feat: 3-tier role system across all platform apps
Portal: - Replace is_admin boolean with role column (admin/advanced/standard) - Settings UI: 3-tier portal role select + per-app role dropdowns - /portal-return endpoint: re-establishes session from JWT for sub-app back-links - /api/internal/nv-users: internal endpoint for NetworkView user sync - portal/migrate_roles.py: one-time DB migration script - Role badges (admin/advanced/standard) in topbar and settings table DigiServer: - Add editor and viewer roles (portal advanced->editor, standard->viewer) - PlaylistPermission model: grant viewer users edit access to specific playlists - app/utils/access.py: shared editor_required, admin_required, can_edit_playlist helpers - Content routes: editor_required on create/delete, per-playlist permission check on mutations - Admin: playlist_permissions route + template to manage viewer playlist grants - Base template: hide Admin nav for viewers, Portal button (⬡) returns to portal - content_list_new: hide create/delete for viewers; Manage vs View button per permission - manage_playlist_content: view-only mode when user lacks edit permission NetworkView: - backend/src/middleware/rbac.js: requireRole + requireWriteAccess helpers - site_permissions table: one site per advanced user - All mutating routes guarded (admin=all, advanced=assigned site, viewer=read-only) - Portal SSO auto-upsert: user row synced from X-Auth-Role on every request - GET /api/users: merges portal users list with local NV data (all 4 portal users visible) - GET/PUT /api/users/:id/site-permission: assign site to advanced user - Settings Users tab: role badges, site dropdown for advanced, (portal only) indicator - Sidebar: ⬡ Portal button between Settings and Logout - Frontend build: VITE_API_BASE=/networkview/api now set in start-dev.sh IT Assets / Server Monitor: - portal_sso.py updated: map advanced->editor/viewer, standard->readonly - AdminUser model: add editor role + is_editor property
This commit is contained in:
ske087
@@ -9,26 +9,15 @@ from typing import Optional
|
||||
|
||||
from app.extensions import db, bcrypt
|
||||
from app.models import User, Player, Content, ServerLog, Playlist, HTTPSConfig
|
||||
from app.models.playlist_permission import PlaylistPermission
|
||||
from app.utils.logger import log_action
|
||||
from app.utils.caddy_manager import CaddyConfigGenerator
|
||||
from app.utils.nginx_config_reader import get_nginx_status
|
||||
from app.utils.access import admin_required, editor_required
|
||||
|
||||
admin_bp = Blueprint('admin', __name__, url_prefix='/admin')
|
||||
|
||||
|
||||
def admin_required(f):
|
||||
"""Decorator to require admin role for route access."""
|
||||
@wraps(f)
|
||||
def decorated_function(*args, **kwargs):
|
||||
if not current_user.is_authenticated:
|
||||
flash('Please login to access this page.', 'warning')
|
||||
return redirect(url_for('auth.login'))
|
||||
if current_user.role != 'admin':
|
||||
log_action('warning', f'Unauthorized admin access attempt by {current_user.username}')
|
||||
flash('You do not have permission to access this page.', 'danger')
|
||||
return redirect(url_for('main.dashboard'))
|
||||
return f(*args, **kwargs)
|
||||
return decorated_function
|
||||
# admin_required and editor_required imported from app.utils.access
|
||||
|
||||
|
||||
@admin_bp.route('/')
|
||||
@@ -203,6 +192,58 @@ def user_management():
|
||||
return redirect(url_for('admin.admin_panel'))
|
||||
|
||||
|
||||
# ── Playlist permissions (viewer-role users) ───────────────────────────────────
|
||||
|
||||
@admin_bp.route('/user/<int:user_id>/playlist-permissions')
|
||||
@login_required
|
||||
@admin_required
|
||||
def playlist_permissions(user_id: int):
|
||||
"""Show/manage which playlists a viewer-role user may edit."""
|
||||
user = User.query.get_or_404(user_id)
|
||||
playlists = Playlist.query.order_by(Playlist.name).all()
|
||||
granted_ids = {
|
||||
p.playlist_id
|
||||
for p in PlaylistPermission.query.filter_by(user_id=user_id).all()
|
||||
}
|
||||
return render_template(
|
||||
'admin/playlist_permissions.html',
|
||||
target_user=user,
|
||||
playlists=playlists,
|
||||
granted_ids=granted_ids,
|
||||
)
|
||||
|
||||
|
||||
@admin_bp.route('/user/<int:user_id>/playlist-permissions/save', methods=['POST'])
|
||||
@login_required
|
||||
@admin_required
|
||||
def save_playlist_permissions(user_id: int):
|
||||
"""Save (overwrite) the playlist edit permissions for a viewer user."""
|
||||
user = User.query.get_or_404(user_id)
|
||||
all_playlists = Playlist.query.all()
|
||||
|
||||
# The form sends one checkbox per playlist: name="playlist_<id>" value="1"
|
||||
new_ids = {
|
||||
pl.id for pl in all_playlists
|
||||
if request.form.get(f'playlist_{pl.id}') == '1'
|
||||
}
|
||||
|
||||
# Current grants
|
||||
existing = {p.playlist_id: p for p in PlaylistPermission.query.filter_by(user_id=user_id).all()}
|
||||
|
||||
# Add new grants
|
||||
for pid in new_ids - set(existing.keys()):
|
||||
db.session.add(PlaylistPermission(user_id=user_id, playlist_id=pid))
|
||||
|
||||
# Remove revoked grants
|
||||
for pid in set(existing.keys()) - new_ids:
|
||||
db.session.delete(existing[pid])
|
||||
|
||||
db.session.commit()
|
||||
log_action('info', f'Playlist permissions updated for user "{user.username}" by {current_user.username}')
|
||||
flash(f'Playlist permissions updated for "{user.username}".', 'success')
|
||||
return redirect(url_for('admin.playlist_permissions', user_id=user_id))
|
||||
|
||||
|
||||
@admin_bp.route('/user/<int:user_id>/password', methods=['POST'])
|
||||
@login_required
|
||||
@admin_required
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
"""Content blueprint - New playlist-centric workflow."""
|
||||
from flask import (Blueprint, render_template, request, redirect, url_for,
|
||||
flash, jsonify, current_app)
|
||||
from flask_login import login_required
|
||||
from flask_login import login_required, current_user
|
||||
from werkzeug.utils import secure_filename
|
||||
from typing import Optional
|
||||
import os
|
||||
@@ -15,6 +15,7 @@ from app.models import Content, Playlist, Player
|
||||
from app.models.playlist import playlist_content
|
||||
from app.utils.logger import log_action
|
||||
from app.utils.uploads import process_video_file, set_upload_progress
|
||||
from app.utils.access import editor_required, can_edit_playlist, get_editable_playlist_ids
|
||||
|
||||
# Store for background processing status
|
||||
_background_tasks = {}
|
||||
@@ -30,12 +31,14 @@ def content_list():
|
||||
media_files = Content.query.order_by(Content.uploaded_at.desc()).limit(3).all() # Only last 3
|
||||
total_media_count = Content.query.count() # Total count for display
|
||||
players = Player.query.order_by(Player.name).all()
|
||||
|
||||
editable_ids = get_editable_playlist_ids(current_user)
|
||||
|
||||
return render_template('content/content_list_new.html',
|
||||
playlists=playlists,
|
||||
media_files=media_files,
|
||||
total_media_count=total_media_count,
|
||||
players=players)
|
||||
players=players,
|
||||
editable_ids=editable_ids)
|
||||
|
||||
|
||||
@content_bp.route('/media-library')
|
||||
@@ -68,6 +71,7 @@ def media_library():
|
||||
|
||||
@content_bp.route('/media/<int:media_id>/delete', methods=['POST'])
|
||||
@login_required
|
||||
@editor_required
|
||||
def delete_media(media_id: int):
|
||||
"""Delete a media file and remove it from all playlists."""
|
||||
try:
|
||||
@@ -132,6 +136,7 @@ def delete_media(media_id: int):
|
||||
|
||||
@content_bp.route('/playlist/create', methods=['POST'])
|
||||
@login_required
|
||||
@editor_required
|
||||
def create_playlist():
|
||||
"""Create a new playlist."""
|
||||
try:
|
||||
@@ -170,6 +175,7 @@ def create_playlist():
|
||||
|
||||
@content_bp.route('/playlist/<int:playlist_id>/delete', methods=['POST'])
|
||||
@login_required
|
||||
@editor_required
|
||||
def delete_playlist(playlist_id: int):
|
||||
"""Delete a playlist."""
|
||||
playlist = Playlist.query.get_or_404(playlist_id)
|
||||
@@ -200,27 +206,32 @@ def delete_playlist(playlist_id: int):
|
||||
def manage_playlist_content(playlist_id: int):
|
||||
"""Manage content in a specific playlist."""
|
||||
playlist = Playlist.query.get_or_404(playlist_id)
|
||||
|
||||
can_edit = can_edit_playlist(current_user, playlist_id)
|
||||
|
||||
# Get content in playlist (ordered)
|
||||
playlist_content = playlist.get_content_ordered()
|
||||
|
||||
|
||||
# Get all available content not in this playlist.
|
||||
# Web links are created on demand per playlist, so they are not offered
|
||||
# as reusable library items here.
|
||||
all_content = Content.query.filter(Content.content_type != 'weblink').all()
|
||||
playlist_content_ids = {c.id for c in playlist_content}
|
||||
available_content = [c for c in all_content if c.id not in playlist_content_ids]
|
||||
|
||||
|
||||
return render_template('content/manage_playlist_content.html',
|
||||
playlist=playlist,
|
||||
playlist_content=playlist_content,
|
||||
available_content=available_content)
|
||||
available_content=available_content,
|
||||
can_edit=can_edit)
|
||||
|
||||
|
||||
@content_bp.route('/playlist/<int:playlist_id>/add-content', methods=['POST'])
|
||||
@login_required
|
||||
def add_content_to_playlist(playlist_id: int):
|
||||
"""Add content to playlist."""
|
||||
if not can_edit_playlist(current_user, playlist_id):
|
||||
flash('You do not have permission to edit this playlist.', 'danger')
|
||||
return redirect(url_for('content.manage_playlist_content', playlist_id=playlist_id))
|
||||
playlist = Playlist.query.get_or_404(playlist_id)
|
||||
|
||||
try:
|
||||
@@ -351,6 +362,9 @@ def add_weblink():
|
||||
@login_required
|
||||
def add_weblink_to_playlist(playlist_id: int):
|
||||
"""Create a web link content item and add it to the playlist."""
|
||||
if not can_edit_playlist(current_user, playlist_id):
|
||||
flash('You do not have permission to edit this playlist.', 'danger')
|
||||
return redirect(url_for('content.manage_playlist_content', playlist_id=playlist_id))
|
||||
playlist = Playlist.query.get_or_404(playlist_id)
|
||||
|
||||
try:
|
||||
@@ -417,6 +431,9 @@ def add_weblink_to_playlist(playlist_id: int):
|
||||
@login_required
|
||||
def remove_content_from_playlist(playlist_id: int, content_id: int):
|
||||
"""Remove content from playlist."""
|
||||
if not can_edit_playlist(current_user, playlist_id):
|
||||
flash('You do not have permission to edit this playlist.', 'danger')
|
||||
return redirect(url_for('content.manage_playlist_content', playlist_id=playlist_id))
|
||||
playlist = Playlist.query.get_or_404(playlist_id)
|
||||
|
||||
try:
|
||||
@@ -454,6 +471,8 @@ def remove_content_from_playlist(playlist_id: int, content_id: int):
|
||||
@login_required
|
||||
def bulk_remove_from_playlist(playlist_id: int):
|
||||
"""Remove multiple content items from playlist."""
|
||||
if not can_edit_playlist(current_user, playlist_id):
|
||||
return jsonify({'success': False, 'message': 'Permission denied'}), 403
|
||||
playlist = Playlist.query.get_or_404(playlist_id)
|
||||
|
||||
try:
|
||||
@@ -496,6 +515,8 @@ def bulk_remove_from_playlist(playlist_id: int):
|
||||
@login_required
|
||||
def reorder_playlist_content(playlist_id: int):
|
||||
"""Reorder content in playlist."""
|
||||
if not can_edit_playlist(current_user, playlist_id):
|
||||
return jsonify({'success': False, 'message': 'Permission denied'}), 403
|
||||
playlist = Playlist.query.get_or_404(playlist_id)
|
||||
|
||||
try:
|
||||
|
||||
@@ -40,8 +40,14 @@ def sync_user():
|
||||
|
||||
data = request.get_json(silent=True) or {}
|
||||
username = (data.get('username') or '').strip()
|
||||
role_raw = (data.get('role') or 'user').strip()
|
||||
role = 'admin' if role_raw == 'admin' else 'user'
|
||||
role_raw = (data.get('role') or 'viewer').strip()
|
||||
# Accept both old ('user') and new ('advanced'/'standard') role names from portal
|
||||
if role_raw == 'admin':
|
||||
role = 'admin'
|
||||
elif role_raw in ('advanced', 'editor'):
|
||||
role = 'editor'
|
||||
else:
|
||||
role = 'viewer'
|
||||
|
||||
if not username:
|
||||
return jsonify({'error': 'username required'}), 400
|
||||
|
||||
@@ -9,6 +9,7 @@ from app.models.player_feedback import PlayerFeedback
|
||||
from app.models.player_edit import PlayerEdit
|
||||
from app.models.player_user import PlayerUser
|
||||
from app.models.https_config import HTTPSConfig
|
||||
from app.models.playlist_permission import PlaylistPermission
|
||||
|
||||
__all__ = [
|
||||
'User',
|
||||
|
||||
@@ -0,0 +1,28 @@
|
||||
"""Per-user playlist edit permission for viewer-role accounts."""
|
||||
from datetime import datetime
|
||||
from app.extensions import db
|
||||
|
||||
|
||||
class PlaylistPermission(db.Model):
|
||||
"""
|
||||
Grants a viewer-role user edit access to a specific playlist.
|
||||
|
||||
admin / editor users have implicit access to all playlists;
|
||||
this table is only consulted for the 'viewer' role.
|
||||
"""
|
||||
__tablename__ = 'playlist_permissions'
|
||||
|
||||
id = db.Column(db.Integer, primary_key=True)
|
||||
user_id = db.Column(db.Integer, db.ForeignKey('user.id', ondelete='CASCADE'), nullable=False)
|
||||
playlist_id = db.Column(db.Integer, db.ForeignKey('playlist.id', ondelete='CASCADE'), nullable=False)
|
||||
granted_at = db.Column(db.DateTime, default=datetime.utcnow, nullable=False)
|
||||
|
||||
user = db.relationship('User', backref=db.backref('playlist_permissions', lazy='dynamic', cascade='all, delete-orphan'))
|
||||
playlist = db.relationship('Playlist', backref=db.backref('permitted_users', lazy='dynamic', cascade='all, delete-orphan'))
|
||||
|
||||
__table_args__ = (
|
||||
db.UniqueConstraint('user_id', 'playlist_id', name='uq_user_playlist_perm'),
|
||||
)
|
||||
|
||||
def __repr__(self):
|
||||
return f'<PlaylistPermission user={self.user_id} playlist={self.playlist_id}>'
|
||||
@@ -24,7 +24,8 @@ class User(db.Model, UserMixin):
|
||||
id = db.Column(db.Integer, primary_key=True)
|
||||
username = db.Column(db.String(80), unique=True, nullable=False, index=True)
|
||||
password = db.Column(db.String(120), nullable=False)
|
||||
role = db.Column(db.String(20), nullable=False, default='user', index=True)
|
||||
role = db.Column(db.String(20), nullable=False, default='viewer', index=True)
|
||||
# Valid roles: 'admin' | 'editor' | 'viewer'
|
||||
theme = db.Column(db.String(20), default='light')
|
||||
created_at = db.Column(db.DateTime, default=datetime.utcnow, nullable=False)
|
||||
last_login = db.Column(db.DateTime, nullable=True)
|
||||
@@ -37,6 +38,16 @@ class User(db.Model, UserMixin):
|
||||
def is_admin(self) -> bool:
|
||||
"""Check if user has admin role."""
|
||||
return self.role == 'admin'
|
||||
|
||||
@property
|
||||
def is_editor(self) -> bool:
|
||||
"""True for admin and editor roles (can manage content)."""
|
||||
return self.role in ('admin', 'editor')
|
||||
|
||||
@property
|
||||
def is_viewer(self) -> bool:
|
||||
"""True for all authenticated users (read access)."""
|
||||
return True
|
||||
|
||||
def update_last_login(self) -> None:
|
||||
"""Update last login timestamp."""
|
||||
|
||||
@@ -0,0 +1,77 @@
|
||||
{% extends "base.html" %}
|
||||
{% block title %}Playlist Permissions — {{ target_user.username }}{% endblock %}
|
||||
|
||||
{% block content %}
|
||||
<div style="margin-bottom: 1.5rem;">
|
||||
<a href="{{ url_for('admin.user_management') }}" class="btn btn-secondary">← Back to Users</a>
|
||||
</div>
|
||||
|
||||
<div class="card">
|
||||
<h2 style="margin-bottom: 0.25rem;">
|
||||
🎬 Playlist Edit Permissions
|
||||
</h2>
|
||||
<p style="color: var(--text-secondary); margin-bottom: 1.5rem;">
|
||||
User: <strong>{{ target_user.username }}</strong>
|
||||
<span class="badge badge-{{ 'success' if target_user.role == 'editor' else 'secondary' }}" style="margin-left: 0.5rem;">
|
||||
{{ target_user.role }}
|
||||
</span>
|
||||
</p>
|
||||
|
||||
{% if target_user.role in ('admin', 'editor') %}
|
||||
<div class="alert alert-info" style="background:#d1ecf1; border-left:4px solid #17a2b8; color:#0c5460; padding:1rem; border-radius:6px;">
|
||||
ℹ️ This user already has <strong>{{ target_user.role }}</strong> access — they can edit <em>all</em> playlists automatically.
|
||||
Playlist-level permissions are only relevant for <strong>viewer</strong> role users.
|
||||
</div>
|
||||
{% else %}
|
||||
<p style="color: var(--text-secondary); margin-bottom: 1.5rem; font-size: 0.9rem;">
|
||||
Select which playlists this viewer may add, remove and reorder content in.
|
||||
They will still be able to <em>view</em> all playlists regardless of this setting.
|
||||
</p>
|
||||
|
||||
<form method="POST" action="{{ url_for('admin.save_playlist_permissions', user_id=target_user.id) }}">
|
||||
{% if playlists %}
|
||||
<table style="width:100%; border-collapse:collapse; margin-bottom:1.5rem;">
|
||||
<thead>
|
||||
<tr style="border-bottom: 2px solid var(--border-color);">
|
||||
<th style="padding:10px 12px; text-align:left;">Playlist</th>
|
||||
<th style="padding:10px 12px; text-align:left; color: var(--text-secondary); font-size:0.85rem;">Description</th>
|
||||
<th style="padding:10px 12px; text-align:center;">Can Edit?</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
{% for playlist in playlists %}
|
||||
<tr style="border-bottom: 1px solid var(--border-color);">
|
||||
<td style="padding:12px;">
|
||||
<strong>{{ playlist.name }}</strong>
|
||||
<div style="font-size:0.8rem; color: var(--text-secondary);">
|
||||
{{ playlist.content_count }} items · {{ playlist.player_count }} player(s)
|
||||
</div>
|
||||
</td>
|
||||
<td style="padding:12px; color: var(--text-secondary); font-size:0.9rem;">
|
||||
{{ playlist.description or '—' }}
|
||||
</td>
|
||||
<td style="padding:12px; text-align:center;">
|
||||
<label style="display:inline-flex; align-items:center; gap:8px; cursor:pointer;">
|
||||
<input type="checkbox"
|
||||
name="playlist_{{ playlist.id }}"
|
||||
value="1"
|
||||
{{ 'checked' if playlist.id in granted_ids else '' }}
|
||||
style="width:18px; height:18px; cursor:pointer;">
|
||||
</label>
|
||||
</td>
|
||||
</tr>
|
||||
{% endfor %}
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<div style="display:flex; gap:1rem;">
|
||||
<button type="submit" class="btn btn-primary">💾 Save Permissions</button>
|
||||
<a href="{{ url_for('admin.user_management') }}" class="btn btn-secondary">Cancel</a>
|
||||
</div>
|
||||
{% else %}
|
||||
<p style="color: var(--text-secondary);">No playlists created yet.</p>
|
||||
{% endif %}
|
||||
</form>
|
||||
{% endif %}
|
||||
</div>
|
||||
{% endblock %}
|
||||
@@ -27,6 +27,7 @@
|
||||
<th>Role</th>
|
||||
<th>Created At</th>
|
||||
<th>Last Login</th>
|
||||
<th>Permissions</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
@@ -40,12 +41,22 @@
|
||||
{% endif %}
|
||||
</td>
|
||||
<td>
|
||||
<span class="badge badge-{{ 'success' if user.role == 'admin' else 'secondary' }}">
|
||||
<span class="badge badge-{{ 'success' if user.role == 'admin' else ('warning' if user.role == 'editor' else 'secondary') }}">
|
||||
{{ user.role|capitalize }}
|
||||
</span>
|
||||
</td>
|
||||
<td>{{ user.created_at | localtime if user.created_at else 'N/A' }}</td>
|
||||
<td>{{ user.last_login | localtime if user.last_login else 'Never' }}</td>
|
||||
<td>
|
||||
{% if user.role == 'viewer' %}
|
||||
<a href="{{ url_for('admin.playlist_permissions', user_id=user.id) }}"
|
||||
class="btn btn-sm" style="font-size:12px; padding:4px 10px;">
|
||||
🎬 Playlists
|
||||
</a>
|
||||
{% else %}
|
||||
<span style="color:#999; font-size:12px;">all access</span>
|
||||
{% endif %}
|
||||
</td>
|
||||
</tr>
|
||||
{% endfor %}
|
||||
{% else %}
|
||||
|
||||
@@ -393,8 +393,17 @@
|
||||
<img src="{{ url_for('static', filename='icons/playlist.svg') }}" alt="">
|
||||
Playlists
|
||||
</a>
|
||||
{% if current_user.role in ('admin', 'editor') %}
|
||||
<a href="{{ url_for('admin.admin_panel') }}">Admin</a>
|
||||
<a href="{{ url_for('auth.logout') }}">Logout ({{ current_user.username }})</a>
|
||||
{% endif %}
|
||||
<a href="/portal-return" title="Back to Enterprise Portal Dashboard"
|
||||
style="background: rgba(255,255,255,0.15); border: 1px solid rgba(255,255,255,0.3);">
|
||||
⬡ Portal
|
||||
</a>
|
||||
<a href="{{ url_for('auth.logout') }}" style="display:flex; flex-direction:column; align-items:center; line-height:1.2;">
|
||||
<span>Logout ({{ current_user.username }})</span>
|
||||
<span style="font-size:0.7em; opacity:0.7; text-transform:uppercase; letter-spacing:0.05em;">{{ current_user.role }}</span>
|
||||
</a>
|
||||
<button class="dark-mode-toggle" onclick="toggleDarkMode()" title="Toggle Dark Mode">
|
||||
<img id="theme-icon" src="{{ url_for('static', filename='icons/moon.svg') }}" alt="Toggle theme">
|
||||
</button>
|
||||
|
||||
@@ -264,7 +264,8 @@
|
||||
</h1>
|
||||
|
||||
<div class="main-grid">
|
||||
<!-- Create Playlist Card -->
|
||||
<!-- Create Playlist Card — editor/admin only -->
|
||||
{% if current_user.role in ('admin', 'editor') %}
|
||||
<div class="card">
|
||||
<div class="card-header">
|
||||
<h2 style="display: flex; align-items: center; gap: 0.5rem;">
|
||||
@@ -300,6 +301,9 @@
|
||||
</button>
|
||||
</form>
|
||||
</div>
|
||||
{% endif %}
|
||||
</form>
|
||||
</div>
|
||||
|
||||
<!-- Upload Media Card -->
|
||||
<div class="card">
|
||||
@@ -395,8 +399,9 @@
|
||||
<div class="playlist-actions">
|
||||
<a href="{{ url_for('content.manage_playlist_content', playlist_id=playlist.id) }}"
|
||||
class="btn btn-primary btn-sm">
|
||||
✏️ Manage
|
||||
{% if playlist.id in editable_ids %}✏️ Manage{% else %}👁 View{% endif %}
|
||||
</a>
|
||||
{% if current_user.role in ('admin', 'editor') %}
|
||||
<form method="POST"
|
||||
action="{{ url_for('content.delete_playlist', playlist_id=playlist.id) }}"
|
||||
style="display: inline;"
|
||||
@@ -406,6 +411,7 @@
|
||||
Delete
|
||||
</button>
|
||||
</form>
|
||||
{% endif %}
|
||||
</div>
|
||||
</div>
|
||||
{% endfor %}
|
||||
|
||||
@@ -274,19 +274,26 @@
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div style="margin-bottom: 20px;">
|
||||
<div style="margin-bottom: 20px; display:flex; align-items:center; gap:1rem;">
|
||||
<a href="{{ url_for('content.content_list') }}" class="btn btn-secondary">
|
||||
← Back to Playlists
|
||||
</a>
|
||||
{% if not can_edit %}
|
||||
<span style="background:#fff3cd; color:#856404; padding:6px 14px; border-radius:6px; font-size:0.85rem; border:1px solid #ffc107;">
|
||||
👁 View-only — you don't have edit permission for this playlist
|
||||
</span>
|
||||
{% endif %}
|
||||
</div>
|
||||
|
||||
<div class="content-grid">
|
||||
<div class="card">
|
||||
<div style="display: flex; justify-content: space-between; align-items: center; margin-bottom: 20px;">
|
||||
<h2 style="margin: 0;">📋 Playlist Content (Drag to Reorder)</h2>
|
||||
<h2 style="margin: 0;">📋 Playlist Content{% if can_edit %} (Drag to Reorder){% endif %}</h2>
|
||||
{% if can_edit %}
|
||||
<button id="bulk-delete-btn" class="btn btn-danger" style="display: none;" onclick="bulkDeleteSelected()">
|
||||
🗑️ Delete Selected (<span id="selected-count">0</span>)
|
||||
</button>
|
||||
{% endif %}
|
||||
</div>
|
||||
|
||||
{% if playlist_content %}
|
||||
@@ -308,11 +315,9 @@
|
||||
</thead>
|
||||
<tbody id="playlist-tbody">
|
||||
{% for content in playlist_content %}
|
||||
<tr class="draggable-row" draggable="true" data-content-id="{{ content.id }}">
|
||||
<td>
|
||||
<input type="checkbox" class="content-checkbox" data-content-id="{{ content.id }}" onchange="updateBulkDeleteButton()">
|
||||
</td>
|
||||
<td><span class="drag-handle">⋮⋮</span></td>
|
||||
<tr class="{% if can_edit %}draggable-row{% endif %}" {% if can_edit %}draggable="true"{% endif %} data-content-id="{{ content.id }}">
|
||||
<td>{% if can_edit %}<input type="checkbox" class="content-checkbox" data-content-id="{{ content.id }}" onchange="updateBulkDeleteButton()">{% endif %}</td>
|
||||
<td>{% if can_edit %}<span class="drag-handle">⋮⋮</span>{% endif %}</td>
|
||||
<td>{{ loop.index }}</td>
|
||||
<td>
|
||||
{% if content.content_type == 'weblink' %}
|
||||
@@ -384,6 +389,7 @@
|
||||
{% endif %}
|
||||
</td>
|
||||
<td>
|
||||
{% if can_edit %}
|
||||
<form method="POST"
|
||||
action="{{ url_for('content.remove_content_from_playlist', playlist_id=playlist.id, content_id=content.id) }}"
|
||||
style="display: inline;"
|
||||
@@ -392,6 +398,10 @@
|
||||
✕
|
||||
</button>
|
||||
</form>
|
||||
{% else %}
|
||||
<span style="color:#999;">—</span>
|
||||
{% endif %}
|
||||
</td> </form>
|
||||
</td>
|
||||
</tr>
|
||||
{% endfor %}
|
||||
@@ -406,6 +416,7 @@
|
||||
</div>
|
||||
|
||||
<div class="card">
|
||||
{% if can_edit %}
|
||||
<h2 style="margin-bottom: 20px;">➕ Add Content</h2>
|
||||
|
||||
<div style="margin-bottom: 24px; padding-bottom: 24px; border-bottom: 1px solid #e0e0e0;">
|
||||
@@ -457,6 +468,15 @@
|
||||
<p>All available content has been added to this playlist!</p>
|
||||
</div>
|
||||
{% endif %}
|
||||
|
||||
{% else %}
|
||||
{# Viewer without edit permission on this playlist #}
|
||||
<div style="text-align:center; padding:40px; color:#999;">
|
||||
<div style="font-size:3rem; margin-bottom:1rem;">🔒</div>
|
||||
<p>You have view-only access to this playlist.</p>
|
||||
<p style="font-size:0.85rem; margin-top:0.5rem;">Contact an administrator to request edit access.</p>
|
||||
</div>
|
||||
{% endif %}
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
@@ -0,0 +1,64 @@
|
||||
"""
|
||||
Shared role / access helpers for DigiServer blueprints.
|
||||
|
||||
Import these instead of duplicating decorators in every blueprint.
|
||||
"""
|
||||
from functools import wraps
|
||||
from flask import abort, flash, redirect, url_for
|
||||
from flask_login import current_user
|
||||
|
||||
|
||||
# ── Role-gate decorators ──────────────────────────────────────────────────────
|
||||
|
||||
def editor_required(f):
|
||||
"""Allow admin and editor roles; redirect viewers with a flash message."""
|
||||
@wraps(f)
|
||||
def decorated(*args, **kwargs):
|
||||
if not current_user.is_authenticated:
|
||||
return redirect(url_for('auth.login'))
|
||||
if current_user.role not in ('admin', 'editor'):
|
||||
flash('You need editor or admin privileges to perform this action.', 'danger')
|
||||
return redirect(url_for('main.dashboard'))
|
||||
return f(*args, **kwargs)
|
||||
return decorated
|
||||
|
||||
|
||||
def admin_required(f):
|
||||
"""Allow admin role only."""
|
||||
@wraps(f)
|
||||
def decorated(*args, **kwargs):
|
||||
if not current_user.is_authenticated:
|
||||
return redirect(url_for('auth.login'))
|
||||
if current_user.role != 'admin':
|
||||
flash('Administrator access required.', 'danger')
|
||||
return redirect(url_for('main.dashboard'))
|
||||
return f(*args, **kwargs)
|
||||
return decorated
|
||||
|
||||
|
||||
# ── Playlist permission check ─────────────────────────────────────────────────
|
||||
|
||||
def can_edit_playlist(user, playlist_id: int) -> bool:
|
||||
"""
|
||||
Return True if *user* is allowed to edit the given playlist.
|
||||
|
||||
- admin / editor → always True
|
||||
- viewer → True only when a PlaylistPermission row exists
|
||||
"""
|
||||
if user.role in ('admin', 'editor'):
|
||||
return True
|
||||
from app.models.playlist_permission import PlaylistPermission
|
||||
return PlaylistPermission.query.filter_by(
|
||||
user_id=user.id, playlist_id=playlist_id
|
||||
).first() is not None
|
||||
|
||||
|
||||
def get_editable_playlist_ids(user) -> set:
|
||||
"""Return the set of playlist IDs the user may edit (used in list views)."""
|
||||
if user.role in ('admin', 'editor'):
|
||||
# Import here to avoid circular imports at module load time
|
||||
from app.models.playlist import Playlist
|
||||
return {p.id for p in Playlist.query.with_entities(Playlist.id).all()}
|
||||
from app.models.playlist_permission import PlaylistPermission
|
||||
rows = PlaylistPermission.query.filter_by(user_id=user.id).all()
|
||||
return {r.playlist_id for r in rows}
|
||||
@@ -3,7 +3,12 @@ Portal SSO middleware for DigiServer v2.
|
||||
|
||||
When the umbrella nginx verifies the portal JWT it sets two headers:
|
||||
X-Auth-Username — the portal username
|
||||
X-Auth-Role — 'admin' or 'user'
|
||||
X-Auth-Role — 'admin' | 'advanced' | 'standard'
|
||||
|
||||
Portal role → DigiServer local role mapping:
|
||||
admin → admin (full access including user management)
|
||||
advanced → editor (manage content/playlists, no user management)
|
||||
standard → viewer (read-only)
|
||||
|
||||
This before_request handler reads those headers and auto-logs in the
|
||||
corresponding local DigiServer user, creating them on first access if
|
||||
@@ -32,12 +37,21 @@ def init_portal_sso(app):
|
||||
login_user(user, remember=False)
|
||||
|
||||
|
||||
def _portal_role_to_local(portal_role):
|
||||
"""Map a portal role string to the DigiServer local role."""
|
||||
if portal_role == 'admin':
|
||||
return 'admin'
|
||||
if portal_role == 'advanced':
|
||||
return 'editor'
|
||||
return 'viewer' # 'standard' or anything unknown
|
||||
|
||||
|
||||
def _get_or_create_user(username, role):
|
||||
from app.models.user import User
|
||||
from app.extensions import db, bcrypt
|
||||
|
||||
try:
|
||||
target_role = 'admin' if role == 'admin' else 'user'
|
||||
target_role = _portal_role_to_local(role)
|
||||
user = User.query.filter_by(username=username).first()
|
||||
if not user:
|
||||
hashed_pw = bcrypt.generate_password_hash(secrets.token_hex(32)).decode('utf-8')
|
||||
|
||||
Reference in New Issue
Block a user