ske087
1f6217d347
Portal: - Replace is_admin boolean with role column (admin/advanced/standard) - Settings UI: 3-tier portal role select + per-app role dropdowns - /portal-return endpoint: re-establishes session from JWT for sub-app back-links - /api/internal/nv-users: internal endpoint for NetworkView user sync - portal/migrate_roles.py: one-time DB migration script - Role badges (admin/advanced/standard) in topbar and settings table DigiServer: - Add editor and viewer roles (portal advanced->editor, standard->viewer) - PlaylistPermission model: grant viewer users edit access to specific playlists - app/utils/access.py: shared editor_required, admin_required, can_edit_playlist helpers - Content routes: editor_required on create/delete, per-playlist permission check on mutations - Admin: playlist_permissions route + template to manage viewer playlist grants - Base template: hide Admin nav for viewers, Portal button (⬡) returns to portal - content_list_new: hide create/delete for viewers; Manage vs View button per permission - manage_playlist_content: view-only mode when user lacks edit permission NetworkView: - backend/src/middleware/rbac.js: requireRole + requireWriteAccess helpers - site_permissions table: one site per advanced user - All mutating routes guarded (admin=all, advanced=assigned site, viewer=read-only) - Portal SSO auto-upsert: user row synced from X-Auth-Role on every request - GET /api/users: merges portal users list with local NV data (all 4 portal users visible) - GET/PUT /api/users/:id/site-permission: assign site to advanced user - Settings Users tab: role badges, site dropdown for advanced, (portal only) indicator - Sidebar: ⬡ Portal button between Settings and Logout - Frontend build: VITE_API_BASE=/networkview/api now set in start-dev.sh IT Assets / Server Monitor: - portal_sso.py updated: map advanced->editor/viewer, standard->readonly - AdminUser model: add editor role + is_editor property
29 lines
1.2 KiB
Python
29 lines
1.2 KiB
Python
"""Per-user playlist edit permission for viewer-role accounts."""
|
|
from datetime import datetime
|
|
from app.extensions import db
|
|
|
|
|
|
class PlaylistPermission(db.Model):
|
|
"""
|
|
Grants a viewer-role user edit access to a specific playlist.
|
|
|
|
admin / editor users have implicit access to all playlists;
|
|
this table is only consulted for the 'viewer' role.
|
|
"""
|
|
__tablename__ = 'playlist_permissions'
|
|
|
|
id = db.Column(db.Integer, primary_key=True)
|
|
user_id = db.Column(db.Integer, db.ForeignKey('user.id', ondelete='CASCADE'), nullable=False)
|
|
playlist_id = db.Column(db.Integer, db.ForeignKey('playlist.id', ondelete='CASCADE'), nullable=False)
|
|
granted_at = db.Column(db.DateTime, default=datetime.utcnow, nullable=False)
|
|
|
|
user = db.relationship('User', backref=db.backref('playlist_permissions', lazy='dynamic', cascade='all, delete-orphan'))
|
|
playlist = db.relationship('Playlist', backref=db.backref('permitted_users', lazy='dynamic', cascade='all, delete-orphan'))
|
|
|
|
__table_args__ = (
|
|
db.UniqueConstraint('user_id', 'playlist_id', name='uq_user_playlist_perm'),
|
|
)
|
|
|
|
def __repr__(self):
|
|
return f'<PlaylistPermission user={self.user_id} playlist={self.playlist_id}>'
|