required acess token and client token in set, delete skin and capes

app/api/capes.py

@@ -1,12 +1,32 @@
-from fastapi import APIRouter, UploadFile, File
+from fastapi import APIRouter, UploadFile, File, HTTPException, Form
 from app.services.cape import CapeService
+from app.services.auth import AuthService
 
 router = APIRouter(tags=["Capes"])
 
 @router.post("/user/{username}/cape")
-async def set_cape(username: str, cape_file: UploadFile = File(...)):
+async def set_cape(
+    username: str, 
+    cape_file: UploadFile = File(...),
+    accessToken: str = Form(...),
+    clientToken: str = Form(...)
+):
+    # Validate the token
+    is_valid = await AuthService().validate(accessToken, clientToken)
+    if not is_valid:
+        raise HTTPException(status_code=401, detail="Invalid authentication tokens")
+        
     return await CapeService().set_cape(username, cape_file)
 
 @router.delete("/user/{username}/cape")
-async def remove_cape(username: str):
+async def remove_cape(
+    username: str,
+    accessToken: str,
+    clientToken: str
+):
+    # Validate the token
+    is_valid = await AuthService().validate(accessToken, clientToken)
+    if not is_valid:
+        raise HTTPException(status_code=401, detail="Invalid authentication tokens")
+        
     return await CapeService().remove_cape(username)

app/api/skins.py

@@ -1,12 +1,33 @@
-from fastapi import APIRouter, UploadFile, File, Form
+from fastapi import APIRouter, UploadFile, File, Form, HTTPException
 from app.services.skin import SkinService
+from app.services.auth import AuthService
 
 router = APIRouter(tags=["Skins"])
 
 @router.post("/user/{username}/skin")
-async def set_skin(username: str, skin_file: UploadFile = File(...), skin_model: str = Form("classic")):
+async def set_skin(
+    username: str, 
+    skin_file: UploadFile = File(...), 
+    skin_model: str = Form("classic"),
+    accessToken: str = Form(...),
+    clientToken: str = Form(...)
+):
+    # Validate the token
+    is_valid = await AuthService().validate(accessToken, clientToken)
+    if not is_valid:
+        raise HTTPException(status_code=401, detail="Invalid authentication tokens")
+        
     return await SkinService().set_skin(username, skin_file, skin_model)
 
 @router.delete("/user/{username}/skin")
-async def remove_skin(username: str):
+async def remove_skin(
+    username: str,
+    accessToken: str,
+    clientToken: str
+):
+    # Validate the token
+    is_valid = await AuthService().validate(accessToken, clientToken)
+    if not is_valid:
+        raise HTTPException(status_code=401, detail="Invalid authentication tokens")
+        
     return await SkinService().remove_skin(username)