp_server.database import get_db
 from warp_server.models import Function, Source, Type
 from warp_server.models import Symbol
 from warp_server.schemas import SearchIndexRow, SearchResponse
+from warp_server.models import User
 
 router = APIRouter(prefix="/api/v1/search", tags=["search"])
 
@@ -15,6 +17,10 @@ DEFAULT_LIMIT = 20
 MAX_LIMIT = 100
 
 
+def _escape_like(s: str) -> str:
+    return s.replace("\\", "\\\\").replace("%", "\\%").replace("_", "\\_")
+
+
 @router.get("", response_model=SearchResponse)
 async def search_handler(
     q: str | None = None,
@@ -27,6 +33,7 @@ async def search_handler(
     source_tags: list[str] | None = None,
     retrieve_data: bool | None = None,
     db: AsyncSession = Depends(get_db),
+    user: User = Depends(get_current_user),
 ):
     actual_limit = min(limit or DEFAULT_LIMIT, MAX_LIMIT)
     actual_offset = offset or 0
@@ -34,14 +41,15 @@ async def search_handler(
     items: list[SearchIndexRow] = []
     total = 0
 
-    # Search across sources, functions, and types based on kind filter
     kinds_to_search = [kind] if kind else ["source", "function", "type"]
 
     for k in kinds_to_search:
         if k == "source":
             query = select(Source)
             if q:
-                query = query.where(Source.name.ilike(f"%{q}%"))
+                query = query.where(
+                    Source.name.ilike(f"%{_escape_like(q)}%", escape="\\")
+                )
             if source_id:
                 query = query.where(Source.id == source_id)
 
@@ -69,9 +77,8 @@ async def search_handler(
             if source_id:
                 query = query.where(Function.source_id == source_id)
             if q:
-                # Join with symbol to search by name
                 query = query.join(Symbol, Symbol.id == Function.symbol_id).where(
-                    Symbol.name.ilike(f"%{q}%")
+                    Symbol.name.ilike(f"%{_escape_like(q)}%", escape="\\")
                 )
 
             count = await db.scalar(select(func.count()).select_from(query.subquery()))
@@ -96,7 +103,9 @@ async def search_handler(
             if source_id:
                 query = query.where(Type.source_id == source_id)
             if q:
-                query = query.where(Type.name.ilike(f"%{q}%"))
+                query = query.where(
+                    Type.name.ilike(f"%{_escape_like(q)}%", escape="\\")
+                )
 
             count = await db.scalar(select(func.count()).select_from(query.subquery()))
             total += count

{warp_server-0.2.0 → warp_server-0.2.3}/src/warp_server/routers/sources.py

@@ -22,6 +22,10 @@ router = APIRouter(prefix="/api/v1/sources", tags=["sources"])
 DEFAULT_LIMIT = 20
 
 
+def _escape_like(s: str) -> str:
+    return s.replace("\\", "\\\\").replace("%", "\\%").replace("_", "\\_")
+
+
 def _source_mdl(s: Source) -> SourceMdl:
     return SourceMdl(id=s.id, created_at=s.created_at, name=s.name)
 
@@ -36,7 +40,6 @@ async def create_source(
     db.add(source)
     await db.flush()
 
-    # Add requesting user if not in the list
     user_ids = set(body.user_ids)
     user_ids.add(user.id)
     for uid in user_ids:
@@ -50,13 +53,19 @@ async def create_source(
 
 
 @router.post("/query", response_model=PaginatedResponse[SourceMdl])
-async def query_sources(body: SourceQueryRequest, db: AsyncSession = Depends(get_db)):
+async def query_sources(
+    body: SourceQueryRequest,
+    db: AsyncSession = Depends(get_db),
+    user: User = Depends(get_current_user),
+):
     query = select(Source)
     if body.name:
         if body.exact:
             query = query.where(Source.name == body.name)
         else:
-            query = query.where(Source.name.ilike(f"%{body.name}%"))
+            query = query.where(
+                Source.name.ilike(f"%{_escape_like(body.name)}%", escape="\\")
+            )
     if body.user_id is not None:
         query = query.join(SourceUser).where(SourceUser.user_id == body.user_id)
 
@@ -76,7 +85,11 @@ async def query_sources(body: SourceQueryRequest, db: AsyncSession = Depends(get
 
 
 @router.get("/{source_id}", response_model=SourceMdl)
-async def get_source_by_id(source_id: UUID, db: AsyncSession = Depends(get_db)):
+async def get_source_by_id(
+    source_id: UUID,
+    db: AsyncSession = Depends(get_db),
+    user: User = Depends(get_current_user),
+):
     result = await db.execute(select(Source).where(Source.id == source_id))
     source = result.scalar_one_or_none()
     if source is None:
@@ -98,7 +111,7 @@ async def _check_source_access(db: AsyncSession, source_id: UUID, user: User) ->
     )
     if su.scalar_one_or_none() is None:
         raise HTTPException(
-            status_code=status.HTTP_401_UNAUTHORIZED, detail="Not authorized"
+            status_code=status.HTTP_403_FORBIDDEN, detail="Not authorized"
         )
     return source
 
@@ -123,7 +136,6 @@ async def update_source(
             db.add(SourceUser(source_id=source_id, user_id=uid))
 
     if body.tags is not None:
-        # Only admins can set tags.
         if user.role != "Admin":
             raise HTTPException(status_code=403, detail="Only admins can set tags")
         await db.execute(
@@ -148,7 +160,11 @@ async def delete_source(
 
 
 @router.get("/{source_id}/tags", response_model=list[SourceTagMdl])
-async def list_source_tags(source_id: UUID, db: AsyncSession = Depends(get_db)):
+async def list_source_tags(
+    source_id: UUID,
+    db: AsyncSession = Depends(get_db),
+    user: User = Depends(get_current_user),
+):
     result = await db.execute(select(SourceTag).where(SourceTag.source_id == source_id))
     return [
         SourceTagMdl(source_id=t.source_id, tag=t.tag) for t in result.scalars().all()
@@ -156,7 +172,11 @@ async def list_source_tags(source_id: UUID, db: AsyncSession = Depends(get_db)):
 
 
 @router.get("/{source_id}/users", response_model=list[SourceUserMdl])
-async def list_source_users(source_id: UUID, db: AsyncSession = Depends(get_db)):
+async def list_source_users(
+    source_id: UUID,
+    db: AsyncSession = Depends(get_db),
+    user: User = Depends(get_current_user),
+):
     result = await db.execute(
         select(SourceUser).where(SourceUser.source_id == source_id)
     )