appfactory/appfactory-portal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Změny:

Browse Source 
users migrace má nové sloupce gitea_user_id, gitea_sync_status, gitea_sync_error, gitea_synced_at.
Přidal jsem gitea_provisioning.py, který přes Gitea API vytváří, aktivuje, deaktivuje a synchronizuje účty.
Role viewer Gitea účet nemá; developer a admin účet mají.
Změny role a enable/disable v administraci spouští sync do Gitea.
Admin UI v routes/users.py zobrazuje stav Gitea synchronizace a má ruční Sync Gitea.
Google login po přihlášení dorovnává Gitea stav podle portálového uživatele.
Gitea OAuth login je v portálu vypnutý; endpointy zůstaly, ale vrací hlášku, že se má použít Google.
Lokální login se zobrazuje/povolí jen při explicitním AUTH_MODE=local.
Gitea API token se čte z GITEA_ADMIN_TOKEN, případně fallback GITEA_API_TOKEN nebo GITEA_TOKEN. Podřízené Gitea username je deterministicky portal-{user_id}, portálová tabulka zůstává zdroj pravdy.
Ověření: python -m py_compile prošel pro všechny upravené Python soubory.
This commit is contained in:
JiriUhlir
2026-06-10 09:34:56 +02:00
parent 38edf07ff3
commit b1263edac6
7 changed files with 334 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/routes/users.py
+77 -6
View File
@@ -7,6 +7,7 @@ from fastapi.responses import HTMLResponse, RedirectResponse
from app.auth import require_user
from app.db.audit import log_audit_event
from app.db.users import ROLES, count_enabled_admins, get_user, list_users, set_user_enabled, update_user_role
from app.gitea_provisioning import sync_gitea_user
from app.templates.layout import page
router = APIRouter()
@@ -31,6 +32,17 @@ def render_enabled_pill(enabled) -> str:
return '<span class="pill pill-muted">disabled</span>'
def render_sync_pill(status: str) -> str:
status = (status or "not_required").lower()
if status == "synced":
return '<span class="pill pill-success">synced</span>'
if status == "error":
return '<span class="pill pill-danger">error</span>'
if status == "syncing":
return '<span class="pill pill-muted">syncing</span>'
return '<span class="pill pill-muted">not required</span>'
def render_role_overview() -> str:
role_rows = (
("admin", "Full administration, user management, role changes, disabling/enabling users, and admin-only operations."),
@@ -83,6 +95,15 @@ def users_page(request: Request, message: str = "", error: str = "", user=Depend
created_at = html.escape(managed_user.get("created_at", "") or "")
last_login_at = html.escape(managed_user.get("last_login_at", "") or "")
enabled = bool(managed_user.get("is_enabled", True))
gitea_user_id = managed_user.get("gitea_user_id")
gitea_sync_status = managed_user.get("gitea_sync_status", "not_required") or "not_required"
gitea_sync_error = html.escape(managed_user.get("gitea_sync_error", "") or "")
gitea_synced_at = html.escape(managed_user.get("gitea_synced_at", "") or "")
gitea_details = f"ID {html.escape(str(gitea_user_id))}" if gitea_user_id else "No account"
if gitea_synced_at:
gitea_details += f"<br><small>{gitea_synced_at}</small>"
if gitea_sync_error:
gitea_details += f'<br><small class="text-danger">{gitea_sync_error}</small>'
toggle_label = "Disable" if enabled else "Enable"
toggle_action = "disable" if enabled else "enable"
@@ -101,18 +122,22 @@ def users_page(request: Request, message: str = "", error: str = "", user=Depend
</form>
</td>
<td>{render_enabled_pill(enabled)}</td>
<td>{render_sync_pill(gitea_sync_status)}<br><small>{gitea_details}</small></td>
<td>{created_at}</td>
<td>{last_login_at}</td>
<td class="actions-cell">
<form method="post" action="/portal/admin/users/{user_id_html}/{toggle_action}" class="inline-form">
<button type="submit" class="btn-secondary">{toggle_label}</button>
</form>
<form method="post" action="/portal/admin/users/{user_id_html}/sync-gitea" class="inline-form">
<button type="submit" class="btn-secondary">Sync Gitea</button>
</form>
</td>
</tr>
"""
if not rows:
rows = '<tr><td colspan="11">No users found.</td></tr>'
rows = '<tr><td colspan="12">No users found.</td></tr>'
return page(
"Users",
@@ -135,6 +160,7 @@ def users_page(request: Request, message: str = "", error: str = "", user=Depend
<th>Provider</th>
<th>Role</th>
<th>Status</th>
<th>Gitea sync</th>
<th>Created</th>
<th>Last login</th>
<th>Actions</th>
@@ -165,6 +191,8 @@ def update_role_action(user_id: int, role: str = Form(...), user=Depends(require
)
update_user_role(user_id, role)
target = get_user(user_id) or target
sync_result = sync_gitea_user(target)
if old_role != role:
log_audit_event(
user,
@@ -175,10 +203,16 @@ def update_role_action(user_id: int, role: str = Form(...), user=Depends(require
"username": target.get("username"),
"old_role": old_role,
"new_role": role,
"gitea_sync_status": sync_result.get("status"),
},
)
return RedirectResponse(url="/portal/admin/users?message=" + quote("User role updated."), status_code=303)
if sync_result.get("status") == "error":
return RedirectResponse(
url="/portal/admin/users?error=" + quote(f"User role updated, but Gitea sync failed: {sync_result.get('error')}"),
status_code=303,
)
return RedirectResponse(url="/portal/admin/users?message=" + quote("User role updated and Gitea synchronized."), status_code=303)
@router.post("/admin/users/{user_id}/disable")
@@ -194,14 +228,21 @@ def disable_user_action(user_id: int, user=Depends(require_user)):
)
set_user_enabled(user_id, False)
target = get_user(user_id) or target
sync_result = sync_gitea_user(target)
log_audit_event(
user,
action="user.disabled",
target_type="user",
target_id=user_id,
metadata={"username": target.get("username")},
metadata={"username": target.get("username"), "gitea_sync_status": sync_result.get("status")},
)
return RedirectResponse(url="/portal/admin/users?message=" + quote("User disabled."), status_code=303)
if sync_result.get("status") == "error":
return RedirectResponse(
url="/portal/admin/users?error=" + quote(f"User disabled, but Gitea sync failed: {sync_result.get('error')}"),
status_code=303,
)
return RedirectResponse(url="/portal/admin/users?message=" + quote("User disabled and Gitea synchronized."), status_code=303)
@router.post("/admin/users/{user_id}/enable")
@@ -212,11 +253,41 @@ def enable_user_action(user_id: int, user=Depends(require_user)):
raise HTTPException(status_code=404, detail="User not found")
set_user_enabled(user_id, True)
target = get_user(user_id) or target
sync_result = sync_gitea_user(target)
log_audit_event(
user,
action="user.enabled",
target_type="user",
target_id=user_id,
metadata={"username": target.get("username")},
metadata={"username": target.get("username"), "gitea_sync_status": sync_result.get("status")},
)
return RedirectResponse(url="/portal/admin/users?message=" + quote("User enabled."), status_code=303)
if sync_result.get("status") == "error":
return RedirectResponse(
url="/portal/admin/users?error=" + quote(f"User enabled, but Gitea sync failed: {sync_result.get('error')}"),
status_code=303,
)
return RedirectResponse(url="/portal/admin/users?message=" + quote("User enabled and Gitea synchronized."), status_code=303)
@router.post("/admin/users/{user_id}/sync-gitea")
def sync_gitea_user_action(user_id: int, user=Depends(require_user)):
require_admin(user)
target = get_user(user_id)
if not target:
raise HTTPException(status_code=404, detail="User not found")
sync_result = sync_gitea_user(target)
log_audit_event(
user,
action="user.gitea.synced",
target_type="user",
target_id=user_id,
metadata={"username": target.get("username"), **sync_result},
)
if sync_result.get("status") == "error":
return RedirectResponse(
url="/portal/admin/users?error=" + quote(f"Gitea sync failed: {sync_result.get('error')}"),
status_code=303,
)
return RedirectResponse(url="/portal/admin/users?message=" + quote("Gitea synchronized."), status_code=303)