71ba0b95a5
Phase B addresses 7 high-severity gaps from the permissions audit: - B1: Enforce tree access check on session start via can_access_tree - B2: Replace all inline permission helpers with centralized permissions.py - B3: Fix require_engineer_or_admin to check is_team_admin before role - B4: Add is_active field on User with enforcement in get_current_active_user - B5: Add admin user management endpoints (list, get, role, team-admin, deactivate, activate) - B6: Add rate limiting on auth/invite endpoints via slowapi (disabled in DEBUG) - B7: Implement refresh token rotation with JTI-based revocation and meaningful logout Also reduces access token TTL from 15 to 5 minutes and updates CLAUDE.md with SaaS/MSP context for future planning sessions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
47 lines
1.1 KiB
Python
47 lines
1.1 KiB
Python
from datetime import datetime
|
|
from typing import Literal, Optional
|
|
from uuid import UUID
|
|
from pydantic import BaseModel, EmailStr, Field
|
|
|
|
|
|
class UserBase(BaseModel):
|
|
email: EmailStr
|
|
name: str = Field(..., min_length=1, max_length=255)
|
|
|
|
|
|
class UserCreate(UserBase):
|
|
password: str = Field(..., min_length=10, description="Password must be at least 10 characters")
|
|
invite_code: Optional[str] = Field(None, description="Invite code for registration (required when invite system is enabled)")
|
|
|
|
|
|
class UserUpdate(BaseModel):
|
|
name: Optional[str] = Field(None, min_length=1, max_length=255)
|
|
email: Optional[EmailStr] = None
|
|
|
|
|
|
class UserLogin(BaseModel):
|
|
email: EmailStr
|
|
password: str
|
|
|
|
|
|
class UserResponse(UserBase):
|
|
id: UUID
|
|
role: str
|
|
is_super_admin: bool = False
|
|
is_team_admin: bool = False
|
|
is_active: bool = True
|
|
team_id: Optional[UUID] = None
|
|
created_at: datetime
|
|
last_login: Optional[datetime] = None
|
|
|
|
class Config:
|
|
from_attributes = True
|
|
|
|
|
|
class RoleUpdate(BaseModel):
|
|
role: Literal["engineer", "viewer"]
|
|
|
|
|
|
class TeamAdminUpdate(BaseModel):
|
|
is_team_admin: bool
|