34daa26a67
Add role-based access control with hierarchy: super_admin > team_admin > engineer > viewer. Adds is_super_admin boolean to User model (migration 010), centralized backend permissions module, frontend usePermissions hook, and UI enforcement (conditional Create/Edit buttons, editor redirect for viewers, role badge in header). All endpoint admin checks updated from role=="admin" to is_super_admin. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
39 lines
1.0 KiB
Python
39 lines
1.0 KiB
Python
from datetime import datetime
|
|
from typing import Optional
|
|
from uuid import UUID
|
|
from pydantic import BaseModel, EmailStr, Field
|
|
|
|
|
|
class UserBase(BaseModel):
|
|
email: EmailStr
|
|
name: str = Field(..., min_length=1, max_length=255)
|
|
|
|
|
|
class UserCreate(UserBase):
|
|
password: str = Field(..., min_length=10, description="Password must be at least 10 characters")
|
|
role: str = Field(default="engineer", description="User role: engineer or viewer")
|
|
invite_code: Optional[str] = Field(None, description="Invite code for registration (required when invite system is enabled)")
|
|
|
|
|
|
class UserUpdate(BaseModel):
|
|
name: Optional[str] = Field(None, min_length=1, max_length=255)
|
|
email: Optional[EmailStr] = None
|
|
|
|
|
|
class UserLogin(BaseModel):
|
|
email: EmailStr
|
|
password: str
|
|
|
|
|
|
class UserResponse(UserBase):
|
|
id: UUID
|
|
role: str
|
|
is_super_admin: bool = False
|
|
is_team_admin: bool = False
|
|
team_id: Optional[UUID] = None
|
|
created_at: datetime
|
|
last_login: Optional[datetime] = None
|
|
|
|
class Config:
|
|
from_attributes = True
|