71ba0b95a5
Phase B addresses 7 high-severity gaps from the permissions audit: - B1: Enforce tree access check on session start via can_access_tree - B2: Replace all inline permission helpers with centralized permissions.py - B3: Fix require_engineer_or_admin to check is_team_admin before role - B4: Add is_active field on User with enforcement in get_current_active_user - B5: Add admin user management endpoints (list, get, role, team-admin, deactivate, activate) - B6: Add rate limiting on auth/invite endpoints via slowapi (disabled in DEBUG) - B7: Implement refresh token rotation with JTI-based revocation and meaningful logout Also reduces access token TTL from 15 to 5 minutes and updates CLAUDE.md with SaaS/MSP context for future planning sessions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
16 lines
594 B
Python
16 lines
594 B
Python
from fastapi import APIRouter
|
|
from app.api.endpoints import auth, trees, sessions, invite, categories, tags, folders, step_categories, steps, admin
|
|
|
|
api_router = APIRouter()
|
|
|
|
api_router.include_router(auth.router)
|
|
api_router.include_router(trees.router)
|
|
api_router.include_router(sessions.router)
|
|
api_router.include_router(invite.router)
|
|
api_router.include_router(categories.router)
|
|
api_router.include_router(tags.router)
|
|
api_router.include_router(folders.router)
|
|
api_router.include_router(step_categories.router)
|
|
api_router.include_router(steps.router)
|
|
api_router.include_router(admin.router)
|