sprava uzivatelu

2026-06-10 07:56:02 +02:00
parent 7dffff17c7
commit 9cec3d001f
7 changed files with 391 additions and 13 deletions
@@ -0,0 +1,186 @@
+import html
+from urllib.parse import quote
+
+from fastapi import APIRouter, Depends, Form, HTTPException, Request
+from fastapi.responses import HTMLResponse, RedirectResponse
+
+from app.auth import require_user
+from app.db.audit import log_audit_event
+from app.db.users import ROLES, count_enabled_admins, get_user, list_users, set_user_enabled, update_user_role
+from app.templates.layout import page
+
+router = APIRouter()
+
+
+def require_admin(user: dict) -> None:
+    if (user.get("role") or "").lower() != "admin":
+        raise HTTPException(status_code=403, detail="Only admins can manage users")
+
+
+def render_role_options(selected: str) -> str:
+    options = []
+    for role in ROLES:
+        selected_attr = " selected" if selected == role else ""
+        options.append(f'<option value="{role}"{selected_attr}>{role}</option>')
+    return "".join(options)
+
+
+def render_enabled_pill(enabled) -> str:
+    if enabled:
+        return '<span class="pill pill-success">enabled</span>'
+    return '<span class="pill pill-muted">disabled</span>'
+
+
+@router.get("/admin/users", response_class=HTMLResponse)
+def users_page(request: Request, message: str = "", error: str = "", user=Depends(require_user)):
+    require_admin(user)
+
+    notice = ""
+    if message:
+        notice = f'<p class="alert">{html.escape(message)}</p>'
+    if error:
+        notice = f'<p class="alert alert-danger">{html.escape(error)}</p>'
+
+    rows = ""
+    for managed_user in list_users():
+        user_id = int(managed_user.get("id"))
+        user_id_html = html.escape(str(user_id))
+        username = html.escape(managed_user.get("username", "") or "")
+        display_name = html.escape(managed_user.get("display_name", "") or "")
+        email = html.escape(managed_user.get("email", "") or "")
+        role = html.escape(managed_user.get("role", "") or "")
+        created_at = html.escape(managed_user.get("created_at", "") or "")
+        last_login_at = html.escape(managed_user.get("last_login_at", "") or "")
+        enabled = bool(managed_user.get("is_enabled", True))
+        toggle_label = "Disable" if enabled else "Enable"
+        toggle_action = "disable" if enabled else "enable"
+
+        rows += f"""
+        <tr>
+            <td>{user_id_html}</td>
+            <td><strong>{username}</strong></td>
+            <td>{display_name}</td>
+            <td>{email}</td>
+            <td>
+                <form method="post" action="/portal/admin/users/{user_id_html}/role" class="inline-form">
+                    <select name="role">{render_role_options(role)}</select>
+                    <button type="submit" class="btn-secondary">Save</button>
+                </form>
+            </td>
+            <td>{render_enabled_pill(enabled)}</td>
+            <td>{created_at}</td>
+            <td>{last_login_at}</td>
+            <td class="actions-cell">
+                <form method="post" action="/portal/admin/users/{user_id_html}/{toggle_action}" class="inline-form">
+                    <button type="submit" class="btn-secondary">{toggle_label}</button>
+                </form>
+            </td>
+        </tr>
+        """
+
+    if not rows:
+        rows = '<tr><td colspan="9">No users found.</td></tr>'
+
+    return page(
+        "Users",
+        f"""
+        <div class="card">
+            <h2>Users</h2>
+            <p class="muted">Administration of portal users and roles.</p>
+            {notice}
+        </div>
+
+        <div class="card">
+            <h2>User List</h2>
+            <table>
+                <tr>
+                    <th>ID</th>
+                    <th>Username</th>
+                    <th>Display name</th>
+                    <th>Email</th>
+                    <th>Role</th>
+                    <th>Status</th>
+                    <th>Created</th>
+                    <th>Last login</th>
+                    <th>Actions</th>
+                </tr>
+                {rows}
+            </table>
+        </div>
+        """,
+        user=user,
+    )
+
+
+@router.post("/admin/users/{user_id}/role")
+def update_role_action(user_id: int, role: str = Form(...), user=Depends(require_user)):
+    require_admin(user)
+    target = get_user(user_id)
+    if not target:
+        raise HTTPException(status_code=404, detail="User not found")
+    if role not in ROLES:
+        raise HTTPException(status_code=400, detail="Invalid role")
+
+    old_role = (target.get("role") or "").lower()
+    if old_role == "admin" and role != "admin" and count_enabled_admins(excluding_user_id=user_id) == 0:
+        return RedirectResponse(
+            url="/portal/admin/users?error=" + quote("Cannot remove admin role from the last enabled admin."),
+            status_code=303,
+        )
+
+    update_user_role(user_id, role)
+    if old_role != role:
+        log_audit_event(
+            user,
+            action="user.role.updated",
+            target_type="user",
+            target_id=user_id,
+            metadata={
+                "username": target.get("username"),
+                "old_role": old_role,
+                "new_role": role,
+            },
+        )
+
+    return RedirectResponse(url="/portal/admin/users?message=" + quote("User role updated."), status_code=303)
+
+
+@router.post("/admin/users/{user_id}/disable")
+def disable_user_action(user_id: int, user=Depends(require_user)):
+    require_admin(user)
+    target = get_user(user_id)
+    if not target:
+        raise HTTPException(status_code=404, detail="User not found")
+    if (target.get("role") or "").lower() == "admin" and count_enabled_admins(excluding_user_id=user_id) == 0:
+        return RedirectResponse(
+            url="/portal/admin/users?error=" + quote("Cannot disable the last enabled admin."),
+            status_code=303,
+        )
+
+    set_user_enabled(user_id, False)
+    log_audit_event(
+        user,
+        action="user.disabled",
+        target_type="user",
+        target_id=user_id,
+        metadata={"username": target.get("username")},
+    )
+    return RedirectResponse(url="/portal/admin/users?message=" + quote("User disabled."), status_code=303)
+
+
+@router.post("/admin/users/{user_id}/enable")
+def enable_user_action(user_id: int, user=Depends(require_user)):
+    require_admin(user)
+    target = get_user(user_id)
+    if not target:
+        raise HTTPException(status_code=404, detail="User not found")
+
+    set_user_enabled(user_id, True)
+    log_audit_event(
+        user,
+        action="user.enabled",
+        target_type="user",
+        target_id=user_id,
+        metadata={"username": target.get("username")},
+    )
+    return RedirectResponse(url="/portal/admin/users?message=" + quote("User enabled."), status_code=303)