ske087
1f6217d347
Portal: - Replace is_admin boolean with role column (admin/advanced/standard) - Settings UI: 3-tier portal role select + per-app role dropdowns - /portal-return endpoint: re-establishes session from JWT for sub-app back-links - /api/internal/nv-users: internal endpoint for NetworkView user sync - portal/migrate_roles.py: one-time DB migration script - Role badges (admin/advanced/standard) in topbar and settings table DigiServer: - Add editor and viewer roles (portal advanced->editor, standard->viewer) - PlaylistPermission model: grant viewer users edit access to specific playlists - app/utils/access.py: shared editor_required, admin_required, can_edit_playlist helpers - Content routes: editor_required on create/delete, per-playlist permission check on mutations - Admin: playlist_permissions route + template to manage viewer playlist grants - Base template: hide Admin nav for viewers, Portal button (⬡) returns to portal - content_list_new: hide create/delete for viewers; Manage vs View button per permission - manage_playlist_content: view-only mode when user lacks edit permission NetworkView: - backend/src/middleware/rbac.js: requireRole + requireWriteAccess helpers - site_permissions table: one site per advanced user - All mutating routes guarded (admin=all, advanced=assigned site, viewer=read-only) - Portal SSO auto-upsert: user row synced from X-Auth-Role on every request - GET /api/users: merges portal users list with local NV data (all 4 portal users visible) - GET/PUT /api/users/:id/site-permission: assign site to advanced user - Settings Users tab: role badges, site dropdown for advanced, (portal only) indicator - Sidebar: ⬡ Portal button between Settings and Logout - Frontend build: VITE_API_BASE=/networkview/api now set in start-dev.sh IT Assets / Server Monitor: - portal_sso.py updated: map advanced->editor/viewer, standard->readonly - AdminUser model: add editor role + is_editor property
55 lines
1.8 KiB
Python
55 lines
1.8 KiB
Python
"""User model for authentication and authorization."""
|
|
from datetime import datetime
|
|
from typing import Optional
|
|
|
|
from flask_login import UserMixin
|
|
|
|
from app.extensions import db
|
|
|
|
|
|
class User(db.Model, UserMixin):
|
|
"""User model for application authentication.
|
|
|
|
Attributes:
|
|
id: Primary key
|
|
username: Unique username for login
|
|
password: Bcrypt hashed password
|
|
role: User role (user or admin)
|
|
theme: UI theme preference (light or dark)
|
|
created_at: Account creation timestamp
|
|
last_login: Last successful login timestamp
|
|
"""
|
|
__tablename__ = 'user'
|
|
|
|
id = db.Column(db.Integer, primary_key=True)
|
|
username = db.Column(db.String(80), unique=True, nullable=False, index=True)
|
|
password = db.Column(db.String(120), nullable=False)
|
|
role = db.Column(db.String(20), nullable=False, default='viewer', index=True)
|
|
# Valid roles: 'admin' | 'editor' | 'viewer'
|
|
theme = db.Column(db.String(20), default='light')
|
|
created_at = db.Column(db.DateTime, default=datetime.utcnow, nullable=False)
|
|
last_login = db.Column(db.DateTime, nullable=True)
|
|
|
|
def __repr__(self) -> str:
|
|
"""String representation of User."""
|
|
return f'<User {self.username} (role={self.role})>'
|
|
|
|
@property
|
|
def is_admin(self) -> bool:
|
|
"""Check if user has admin role."""
|
|
return self.role == 'admin'
|
|
|
|
@property
|
|
def is_editor(self) -> bool:
|
|
"""True for admin and editor roles (can manage content)."""
|
|
return self.role in ('admin', 'editor')
|
|
|
|
@property
|
|
def is_viewer(self) -> bool:
|
|
"""True for all authenticated users (read access)."""
|
|
return True
|
|
|
|
def update_last_login(self) -> None:
|
|
"""Update last login timestamp."""
|
|
self.last_login = datetime.utcnow()
|