Fix bugs, convert thumbnail to png, add context menu

backend/app/auth/dependencies.py

@@ -0,0 +1,35 @@
+"""FastAPI dependencies for authentication and security."""
+
+from fastapi import Request, HTTPException
+
+from app.auth.session import verify_session
+from app.config import settings
+
+def get_current_user(request: Request) -> int:
+    """
+    Dependency that extracts and validates the session cookie.
+    Raises 401 if missing or invalid.
+    Returns the user_id.
+    """
+    token = request.cookies.get(settings.COOKIE_NAME)
+    if not token:
+        raise HTTPException(status_code=401, detail="Not authenticated")
+    
+    user_id = verify_session(token)
+    if not user_id:
+        raise HTTPException(status_code=401, detail="Session expired or invalid")
+    
+    return user_id
+
+
+def verify_csrf(request: Request) -> None:
+    """
+    Dependency to mitigate CSRF for cookie-based auth.
+    Requires X-Requested-With header on all mutating requests.
+    """
+    if request.method in ["POST", "PUT", "PATCH", "DELETE"]:
+        if request.headers.get("X-Requested-With") != "XMLHttpRequest":
+            raise HTTPException(
+                status_code=403, 
+                detail="CSRF check failed: missing X-Requested-With header"
+            )