MultiDirectoryLab · rimu-stack · Feb 6, 2026 · Jan 27, 2026 · Jan 27, 2026 · Jan 27, 2026
diff --git a/app/api/audit/router.py b/app/api/audit/router.py
@@ -15,6 +15,7 @@
     DishkaErrorAwareRoute,
     DomainErrorTranslator,
 )
+from api.utils import require_master_db
 from enums import DomainCodes
 from ldap_protocol.policies.audit.exception import (
     AuditAlreadyExistsError,
@@ -59,7 +60,11 @@ async def get_audit_policies(
     return await audit_adapter.get_policies()
 
 
-@audit_router.put("/policy/{policy_id}", error_map=error_map)
+@audit_router.put(
+    "/policy/{policy_id}",
+    error_map=error_map,
+    dependencies=[Depends(require_master_db)],
+)
 async def update_audit_policy(
     policy_id: int,
     policy_data: AuditPolicySchemaRequest,
@@ -81,6 +86,7 @@ async def get_audit_destinations(
     "/destination",
     status_code=status.HTTP_201_CREATED,
     error_map=error_map,
+    dependencies=[Depends(require_master_db)],
 )
 async def create_audit_destination(
     destination_data: AuditDestinationSchemaRequest,
@@ -90,7 +96,11 @@ async def create_audit_destination(
     return await audit_adapter.create_destination(destination_data)
 
 
-@audit_router.delete("/destination/{destination_id}", error_map=error_map)
+@audit_router.delete(
+    "/destination/{destination_id}",
+    error_map=error_map,
+    dependencies=[Depends(require_master_db)],
+)
 async def delete_audit_destination(
     destination_id: int,
     audit_adapter: FromDishka[AuditPoliciesAdapter],
@@ -99,7 +109,11 @@ async def delete_audit_destination(
     await audit_adapter.delete_destination(destination_id)
 
 
-@audit_router.put("/destination/{destination_id}", error_map=error_map)
+@audit_router.put(
+    "/destination/{destination_id}",
+    error_map=error_map,
+    dependencies=[Depends(require_master_db)],
+)
 async def update_audit_destination(
     destination_id: int,
     destination_data: AuditDestinationSchemaRequest,

diff --git a/app/api/auth/router_auth.py b/app/api/auth/router_auth.py
@@ -19,6 +19,7 @@
     DishkaErrorAwareRoute,
     DomainErrorTranslator,
 )
+from api.utils import require_master_db
 from enums import DomainCodes
 from ldap_protocol.auth.exceptions.mfa import (
     MFAAPIError,
@@ -186,7 +187,7 @@ async def logout(
 @auth_router.patch(
     "/user/password",
     status_code=200,
-    dependencies=[Depends(verify_auth)],
+    dependencies=[Depends(verify_auth), Depends(require_master_db)],
     error_map=error_map,
 )
 async def password_reset(
@@ -229,6 +230,7 @@ async def check_setup(
     status_code=status.HTTP_200_OK,
     responses={423: {"detail": "Locked"}},
     error_map=error_map,
+    dependencies=[Depends(require_master_db)],
 )
 async def first_setup(
     request: SetupRequest,

diff --git a/app/api/auth/router_mfa.py b/app/api/auth/router_mfa.py
@@ -24,6 +24,7 @@
     DishkaErrorAwareRoute,
     DomainErrorTranslator,
 )
+from api.utils import require_master_db
 from enums import DomainCodes
 from ldap_protocol.auth.exceptions.mfa import (
     ForbiddenError,
@@ -81,7 +82,7 @@
 @mfa_router.post(
     "/setup",
     status_code=status.HTTP_201_CREATED,
-    dependencies=[Depends(verify_auth)],
+    dependencies=[Depends(verify_auth), Depends(require_master_db)],
     error_map=error_map,
 )
 async def setup_mfa(
@@ -100,7 +101,7 @@ async def setup_mfa(
 
 @mfa_router.delete(
     "/keys",
-    dependencies=[Depends(verify_auth)],
+    dependencies=[Depends(verify_auth), Depends(require_master_db)],
     error_map=error_map,
 )
 async def remove_mfa(
@@ -113,7 +114,7 @@ async def remove_mfa(
 
 @mfa_router.post(
     "/get",
-    dependencies=[Depends(verify_auth)],
+    dependencies=[Depends(verify_auth), Depends(require_master_db)],
     error_map=error_map,
 )
 async def get_mfa(

diff --git a/app/api/ldap_schema/attribute_type_router.py b/app/api/ldap_schema/attribute_type_router.py
@@ -7,7 +7,7 @@
 from typing import Annotated
 
 from dishka.integrations.fastapi import FromDishka
-from fastapi import Query, status
+from fastapi import Depends, Query, status
 
 from api.ldap_schema import LimitedListType, error_map, ldap_schema_router
 from api.ldap_schema.adapters.attribute_type import AttributeTypeFastAPIAdapter
@@ -16,13 +16,15 @@
     AttributeTypeSchema,
     AttributeTypeUpdateSchema,
 )
+from api.utils import require_master_db
 from ldap_protocol.utils.pagination import PaginationParams
 
 
 @ldap_schema_router.post(
     "/attribute_type",
     status_code=status.HTTP_201_CREATED,
     error_map=error_map,
+    dependencies=[Depends(require_master_db)],
 )
 async def create_one_attribute_type(
     request_data: AttributeTypeSchema[None],
@@ -59,6 +61,7 @@ async def get_list_attribute_types_with_pagination(
 @ldap_schema_router.patch(
     "/attribute_type/{attribute_type_name}",
     error_map=error_map,
+    dependencies=[Depends(require_master_db)],
 )
 async def modify_one_attribute_type(
     attribute_type_name: str,
@@ -72,6 +75,7 @@ async def modify_one_attribute_type(
 @ldap_schema_router.post(
     "/attribute_types/delete",
     error_map=error_map,
+    dependencies=[Depends(require_master_db)],
 )
 async def delete_bulk_attribute_types(
     attribute_types_names: LimitedListType,

diff --git a/app/api/ldap_schema/entity_type_router.py b/app/api/ldap_schema/entity_type_router.py
@@ -7,7 +7,7 @@
 from typing import Annotated
 
 from dishka.integrations.fastapi import FromDishka
-from fastapi import Query, status
+from fastapi import Depends, Query, status
 
 from api.ldap_schema import LimitedListType, error_map
 from api.ldap_schema.adapters.entity_type import LDAPEntityTypeFastAPIAdapter
@@ -17,13 +17,15 @@
     EntityTypeSchema,
     EntityTypeUpdateSchema,
 )
+from api.utils import require_master_db
 from ldap_protocol.utils.pagination import PaginationParams
 
 
 @ldap_schema_router.post(
     "/entity_type",
     status_code=status.HTTP_201_CREATED,
     error_map=error_map,
+    dependencies=[Depends(require_master_db)],
 )
 async def create_one_entity_type(
     request_data: EntityTypeSchema[None],
@@ -66,6 +68,7 @@ async def get_entity_type_attributes(
 @ldap_schema_router.patch(
     "/entity_type/{entity_type_name}",
     error_map=error_map,
+    dependencies=[Depends(require_master_db)],
 )
 async def modify_one_entity_type(
     entity_type_name: str,
@@ -76,7 +79,11 @@ async def modify_one_entity_type(
     await adapter.update(name=entity_type_name, data=request_data)
 
 
-@ldap_schema_router.post("/entity_type/delete", error_map=error_map)
+@ldap_schema_router.post(
+    "/entity_type/delete",
+    error_map=error_map,
+    dependencies=[Depends(require_master_db)],
+)
 async def delete_bulk_entity_types(
     entity_type_names: LimitedListType,
     adapter: FromDishka[LDAPEntityTypeFastAPIAdapter],

diff --git a/app/api/ldap_schema/object_class_router.py b/app/api/ldap_schema/object_class_router.py
@@ -7,7 +7,7 @@
 from typing import Annotated
 
 from dishka.integrations.fastapi import FromDishka
-from fastapi import Query, status
+from fastapi import Depends, Query, status
 
 from api.ldap_schema import LimitedListType, error_map
 from api.ldap_schema.adapters.object_class import ObjectClassFastAPIAdapter
@@ -17,13 +17,15 @@
     ObjectClassSchema,
     ObjectClassUpdateSchema,
 )
+from api.utils import require_master_db
 from ldap_protocol.utils.pagination import PaginationParams
 
 
 @ldap_schema_router.post(
     "/object_class",
     status_code=status.HTTP_201_CREATED,
     error_map=error_map,
+    dependencies=[Depends(require_master_db)],
 )
 async def create_one_object_class(
     request_data: ObjectClassSchema[None],
@@ -57,6 +59,7 @@ async def get_list_object_classes_with_pagination(
 @ldap_schema_router.patch(
     "/object_class/{object_class_name}",
     error_map=error_map,
+    dependencies=[Depends(require_master_db)],
 )
 async def modify_one_object_class(
     object_class_name: str,
@@ -67,7 +70,11 @@ async def modify_one_object_class(
     await adapter.update(object_class_name, request_data)
 
 
-@ldap_schema_router.post("/object_class/delete", error_map=error_map)
+@ldap_schema_router.post(
+    "/object_class/delete",
+    error_map=error_map,
+    dependencies=[Depends(require_master_db)],
+)
 async def delete_bulk_object_classes(
     object_classes_names: LimitedListType,
     adapter: FromDishka[ObjectClassFastAPIAdapter],

diff --git a/app/api/main/dns_router.py b/app/api/main/dns_router.py
@@ -29,6 +29,7 @@
     DNSServiceZoneDeleteRequest,
     DNSServiceZoneUpdateRequest,
 )
+from api.utils import require_master_db
 from enums import DomainCodes
 from ldap_protocol.dns import (
     DNSForwardServerStatus,
@@ -139,7 +140,11 @@ async def get_dns_status(
     return await adapter.get_dns_status()
 
 
-@dns_router.post("/setup", error_map=error_map)
+@dns_router.post(
+    "/setup",
+    error_map=error_map,
+    dependencies=[Depends(require_master_db)],
+)
 async def setup_dns(
     data: DNSServiceSetupRequest,
     adapter: FromDishka[DNSFastAPIAdapter],

diff --git a/app/api/main/krb5_router.py b/app/api/main/krb5_router.py
@@ -24,6 +24,7 @@
 )
 from api.main.adapters.kerberos import KerberosFastAPIAdapter
 from api.main.schema import KerberosSetupRequest
+from api.utils import require_master_db
 from enums import DomainCodes
 from ldap_protocol.dialogue import LDAPSession
 from ldap_protocol.kerberos import KerberosState
@@ -82,7 +83,7 @@
     "/setup/tree",
     response_class=Response,
     error_map=error_map,
-    dependencies=[Depends(verify_auth)],
+    dependencies=[Depends(verify_auth), Depends(require_master_db)],
 )
 async def setup_krb_catalogue(
     mail: Annotated[EmailStr, Body()],
@@ -106,7 +107,12 @@ async def setup_krb_catalogue(
     )
 
 
-@krb5_router.post("/setup", response_class=Response, error_map=error_map)
+@krb5_router.post(
+    "/setup",
+    response_class=Response,
+    error_map=error_map,
+    dependencies=[Depends(require_master_db)],
+)
 async def setup_kdc(
     data: KerberosSetupRequest,
     identity_adapter: FromDishka[AuthFastAPIAdapter],
@@ -173,7 +179,7 @@ async def get_krb_status(
 
 @krb5_router.post(
     "/principal/add",
-    dependencies=[Depends(verify_auth)],
+    dependencies=[Depends(verify_auth), Depends(require_master_db)],
     error_map=error_map,
 )
 async def add_principal(
@@ -193,7 +199,7 @@ async def add_principal(
 
 @krb5_router.patch(
     "/principal/rename",
-    dependencies=[Depends(verify_auth)],
+    dependencies=[Depends(verify_auth), Depends(require_master_db)],
     error_map=error_map,
 )
 async def rename_principal(
@@ -217,7 +223,7 @@ async def rename_principal(
 
 @krb5_router.patch(
     "/principal/reset",
-    dependencies=[Depends(verify_auth)],
+    dependencies=[Depends(verify_auth), Depends(require_master_db)],
     error_map=error_map,
 )
 async def reset_principal_pw(
@@ -238,7 +244,7 @@ async def reset_principal_pw(
 
 @krb5_router.delete(
     "/principal/delete",
-    dependencies=[Depends(verify_auth)],
+    dependencies=[Depends(verify_auth), Depends(require_master_db)],
     error_map=error_map,
 )
 async def delete_principal(