refactor(internal): switch auth to api-client headers

backend/app/api/internal.py

@@ -1,4 +1,4 @@
-from fastapi import APIRouter, Depends, Header, HTTPException, status
+from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.orm import Session
 
 from app.core.config import get_settings
@@ -8,24 +8,16 @@ from app.repositories.users_repo import UsersRepository
 from app.schemas.authentik_admin import AuthentikEnsureUserRequest, AuthentikEnsureUserResponse
 from app.schemas.permissions import PermissionSnapshotResponse
 from app.schemas.users import UserUpsertBySubRequest
+from app.security.api_client_auth import require_api_client
 from app.services.authentik_admin_service import AuthentikAdminService
 from app.services.permission_service import PermissionService
 
-router = APIRouter(prefix="/internal", tags=["internal"])
-
-
-def verify_internal_secret(x_internal_secret: str = Header(alias="X-Internal-Secret")) -> None:
-    settings = get_settings()
-    if not settings.internal_shared_secret:
-        raise HTTPException(status_code=status.HTTP_503_SERVICE_UNAVAILABLE, detail="internal_secret_not_configured")
-    if x_internal_secret != settings.internal_shared_secret:
-        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="invalid_internal_secret")
+router = APIRouter(prefix="/internal", tags=["internal"], dependencies=[Depends(require_api_client)])
 
 
 @router.post("/users/upsert-by-sub")
 def upsert_user_by_sub(
     payload: UserUpsertBySubRequest,
-    _: None = Depends(verify_internal_secret),
     db: Session = Depends(get_db),
 ) -> dict[str, str | bool | None]:
     repo = UsersRepository(db)
@@ -50,7 +42,6 @@ def upsert_user_by_sub(
 @router.get("/permissions/{authentik_sub}/snapshot", response_model=PermissionSnapshotResponse)
 def get_permission_snapshot(
     authentik_sub: str,
-    _: None = Depends(verify_internal_secret),
     db: Session = Depends(get_db),
 ) -> PermissionSnapshotResponse:
     users_repo = UsersRepository(db)
@@ -67,7 +58,6 @@ def get_permission_snapshot(
 @router.post("/authentik/users/ensure", response_model=AuthentikEnsureUserResponse)
 def ensure_authentik_user(
     payload: AuthentikEnsureUserRequest,
-    _: None = Depends(verify_internal_secret),
     db: Session = Depends(get_db),
 ) -> AuthentikEnsureUserResponse:
     settings = get_settings()