Viktor Barzin f781afe3fa api: drop bearer-token gate from /api/* CRUD + simulate ... The SPA can't carry a Bearer header — there's no client-side mechanism to obtain the RECOMPUTE_BEARER_TOKEN, and the value can't safely be embedded in the JS bundle. Result: every POST/PATCH/DELETE on scenarios/life-events/goals + every /simulate + /compare returned 401 in prod, breaking the SPA end-to-end. Strip require_bearer from the routers. Authentik forward-auth on the SPA path (/) is now the security boundary; /api/* is open at both ingress + app level. Single-tenant personal tool — the data is the user's own anonymous numeric projections. Kept on /recompute (heavy admin batch in app.py) since that's an operator action, not a user one. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>		2026-05-09 23:56:37 +00:00
..
__init__.py	api: expand FastAPI surface for scenarios, networth, life-events, goals, simulate	2026-05-09 21:48:36 +00:00
auth.py	api: expand FastAPI surface for scenarios, networth, life-events, goals, simulate	2026-05-09 21:48:36 +00:00
dependencies.py	api: expand FastAPI surface for scenarios, networth, life-events, goals, simulate	2026-05-09 21:48:36 +00:00
goals.py	api: drop bearer-token gate from /api/* CRUD + simulate	2026-05-09 23:56:37 +00:00
life_events.py	api: drop bearer-token gate from /api/* CRUD + simulate	2026-05-09 23:56:37 +00:00
networth.py	api: expand FastAPI surface for scenarios, networth, life-events, goals, simulate	2026-05-09 21:48:36 +00:00
scenarios.py	api: drop bearer-token gate from /api/* CRUD + simulate	2026-05-09 23:56:37 +00:00
schemas.py	engine+api: plumb life events into the simulator	2026-05-09 22:30:33 +00:00
simulate.py	api: drop bearer-token gate from /api/* CRUD + simulate	2026-05-09 23:56:37 +00:00