Replaced config auth with db auth

src/alpine_bits_python/api.py

@@ -664,7 +664,8 @@ async def detect_language(
 
 async def validate_basic_auth(
     credentials: HTTPBasicCredentials = Depends(security_basic),
-) -> str:
+    db_session=Depends(get_async_session),
+) -> tuple[str, str]:
     """Validate basic authentication for AlpineBits protocol.
 
     Returns username if valid, raises HTTPException if not.
@@ -676,26 +677,40 @@ async def validate_basic_auth(
             detail="ERROR: Authentication required",
             headers={"WWW-Authenticate": "Basic"},
         )
-    valid = False
-    config = app.state.config
+    hotel_service = HotelService(db_session)
+    hotel = await hotel_service.authenticate_hotel(
+        credentials.username, credentials.password
+    )
 
-    for entry in config["alpine_bits_auth"]:
+    if hotel:
+        _LOGGER.info(
+            "AlpineBits authentication successful for user: %s (from database)",
+            credentials.username,
+        )
+        return credentials.username, credentials.password
+
+    # Fallback to config-defined credentials for legacy scenarios
+    config = app.state.config
+    valid = False
+    for entry in config.get("alpine_bits_auth", []):
         if (
-            credentials.username == entry["username"]
-            and credentials.password == entry["password"]
+            credentials.username == entry.get("username")
+            and credentials.password == entry.get("password")
         ):
             valid = True
+            _LOGGER.warning(
+                "AlpineBits authentication for user %s matched legacy config entry",
+                credentials.username,
+            )
             break
+
     if not valid:
         raise HTTPException(
             status_code=401,
             detail="ERROR: Invalid credentials",
             headers={"WWW-Authenticate": "Basic"},
         )
-    _LOGGER.info(
-        "AlpineBits authentication successful for user: %s (from config)",
-        credentials.username,
-    )
+
     return credentials.username, credentials.password