feat: add limited visitor tokens

app/api/controllers/visitor_tokens.py

@@ -0,0 +1,14 @@
+from fastapi import APIRouter, status
+
+from app.api.schemas.visitor_tokens import VisitorTokenResponse
+from app.core.config import get_settings
+from app.core.security import VisitorTokenIssuer
+
+router = APIRouter(prefix="/api/v1/visitor-tokens", tags=["visitor-tokens"])
+
+
+@router.post("", response_model=VisitorTokenResponse, status_code=status.HTTP_201_CREATED)
+async def issue_visitor_token() -> VisitorTokenResponse:
+    settings = get_settings()
+    token, _expires_at = VisitorTokenIssuer(settings).issue()
+    return VisitorTokenResponse(access_token=token, expires_in=settings.visitor_token_ttl_seconds)

app/api/dependencies/auth.py

@@ -24,7 +24,8 @@ async def build_request_context(
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Unauthorized")
     try:
         context = _authenticator().authenticate(credentials.credentials)
-        context = await IdentityService().resolve(context)
+        if "visitor" not in context.roles:
+            context = await IdentityService().resolve(context)
     except Exception as exc:
         from app.core.errors import UnauthorizedAgentError
 

app/api/schemas/visitor_tokens.py

@@ -0,0 +1,9 @@
+from pydantic import BaseModel, ConfigDict, Field
+
+
+class VisitorTokenResponse(BaseModel):
+    model_config = ConfigDict(frozen=True)
+
+    access_token: str = Field(min_length=1)
+    token_type: str = "Bearer"
+    expires_in: int = Field(ge=60, le=3600)