feat: 3-tier role system across all platform apps
Portal: - Replace is_admin boolean with role column (admin/advanced/standard) - Settings UI: 3-tier portal role select + per-app role dropdowns - /portal-return endpoint: re-establishes session from JWT for sub-app back-links - /api/internal/nv-users: internal endpoint for NetworkView user sync - portal/migrate_roles.py: one-time DB migration script - Role badges (admin/advanced/standard) in topbar and settings table DigiServer: - Add editor and viewer roles (portal advanced->editor, standard->viewer) - PlaylistPermission model: grant viewer users edit access to specific playlists - app/utils/access.py: shared editor_required, admin_required, can_edit_playlist helpers - Content routes: editor_required on create/delete, per-playlist permission check on mutations - Admin: playlist_permissions route + template to manage viewer playlist grants - Base template: hide Admin nav for viewers, Portal button (⬡) returns to portal - content_list_new: hide create/delete for viewers; Manage vs View button per permission - manage_playlist_content: view-only mode when user lacks edit permission NetworkView: - backend/src/middleware/rbac.js: requireRole + requireWriteAccess helpers - site_permissions table: one site per advanced user - All mutating routes guarded (admin=all, advanced=assigned site, viewer=read-only) - Portal SSO auto-upsert: user row synced from X-Auth-Role on every request - GET /api/users: merges portal users list with local NV data (all 4 portal users visible) - GET/PUT /api/users/:id/site-permission: assign site to advanced user - Settings Users tab: role badges, site dropdown for advanced, (portal only) indicator - Sidebar: ⬡ Portal button between Settings and Logout - Frontend build: VITE_API_BASE=/networkview/api now set in start-dev.sh IT Assets / Server Monitor: - portal_sso.py updated: map advanced->editor/viewer, standard->readonly - AdminUser model: add editor role + is_editor property
This commit is contained in:
ske087
@@ -0,0 +1,77 @@
|
||||
{% extends "base.html" %}
|
||||
{% block title %}Playlist Permissions — {{ target_user.username }}{% endblock %}
|
||||
|
||||
{% block content %}
|
||||
<div style="margin-bottom: 1.5rem;">
|
||||
<a href="{{ url_for('admin.user_management') }}" class="btn btn-secondary">← Back to Users</a>
|
||||
</div>
|
||||
|
||||
<div class="card">
|
||||
<h2 style="margin-bottom: 0.25rem;">
|
||||
🎬 Playlist Edit Permissions
|
||||
</h2>
|
||||
<p style="color: var(--text-secondary); margin-bottom: 1.5rem;">
|
||||
User: <strong>{{ target_user.username }}</strong>
|
||||
<span class="badge badge-{{ 'success' if target_user.role == 'editor' else 'secondary' }}" style="margin-left: 0.5rem;">
|
||||
{{ target_user.role }}
|
||||
</span>
|
||||
</p>
|
||||
|
||||
{% if target_user.role in ('admin', 'editor') %}
|
||||
<div class="alert alert-info" style="background:#d1ecf1; border-left:4px solid #17a2b8; color:#0c5460; padding:1rem; border-radius:6px;">
|
||||
ℹ️ This user already has <strong>{{ target_user.role }}</strong> access — they can edit <em>all</em> playlists automatically.
|
||||
Playlist-level permissions are only relevant for <strong>viewer</strong> role users.
|
||||
</div>
|
||||
{% else %}
|
||||
<p style="color: var(--text-secondary); margin-bottom: 1.5rem; font-size: 0.9rem;">
|
||||
Select which playlists this viewer may add, remove and reorder content in.
|
||||
They will still be able to <em>view</em> all playlists regardless of this setting.
|
||||
</p>
|
||||
|
||||
<form method="POST" action="{{ url_for('admin.save_playlist_permissions', user_id=target_user.id) }}">
|
||||
{% if playlists %}
|
||||
<table style="width:100%; border-collapse:collapse; margin-bottom:1.5rem;">
|
||||
<thead>
|
||||
<tr style="border-bottom: 2px solid var(--border-color);">
|
||||
<th style="padding:10px 12px; text-align:left;">Playlist</th>
|
||||
<th style="padding:10px 12px; text-align:left; color: var(--text-secondary); font-size:0.85rem;">Description</th>
|
||||
<th style="padding:10px 12px; text-align:center;">Can Edit?</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
{% for playlist in playlists %}
|
||||
<tr style="border-bottom: 1px solid var(--border-color);">
|
||||
<td style="padding:12px;">
|
||||
<strong>{{ playlist.name }}</strong>
|
||||
<div style="font-size:0.8rem; color: var(--text-secondary);">
|
||||
{{ playlist.content_count }} items · {{ playlist.player_count }} player(s)
|
||||
</div>
|
||||
</td>
|
||||
<td style="padding:12px; color: var(--text-secondary); font-size:0.9rem;">
|
||||
{{ playlist.description or '—' }}
|
||||
</td>
|
||||
<td style="padding:12px; text-align:center;">
|
||||
<label style="display:inline-flex; align-items:center; gap:8px; cursor:pointer;">
|
||||
<input type="checkbox"
|
||||
name="playlist_{{ playlist.id }}"
|
||||
value="1"
|
||||
{{ 'checked' if playlist.id in granted_ids else '' }}
|
||||
style="width:18px; height:18px; cursor:pointer;">
|
||||
</label>
|
||||
</td>
|
||||
</tr>
|
||||
{% endfor %}
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<div style="display:flex; gap:1rem;">
|
||||
<button type="submit" class="btn btn-primary">💾 Save Permissions</button>
|
||||
<a href="{{ url_for('admin.user_management') }}" class="btn btn-secondary">Cancel</a>
|
||||
</div>
|
||||
{% else %}
|
||||
<p style="color: var(--text-secondary);">No playlists created yet.</p>
|
||||
{% endif %}
|
||||
</form>
|
||||
{% endif %}
|
||||
</div>
|
||||
{% endblock %}
|
||||
@@ -27,6 +27,7 @@
|
||||
<th>Role</th>
|
||||
<th>Created At</th>
|
||||
<th>Last Login</th>
|
||||
<th>Permissions</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
@@ -40,12 +41,22 @@
|
||||
{% endif %}
|
||||
</td>
|
||||
<td>
|
||||
<span class="badge badge-{{ 'success' if user.role == 'admin' else 'secondary' }}">
|
||||
<span class="badge badge-{{ 'success' if user.role == 'admin' else ('warning' if user.role == 'editor' else 'secondary') }}">
|
||||
{{ user.role|capitalize }}
|
||||
</span>
|
||||
</td>
|
||||
<td>{{ user.created_at | localtime if user.created_at else 'N/A' }}</td>
|
||||
<td>{{ user.last_login | localtime if user.last_login else 'Never' }}</td>
|
||||
<td>
|
||||
{% if user.role == 'viewer' %}
|
||||
<a href="{{ url_for('admin.playlist_permissions', user_id=user.id) }}"
|
||||
class="btn btn-sm" style="font-size:12px; padding:4px 10px;">
|
||||
🎬 Playlists
|
||||
</a>
|
||||
{% else %}
|
||||
<span style="color:#999; font-size:12px;">all access</span>
|
||||
{% endif %}
|
||||
</td>
|
||||
</tr>
|
||||
{% endfor %}
|
||||
{% else %}
|
||||
|
||||
@@ -393,8 +393,17 @@
|
||||
<img src="{{ url_for('static', filename='icons/playlist.svg') }}" alt="">
|
||||
Playlists
|
||||
</a>
|
||||
{% if current_user.role in ('admin', 'editor') %}
|
||||
<a href="{{ url_for('admin.admin_panel') }}">Admin</a>
|
||||
<a href="{{ url_for('auth.logout') }}">Logout ({{ current_user.username }})</a>
|
||||
{% endif %}
|
||||
<a href="/portal-return" title="Back to Enterprise Portal Dashboard"
|
||||
style="background: rgba(255,255,255,0.15); border: 1px solid rgba(255,255,255,0.3);">
|
||||
⬡ Portal
|
||||
</a>
|
||||
<a href="{{ url_for('auth.logout') }}" style="display:flex; flex-direction:column; align-items:center; line-height:1.2;">
|
||||
<span>Logout ({{ current_user.username }})</span>
|
||||
<span style="font-size:0.7em; opacity:0.7; text-transform:uppercase; letter-spacing:0.05em;">{{ current_user.role }}</span>
|
||||
</a>
|
||||
<button class="dark-mode-toggle" onclick="toggleDarkMode()" title="Toggle Dark Mode">
|
||||
<img id="theme-icon" src="{{ url_for('static', filename='icons/moon.svg') }}" alt="Toggle theme">
|
||||
</button>
|
||||
|
||||
@@ -264,7 +264,8 @@
|
||||
</h1>
|
||||
|
||||
<div class="main-grid">
|
||||
<!-- Create Playlist Card -->
|
||||
<!-- Create Playlist Card — editor/admin only -->
|
||||
{% if current_user.role in ('admin', 'editor') %}
|
||||
<div class="card">
|
||||
<div class="card-header">
|
||||
<h2 style="display: flex; align-items: center; gap: 0.5rem;">
|
||||
@@ -300,6 +301,9 @@
|
||||
</button>
|
||||
</form>
|
||||
</div>
|
||||
{% endif %}
|
||||
</form>
|
||||
</div>
|
||||
|
||||
<!-- Upload Media Card -->
|
||||
<div class="card">
|
||||
@@ -395,8 +399,9 @@
|
||||
<div class="playlist-actions">
|
||||
<a href="{{ url_for('content.manage_playlist_content', playlist_id=playlist.id) }}"
|
||||
class="btn btn-primary btn-sm">
|
||||
✏️ Manage
|
||||
{% if playlist.id in editable_ids %}✏️ Manage{% else %}👁 View{% endif %}
|
||||
</a>
|
||||
{% if current_user.role in ('admin', 'editor') %}
|
||||
<form method="POST"
|
||||
action="{{ url_for('content.delete_playlist', playlist_id=playlist.id) }}"
|
||||
style="display: inline;"
|
||||
@@ -406,6 +411,7 @@
|
||||
Delete
|
||||
</button>
|
||||
</form>
|
||||
{% endif %}
|
||||
</div>
|
||||
</div>
|
||||
{% endfor %}
|
||||
|
||||
@@ -274,19 +274,26 @@
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div style="margin-bottom: 20px;">
|
||||
<div style="margin-bottom: 20px; display:flex; align-items:center; gap:1rem;">
|
||||
<a href="{{ url_for('content.content_list') }}" class="btn btn-secondary">
|
||||
← Back to Playlists
|
||||
</a>
|
||||
{% if not can_edit %}
|
||||
<span style="background:#fff3cd; color:#856404; padding:6px 14px; border-radius:6px; font-size:0.85rem; border:1px solid #ffc107;">
|
||||
👁 View-only — you don't have edit permission for this playlist
|
||||
</span>
|
||||
{% endif %}
|
||||
</div>
|
||||
|
||||
<div class="content-grid">
|
||||
<div class="card">
|
||||
<div style="display: flex; justify-content: space-between; align-items: center; margin-bottom: 20px;">
|
||||
<h2 style="margin: 0;">📋 Playlist Content (Drag to Reorder)</h2>
|
||||
<h2 style="margin: 0;">📋 Playlist Content{% if can_edit %} (Drag to Reorder){% endif %}</h2>
|
||||
{% if can_edit %}
|
||||
<button id="bulk-delete-btn" class="btn btn-danger" style="display: none;" onclick="bulkDeleteSelected()">
|
||||
🗑️ Delete Selected (<span id="selected-count">0</span>)
|
||||
</button>
|
||||
{% endif %}
|
||||
</div>
|
||||
|
||||
{% if playlist_content %}
|
||||
@@ -308,11 +315,9 @@
|
||||
</thead>
|
||||
<tbody id="playlist-tbody">
|
||||
{% for content in playlist_content %}
|
||||
<tr class="draggable-row" draggable="true" data-content-id="{{ content.id }}">
|
||||
<td>
|
||||
<input type="checkbox" class="content-checkbox" data-content-id="{{ content.id }}" onchange="updateBulkDeleteButton()">
|
||||
</td>
|
||||
<td><span class="drag-handle">⋮⋮</span></td>
|
||||
<tr class="{% if can_edit %}draggable-row{% endif %}" {% if can_edit %}draggable="true"{% endif %} data-content-id="{{ content.id }}">
|
||||
<td>{% if can_edit %}<input type="checkbox" class="content-checkbox" data-content-id="{{ content.id }}" onchange="updateBulkDeleteButton()">{% endif %}</td>
|
||||
<td>{% if can_edit %}<span class="drag-handle">⋮⋮</span>{% endif %}</td>
|
||||
<td>{{ loop.index }}</td>
|
||||
<td>
|
||||
{% if content.content_type == 'weblink' %}
|
||||
@@ -384,6 +389,7 @@
|
||||
{% endif %}
|
||||
</td>
|
||||
<td>
|
||||
{% if can_edit %}
|
||||
<form method="POST"
|
||||
action="{{ url_for('content.remove_content_from_playlist', playlist_id=playlist.id, content_id=content.id) }}"
|
||||
style="display: inline;"
|
||||
@@ -392,6 +398,10 @@
|
||||
✕
|
||||
</button>
|
||||
</form>
|
||||
{% else %}
|
||||
<span style="color:#999;">—</span>
|
||||
{% endif %}
|
||||
</td> </form>
|
||||
</td>
|
||||
</tr>
|
||||
{% endfor %}
|
||||
@@ -406,6 +416,7 @@
|
||||
</div>
|
||||
|
||||
<div class="card">
|
||||
{% if can_edit %}
|
||||
<h2 style="margin-bottom: 20px;">➕ Add Content</h2>
|
||||
|
||||
<div style="margin-bottom: 24px; padding-bottom: 24px; border-bottom: 1px solid #e0e0e0;">
|
||||
@@ -457,6 +468,15 @@
|
||||
<p>All available content has been added to this playlist!</p>
|
||||
</div>
|
||||
{% endif %}
|
||||
|
||||
{% else %}
|
||||
{# Viewer without edit permission on this playlist #}
|
||||
<div style="text-align:center; padding:40px; color:#999;">
|
||||
<div style="font-size:3rem; margin-bottom:1rem;">🔒</div>
|
||||
<p>You have view-only access to this playlist.</p>
|
||||
<p style="font-size:0.85rem; margin-top:0.5rem;">Contact an administrator to request edit access.</p>
|
||||
</div>
|
||||
{% endif %}
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
Reference in New Issue
Block a user