78a0ee8d83
Feature work from the 2026-07 session: Settings IA - Replace the flat 27-card settings hub with a persistent two-pane shell (SettingsLayout.vue): grouped, searchable left rail + content pane. - Nest all settings/* routes under the shell via router post-processing; shared nav catalog in settingsNav.js. Group by asset class (PCs, Printers, Equipment, Network) so per-type settings stop scattering. Custom fields (core) - customfields + customfieldvalues tables (migration 7d14), CRUD API at /api/customfields, per-asset value get/save. - Settings management page + reusable CustomFieldsSection (detail) and CustomFieldsInputs (form) wired into all four asset types. Warranty (new plugin) - plugins/warranty: warranties + warrantyassets (migration 7d15), derived coverage status, provider abstraction (manual now; Dell/Lenovo/HP stubs). - API CRUD + per-asset panel + report buckets; WarrantyPanel on all four detail pages; Warranties management page; Warranty report + Reports card. - Seed warranty.* permissions. Printer drivers - printerdrivers table (migration 7d13) linked to printer models; drivers now surface on the matching printer's detail page. Other - PCDetail rebalanced (Network + Status + Warranty + custom fields on the right). - Rename PCs list "Features" column to "Remote Access"; fix badge hover underline. - Drop equipment islocationonly field. - Centralize asset-type label/route maps into utils/assetTypes.js. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
75 lines
2.6 KiB
Python
75 lines
2.6 KiB
Python
"""Authorization decorators for role and permission gating.
|
|
|
|
Authentication (is the caller logged in?) is handled by Flask-JWT-Extended's
|
|
@jwt_required. Authorization (is the caller ALLOWED to do this?) is handled
|
|
here. The two are separate concerns; a route needs both on any state-changing
|
|
action.
|
|
|
|
These decorators call verify_jwt_in_request() themselves, so they work whether
|
|
or not a separate @jwt_required is also present. The admin role bypasses every
|
|
permission check (see User.haspermission), so an admin never needs individual
|
|
permissions granted.
|
|
|
|
Usage:
|
|
|
|
@assets_bp.route('/<int:asset_id>', methods=['DELETE'])
|
|
@jwt_required()
|
|
@require_permission('assets.delete')
|
|
def delete_asset(asset_id):
|
|
...
|
|
"""
|
|
|
|
from functools import wraps
|
|
|
|
from flask_jwt_extended import verify_jwt_in_request, current_user
|
|
|
|
from shopdb.utils.responses import error_response, ErrorCodes
|
|
|
|
|
|
def require_permission(permission_name: str):
|
|
"""Gate a route behind a single permission. Admin role bypasses."""
|
|
def decorator(view_func):
|
|
@wraps(view_func)
|
|
def wrapper(*args, **kwargs):
|
|
# verify jwt first so current_user is loaded (idempotent if the
|
|
# route also has @jwt_required)
|
|
verify_jwt_in_request()
|
|
if current_user is None:
|
|
return error_response(
|
|
ErrorCodes.UNAUTHORIZED,
|
|
'Authentication required',
|
|
http_code=401
|
|
)
|
|
if not current_user.haspermission(permission_name):
|
|
return error_response(
|
|
ErrorCodes.FORBIDDEN,
|
|
'You do not have permission to perform this action',
|
|
http_code=403
|
|
)
|
|
return view_func(*args, **kwargs)
|
|
return wrapper
|
|
return decorator
|
|
|
|
|
|
def require_role(rolename: str):
|
|
"""Gate a route behind a single role (e.g. 'admin')."""
|
|
def decorator(view_func):
|
|
@wraps(view_func)
|
|
def wrapper(*args, **kwargs):
|
|
verify_jwt_in_request()
|
|
if current_user is None:
|
|
return error_response(
|
|
ErrorCodes.UNAUTHORIZED,
|
|
'Authentication required',
|
|
http_code=401
|
|
)
|
|
if not current_user.hasrole(rolename):
|
|
return error_response(
|
|
ErrorCodes.FORBIDDEN,
|
|
f'{rolename.capitalize()} access required',
|
|
http_code=403
|
|
)
|
|
return view_func(*args, **kwargs)
|
|
return wrapper
|
|
return decorator
|