e8a95bf561
- User id/login = username (was email). Email is a separate settable field. - Default admin: username admin / password 1234, must_setup=True. - Login forces /setup on first login: set email + change password, then clears must_setup. - New /api/auth/setup endpoint; JWT sub = username; admin routes use username. - Frontend: Login uses username, router guard forces /setup, new Setup.vue (email + new password + confirm), i18n EN/TH. - Tests: test_setup.py added; all suites adapted (m0/m1/routes/security/setup/e2e) PASS.
95 lines
3.2 KiB
Python
95 lines
3.2 KiB
Python
"""Admin routes: user provisioning + role management (no self-registration)."""
|
|
from __future__ import annotations
|
|
|
|
from flask import Blueprint, jsonify, request
|
|
|
|
from ..auth.users import AuthError
|
|
from ..config import Config
|
|
from .helpers import ApiError, current_user, require_auth, require_roles
|
|
|
|
admin_bp = Blueprint("admin", __name__)
|
|
|
|
|
|
def _store():
|
|
from flask import current_app
|
|
|
|
return current_app.extensions["user_store"]
|
|
|
|
|
|
@admin_bp.post("/users")
|
|
@require_auth
|
|
@require_roles("admin")
|
|
def create_user():
|
|
"""Create a user + provision a password (invite). Admin or super-admin only."""
|
|
data = request.get_json(silent=True) or {}
|
|
name = (data.get("name") or "").strip()
|
|
username = (data.get("username") or data.get("email") or "").strip().lower()
|
|
password = data.get("password") or ""
|
|
role = (data.get("role") or "user").strip()
|
|
org_id = (data.get("org_id") or current_user().get("org_id") or "org-default").strip()
|
|
|
|
if not username or not password:
|
|
raise ApiError("username and password are required")
|
|
if role not in Config.ROLES:
|
|
raise ApiError(f"invalid role: {role}")
|
|
# Only super_admin can create another admin/super_admin
|
|
actor_role = current_user().get("role")
|
|
if role in ("admin", "super_admin") and actor_role != "super_admin":
|
|
raise ApiError("only super_admin can grant admin roles", 403)
|
|
try:
|
|
user = _store().create_user(
|
|
org_id=org_id, username=username, password=password, name=name, role=role
|
|
)
|
|
except AuthError as exc:
|
|
raise ApiError(str(exc))
|
|
return jsonify({"user": _store().public_user(user)}), 201
|
|
|
|
|
|
@admin_bp.get("/users")
|
|
@require_auth
|
|
@require_roles("admin")
|
|
def list_users():
|
|
actor = current_user()
|
|
if actor.get("role") == "super_admin":
|
|
users = _store().list_users()
|
|
else:
|
|
users = _store().list_users(org_id=actor.get("org_id"))
|
|
return jsonify({"users": users})
|
|
|
|
|
|
@admin_bp.put("/users/<username>")
|
|
@require_auth
|
|
@require_roles("admin")
|
|
def update_user(username: str):
|
|
data = request.get_json(silent=True) or {}
|
|
username = username.strip().lower()
|
|
actor = current_user()
|
|
target = _store().get_user_or_none(username)
|
|
if not target:
|
|
raise ApiError("user not found", 404)
|
|
|
|
# Role changes / admin-modification restricted to super_admin
|
|
if "role" in data:
|
|
role = (data.get("role") or "").strip()
|
|
if role not in Config.ROLES:
|
|
raise ApiError(f"invalid role: {role}")
|
|
if actor.get("role") != "super_admin":
|
|
raise ApiError("only super_admin can change roles")
|
|
_store().set_role(username, role)
|
|
|
|
if "active" in data:
|
|
if actor.get("role") != "super_admin":
|
|
raise ApiError("only super_admin can activate/deactivate users")
|
|
_store().set_active(username, bool(data.get("active")))
|
|
|
|
if "password" in data and data.get("password"):
|
|
_store().set_password(username, data.get("password"))
|
|
|
|
if "email" in data:
|
|
try:
|
|
_store().set_email(username, data.get("email"))
|
|
except AuthError as exc:
|
|
raise ApiError(str(exc))
|
|
|
|
return jsonify({"user": _store().public_user(_store().get_user(username))})
|