cookie_person now mandatory

api/deps.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 from typing import Annotated, AsyncGenerator, Optional
 
 import aiosqlite
-from fastapi import Cookie, Depends, Request
+from fastapi import Cookie, Depends, Request, HTTPException
 from fastapi.responses import JSONResponse
 
 import db
@@ -38,12 +38,17 @@ async def get_db() -> AsyncGenerator[aiosqlite.Connection, None]:
 
 
 async def cookie_person(
-    user_id: Optional[int] = Cookie(None, alias="user_id"),
+    user_id: int = Cookie(..., alias="user_id"),
     conn: aiosqlite.Connection = Depends(get_db),
-) -> Optional[persons.Person]:
-    if user_id is None:
-        return None
-    return await persons.get_by_id(conn, user_id)
+) -> persons.Person:
+    """Return the authenticated user from the user_id cookie or raise 401.
+
+    All endpoints that depend on this require the cookie to be provided.
+    """
+    person = await persons.get_by_id(conn, user_id)
+    if not person:
+        raise HTTPException(status_code=401, detail="Unauthorized")
+    return person
 
 
 def error_response(request: Optional[Request], status_code: int, message: str) -> JSONResponse: