34daa26a67
Add role-based access control with hierarchy: super_admin > team_admin > engineer > viewer. Adds is_super_admin boolean to User model (migration 010), centralized backend permissions module, frontend usePermissions hook, and UI enforcement (conditional Create/Edit buttons, editor redirect for viewers, role badge in header). All endpoint admin checks updated from role=="admin" to is_super_admin. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
34 lines
962 B
Python
34 lines
962 B
Python
"""add is_super_admin to users
|
|
|
|
Revision ID: 010
|
|
Revises: 009
|
|
Create Date: 2026-02-05
|
|
|
|
"""
|
|
from typing import Sequence, Union
|
|
|
|
from alembic import op
|
|
import sqlalchemy as sa
|
|
|
|
|
|
# revision identifiers, used by Alembic.
|
|
revision: str = '010'
|
|
down_revision: Union[str, None] = '009'
|
|
branch_labels: Union[str, Sequence[str], None] = None
|
|
depends_on: Union[str, Sequence[str], None] = None
|
|
|
|
|
|
def upgrade() -> None:
|
|
# Add is_super_admin flag
|
|
op.add_column('users',
|
|
sa.Column('is_super_admin', sa.Boolean(), nullable=False, server_default=sa.text('false'))
|
|
)
|
|
# Migrate existing admin users: promote to super admin AND normalize role
|
|
op.execute("UPDATE users SET is_super_admin = TRUE, role = 'engineer' WHERE role = 'admin'")
|
|
|
|
|
|
def downgrade() -> None:
|
|
# Restore admin role for super admins before dropping column
|
|
op.execute("UPDATE users SET role = 'admin' WHERE is_super_admin = TRUE")
|
|
op.drop_column('users', 'is_super_admin')
|