feat: 3-tier role system across all platform apps
Portal: - Replace is_admin boolean with role column (admin/advanced/standard) - Settings UI: 3-tier portal role select + per-app role dropdowns - /portal-return endpoint: re-establishes session from JWT for sub-app back-links - /api/internal/nv-users: internal endpoint for NetworkView user sync - portal/migrate_roles.py: one-time DB migration script - Role badges (admin/advanced/standard) in topbar and settings table DigiServer: - Add editor and viewer roles (portal advanced->editor, standard->viewer) - PlaylistPermission model: grant viewer users edit access to specific playlists - app/utils/access.py: shared editor_required, admin_required, can_edit_playlist helpers - Content routes: editor_required on create/delete, per-playlist permission check on mutations - Admin: playlist_permissions route + template to manage viewer playlist grants - Base template: hide Admin nav for viewers, Portal button (⬡) returns to portal - content_list_new: hide create/delete for viewers; Manage vs View button per permission - manage_playlist_content: view-only mode when user lacks edit permission NetworkView: - backend/src/middleware/rbac.js: requireRole + requireWriteAccess helpers - site_permissions table: one site per advanced user - All mutating routes guarded (admin=all, advanced=assigned site, viewer=read-only) - Portal SSO auto-upsert: user row synced from X-Auth-Role on every request - GET /api/users: merges portal users list with local NV data (all 4 portal users visible) - GET/PUT /api/users/:id/site-permission: assign site to advanced user - Settings Users tab: role badges, site dropdown for advanced, (portal only) indicator - Sidebar: ⬡ Portal button between Settings and Logout - Frontend build: VITE_API_BASE=/networkview/api now set in start-dev.sh IT Assets / Server Monitor: - portal_sso.py updated: map advanced->editor/viewer, standard->readonly - AdminUser model: add editor role + is_editor property
This commit is contained in:
ske087
@@ -0,0 +1,77 @@
|
||||
{% extends "base.html" %}
|
||||
{% block title %}Playlist Permissions — {{ target_user.username }}{% endblock %}
|
||||
|
||||
{% block content %}
|
||||
<div style="margin-bottom: 1.5rem;">
|
||||
<a href="{{ url_for('admin.user_management') }}" class="btn btn-secondary">← Back to Users</a>
|
||||
</div>
|
||||
|
||||
<div class="card">
|
||||
<h2 style="margin-bottom: 0.25rem;">
|
||||
🎬 Playlist Edit Permissions
|
||||
</h2>
|
||||
<p style="color: var(--text-secondary); margin-bottom: 1.5rem;">
|
||||
User: <strong>{{ target_user.username }}</strong>
|
||||
<span class="badge badge-{{ 'success' if target_user.role == 'editor' else 'secondary' }}" style="margin-left: 0.5rem;">
|
||||
{{ target_user.role }}
|
||||
</span>
|
||||
</p>
|
||||
|
||||
{% if target_user.role in ('admin', 'editor') %}
|
||||
<div class="alert alert-info" style="background:#d1ecf1; border-left:4px solid #17a2b8; color:#0c5460; padding:1rem; border-radius:6px;">
|
||||
ℹ️ This user already has <strong>{{ target_user.role }}</strong> access — they can edit <em>all</em> playlists automatically.
|
||||
Playlist-level permissions are only relevant for <strong>viewer</strong> role users.
|
||||
</div>
|
||||
{% else %}
|
||||
<p style="color: var(--text-secondary); margin-bottom: 1.5rem; font-size: 0.9rem;">
|
||||
Select which playlists this viewer may add, remove and reorder content in.
|
||||
They will still be able to <em>view</em> all playlists regardless of this setting.
|
||||
</p>
|
||||
|
||||
<form method="POST" action="{{ url_for('admin.save_playlist_permissions', user_id=target_user.id) }}">
|
||||
{% if playlists %}
|
||||
<table style="width:100%; border-collapse:collapse; margin-bottom:1.5rem;">
|
||||
<thead>
|
||||
<tr style="border-bottom: 2px solid var(--border-color);">
|
||||
<th style="padding:10px 12px; text-align:left;">Playlist</th>
|
||||
<th style="padding:10px 12px; text-align:left; color: var(--text-secondary); font-size:0.85rem;">Description</th>
|
||||
<th style="padding:10px 12px; text-align:center;">Can Edit?</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
{% for playlist in playlists %}
|
||||
<tr style="border-bottom: 1px solid var(--border-color);">
|
||||
<td style="padding:12px;">
|
||||
<strong>{{ playlist.name }}</strong>
|
||||
<div style="font-size:0.8rem; color: var(--text-secondary);">
|
||||
{{ playlist.content_count }} items · {{ playlist.player_count }} player(s)
|
||||
</div>
|
||||
</td>
|
||||
<td style="padding:12px; color: var(--text-secondary); font-size:0.9rem;">
|
||||
{{ playlist.description or '—' }}
|
||||
</td>
|
||||
<td style="padding:12px; text-align:center;">
|
||||
<label style="display:inline-flex; align-items:center; gap:8px; cursor:pointer;">
|
||||
<input type="checkbox"
|
||||
name="playlist_{{ playlist.id }}"
|
||||
value="1"
|
||||
{{ 'checked' if playlist.id in granted_ids else '' }}
|
||||
style="width:18px; height:18px; cursor:pointer;">
|
||||
</label>
|
||||
</td>
|
||||
</tr>
|
||||
{% endfor %}
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<div style="display:flex; gap:1rem;">
|
||||
<button type="submit" class="btn btn-primary">💾 Save Permissions</button>
|
||||
<a href="{{ url_for('admin.user_management') }}" class="btn btn-secondary">Cancel</a>
|
||||
</div>
|
||||
{% else %}
|
||||
<p style="color: var(--text-secondary);">No playlists created yet.</p>
|
||||
{% endif %}
|
||||
</form>
|
||||
{% endif %}
|
||||
</div>
|
||||
{% endblock %}
|
||||
@@ -27,6 +27,7 @@
|
||||
<th>Role</th>
|
||||
<th>Created At</th>
|
||||
<th>Last Login</th>
|
||||
<th>Permissions</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
@@ -40,12 +41,22 @@
|
||||
{% endif %}
|
||||
</td>
|
||||
<td>
|
||||
<span class="badge badge-{{ 'success' if user.role == 'admin' else 'secondary' }}">
|
||||
<span class="badge badge-{{ 'success' if user.role == 'admin' else ('warning' if user.role == 'editor' else 'secondary') }}">
|
||||
{{ user.role|capitalize }}
|
||||
</span>
|
||||
</td>
|
||||
<td>{{ user.created_at | localtime if user.created_at else 'N/A' }}</td>
|
||||
<td>{{ user.last_login | localtime if user.last_login else 'Never' }}</td>
|
||||
<td>
|
||||
{% if user.role == 'viewer' %}
|
||||
<a href="{{ url_for('admin.playlist_permissions', user_id=user.id) }}"
|
||||
class="btn btn-sm" style="font-size:12px; padding:4px 10px;">
|
||||
🎬 Playlists
|
||||
</a>
|
||||
{% else %}
|
||||
<span style="color:#999; font-size:12px;">all access</span>
|
||||
{% endif %}
|
||||
</td>
|
||||
</tr>
|
||||
{% endfor %}
|
||||
{% else %}
|
||||
|
||||
Reference in New Issue
Block a user