It is currently possible to add dependencies to a StacApi with the add_route_dependencies method, as shown in this test:

This works but it is tricky because you need to enumerate all of the route paths/methods that you want to cover. Would it make sense to add an optional route_dependencies attribute to the TransactionsExtension and BulkTransactionExtension that would be included in all of the router.add_api_route calls?

If we did this, then a user could easily define some kind of auth function and apply it as a dependency to all of the routes that are managed by the transaction extensions.

It could look something like this:

from fastapi import Depends
from fastapi.security import HTTPBasic, HTTPBasicCredentials

from stac_fastapi.api.app import StacApi
from stac_fastapi.extensions.core import TransactionExtension


def must_be_bob(
    credentials: HTTPBasicCredentials = Depends(HTTPBasic()),
):
    if credentials.username == "bob":
        return True

    raise HTTPException(
        status_code=status.HTTP_401_UNAUTHORIZED,
        detail="You're not Bob",
        headers={"WWW-Authenticate": "Basic"},
    )


api = StacApi(
    ...
    extensions=[
        TransactionExtension(..., route_dependencies=[Depends(must_be_bob)])
    ],
    ...
)

On the TransactionExtension we would just add the new route_dependencies attribute and provide it in all calls to self.router.add_api_route().

cc @vincentsarago @gadomski