fixes + guest

app/auth.py

@@ -125,7 +125,7 @@ def find_or_create_oauth_user(username: str, display_name: str, email: str) -> d
                 created_at,
                 updated_at
             )
-            VALUES (?, ?, ?, '', 'developer', 1, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+            VALUES (?, ?, ?, '', 'guest', 1, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
             """,
             (username, display_name, email),
         )
@@ -196,7 +196,9 @@ def find_or_create_google_user(email: str, display_name: str, provider_subject:
         created = False
         user_id = row["id"]
     else:
-        role = "admin" if con.execute("SELECT COUNT(*) AS count FROM users").fetchone()["count"] == 0 else "viewer"
+        # První účet v prázdné tabulce je admin (bootstrap), každý další nový účet je guest –
+        # bez přístupu, dokud mu admin nepřidělí vyšší roli.
+        role = "admin" if con.execute("SELECT COUNT(*) AS count FROM users").fetchone()["count"] == 0 else "guest"
         insert_columns = [
             "username",
             "display_name",
@@ -292,6 +294,12 @@ def current_user(request: Request) -> dict[str, Any] | None:
 def require_user(request: Request) -> dict[str, Any]:
     user = current_user(request)
     if user:
+        # Guest nemá přístup nikam – přesměruj ho na stránku s výzvou o přidělení práv.
+        if is_guest(user):
+            raise HTTPException(
+                status_code=status.HTTP_303_SEE_OTHER,
+                headers={"Location": "/portal/guest"},
+            )
         return user
 
     raise HTTPException(
@@ -307,6 +315,11 @@ def require_user(request: Request) -> dict[str, Any]:
 #               variables, resources, metadata). Cannot delete services or access admin areas.
 #   admin     – full access, including deleting services and the Administration / Users area.
 
+def is_guest(user: dict | None) -> bool:
+    """True for the default role assigned to a freshly created account (no access yet)."""
+    return bool(user) and (user.get("role") or "").lower() == "guest"
+
+
 def is_admin(user: dict | None) -> bool:
     return bool(user) and (user.get("role") or "").lower() == "admin"