ske087
7d24e7f527
Auth: - Fix local login (was redirecting to portal; now authenticates AdminUser directly) - Portal SSO still takes priority in production via nginx headers Role system (admin | editor | readonly): - New app/utils/decorators.py with editor_required and admin_required decorators - All write routes protected with editor_required (create/edit/delete/import/mask) - Settings user management protected with admin_required - Sidebar hides write-only links for readonly users - Dashboard quick actions and list page buttons hidden for readonly Settings page: - Role colour badges (admin=red, editor=blue, readonly=grey) - Inline role changer per user (dropdown auto-submit) - Reset password modal per user - Delete user button with confirmation - Add user form includes role selector with legend Portal user sync: - New /internal/sync-user endpoint receives user pre-creation from portal - INTERNAL_SYNC_SECRET added to config - portal/config.py: added internal_url for itassets app so _sync_user_to_app works
74 lines
2.5 KiB
Python
74 lines
2.5 KiB
Python
import os
|
|
from datetime import datetime, date
|
|
from flask import Flask
|
|
from werkzeug.middleware.proxy_fix import ProxyFix
|
|
from config import config
|
|
from app.extensions import db, migrate, login_manager
|
|
|
|
|
|
def create_app(config_name='default'):
|
|
app = Flask(__name__)
|
|
app.config.from_object(config[config_name])
|
|
|
|
# Ensure storage directories exist
|
|
for folder_key in ('UPLOAD_FOLDER', 'PDF_FOLDER', 'TEMPLATE_FOLDER', 'DOCX_FOLDER'):
|
|
folder = os.path.join(app.root_path, '..', app.config[folder_key])
|
|
os.makedirs(folder, exist_ok=True)
|
|
|
|
# Proxy and script-name middleware for umbrella nginx
|
|
app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=1, x_host=1, x_port=1)
|
|
from app.utils.script_name_fix import ScriptNameFix
|
|
app.wsgi_app = ScriptNameFix(app.wsgi_app)
|
|
|
|
# Initialize extensions
|
|
db.init_app(app)
|
|
migrate.init_app(app, db)
|
|
login_manager.init_app(app)
|
|
|
|
# Import models so Flask-Migrate detects them
|
|
from app.models import admin_user, user, asset, assignment, paperwork, audit_log, document_template # noqa: F401
|
|
|
|
# Register blueprints
|
|
from app.routes.auth import bp as auth_bp
|
|
from app.routes.dashboard import bp as dashboard_bp
|
|
from app.routes.users import bp as users_bp
|
|
from app.routes.assets import bp as assets_bp
|
|
from app.routes.assignments import bp as assignments_bp
|
|
from app.routes.paperwork import bp as paperwork_bp
|
|
from app.routes.audit import bp as audit_bp
|
|
from app.routes.settings import bp as settings_bp
|
|
from app.routes.doc_templates import bp as doc_templates_bp
|
|
from app.routes.internal import bp as internal_bp
|
|
|
|
app.register_blueprint(auth_bp)
|
|
app.register_blueprint(dashboard_bp)
|
|
app.register_blueprint(users_bp)
|
|
app.register_blueprint(assets_bp)
|
|
app.register_blueprint(assignments_bp)
|
|
app.register_blueprint(paperwork_bp)
|
|
app.register_blueprint(audit_bp)
|
|
app.register_blueprint(settings_bp)
|
|
app.register_blueprint(doc_templates_bp)
|
|
app.register_blueprint(internal_bp)
|
|
|
|
# Inject common template variables
|
|
from datetime import datetime, date
|
|
|
|
@app.context_processor
|
|
def inject_globals():
|
|
return {
|
|
'now': datetime.utcnow(),
|
|
'today': date.today(),
|
|
'today_date': date.today().isoformat(),
|
|
}
|
|
|
|
# Portal SSO: auto-login users arriving via the umbrella nginx gateway
|
|
from app.utils.portal_sso import init_portal_sso
|
|
init_portal_sso(app)
|
|
|
|
# Ensure DB schema exists (idempotent)
|
|
with app.app_context():
|
|
db.create_all()
|
|
|
|
return app
|