Create admin.py

src/api/admin.py

@@ -0,0 +1,50 @@
+from fastapi import APIRouter, HTTPException, Request, Response
+from pydantic import BaseModel
+import secrets
+import time
+
+router = APIRouter()
+
+class LoginRequest(BaseModel):
+    password: str
+
+class ConfigUpdate(BaseModel):
+    key: str
+    value: str
+
+# Simple session storage (in-memory for HF single instance)
+admin_sessions = {}
+
+@router.post("/auth")
+async def admin_auth(req: LoginRequest):
+    from src.config import get_settings
+    settings = get_settings()
+    
+    if req.password != settings.admin_password:
+        raise HTTPException(status_code=401, detail="Invalid password")
+    
+    token = secrets.token_hex(32)
+    admin_sessions[token] = time.time() + 86400  # 24 hours
+    
+    resp = Response(content='{"status": "ok"}')
+    resp.set_cookie(key="admin_session", value=token, httponly=True, max_age=86400)
+    return resp
+
+@router.get("/config")
+async def get_config():
+    from src.config import get_settings
+    settings = get_settings()
+    return {
+        "max_results": settings.max_results,
+        "maintenance_mode": settings.maintenance_mode
+    }
+
+@router.post("/config")
+async def update_config(req: ConfigUpdate, request: Request):
+    # Verify session
+    token = request.cookies.get("admin_session")
+    if not token or token not in admin_sessions:
+        raise HTTPException(status_code=401, detail="Not authenticated")
+    
+    # In real implementation, update DB or env
+    return {"status": "ok", "updated": req.key}