app.main

Application factory for the adriano backend.

The FastAPI application is always built through create_app(). Routers, middleware, and exception handlers are registered inside the factory; nothing is registered at import time outside of it.

The lifespan loads catalog.yaml and syncs source registrations (app.composition.start_catalog()). Startup never fails because of the configuration or the database: problems are logged and reported by /healthz. The one exception is the outbound TLS context (app.tls): create_app() builds it, so an unloadable ADRIANO_EXTRA_CA_CERTS entry stops every worker at startup instead of failing the first sign-in or poll.

Authentication: every /api/v1 route requires a bearer token (app.auth) – an OIDC/dev JWT, except candidate intake (/api/v1/candidates), which accepts only per-registration CI push tokens (app.auth.push); /healthz and the OpenAPI schema/docs (/openapi.json, /api/docs) are public – they expose no record data or secrets. The dev-only /auth/dev router is imported and mounted only when ADRIANO_DEV_AUTH_ENABLED is true and ADRIANO_DEV_SHARED_SECRET is set (see module-dev-auth-bypass).

When ADRIANO_STATIC_DIR is set, the same process also serves the built SPA, its /config.js and the security headers (app.web.mount_spa()), registered after every API router so the API keeps precedence.

app.main.create_app(settings=None)

Build and return the configured FastAPI application.

Parameters:

settings (Settings | None) – Settings deciding which routers are mounted (dev auth, SPA) and the reported version; defaults to app.config.get_settings(). Request-time settings still come from the get_settings dependency.

Return type:

FastAPI

Returns:

A fully configured FastAPI instance with routers and exception handlers registered.

Raises:

ConfigurationError – If static_dir is set but holds no index.html, or an extra CA path cannot be loaded.