ge-aerospace/shopdb-flask
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

slides: grantable slides.manage permission for non-admin curators

Browse Source
This commit is contained in:
Cameron Proudlock
2026-07-29 08:41:53 -04:00
parent 02147827f0
commit eeae042aa8
8 changed files with 106 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
plugins/slides/api/routes.py
View File

@@ -2,7 +2,8 @@
Image files live on disk at instance/slides/<surface>/; TvSlide rows hold play
order + per-slide seconds. Feed + image routes are PUBLIC (kiosks/screensaver
have no auth); management routes are admin-only.
have no auth); management routes require the slides.manage permission (admins
have it by default).
"""
import os
@@ -12,7 +13,8 @@ from flask import Blueprint, request, current_app, jsonify, send_from_directory
from flask_jwt_extended import jwt_required
from werkzeug.utils import secure_filename
from shopdb.api import db, success_response, error_response, ErrorCodes, require_role
from shopdb.api import (db, success_response, error_response, ErrorCodes,
require_permission)
from ..models import TvSlide
@@ -88,7 +90,7 @@ def serve_image(surface, filename):
@slides_bp.route('/<surface>', methods=['GET'])
@jwt_required()
@require_role('admin')
@require_permission('slides.manage')
def list_slides(surface):
if not _valid_surface(surface):
return error_response(ErrorCodes.VALIDATION_ERROR, 'Unknown surface')
@@ -106,7 +108,7 @@ def list_slides(surface):
@slides_bp.route('/<surface>/upload', methods=['POST'])
@jwt_required()
@require_role('admin')
@require_permission('slides.manage')
def upload_slides(surface):
if not _valid_surface(surface):
return error_response(ErrorCodes.VALIDATION_ERROR, 'Unknown surface')
@@ -151,7 +153,7 @@ def upload_slides(surface):
@slides_bp.route('/<surface>/order', methods=['POST'])
@jwt_required()
@require_role('admin')
@require_permission('slides.manage')
def reorder_slides(surface):
if not _valid_surface(surface):
return error_response(ErrorCodes.VALIDATION_ERROR, 'Unknown surface')
@@ -167,7 +169,7 @@ def reorder_slides(surface):
@slides_bp.route('/<surface>/delete', methods=['POST'])
@jwt_required()
@require_role('admin')
@require_permission('slides.manage')
def delete_slides(surface):
if not _valid_surface(surface):
return error_response(ErrorCodes.VALIDATION_ERROR, 'Unknown surface')
@@ -193,7 +195,7 @@ def delete_slides(surface):
@slides_bp.route('/<surface>/<int:slideid>', methods=['PATCH'])
@jwt_required()
@require_role('admin')
@require_permission('slides.manage')
def update_slide(surface, slideid):
if not _valid_surface(surface):
return error_response(ErrorCodes.VALIDATION_ERROR, 'Unknown surface')