UI fixes and menu

app/auth.py

@@ -298,3 +298,33 @@ def require_user(request: Request) -> dict[str, Any]:
         status_code=status.HTTP_303_SEE_OTHER,
         headers={"Location": "/portal/login"},
     )
+
+
+# --- Role-based access control ----------------------------------------------
+# Portal roles, from least to most privileged:
+#   viewer    – read-only: sees which services run and their documentation, nothing more.
+#   developer – everything a viewer sees + operational service workflows (Git/clone, deploy,
+#               variables, resources, metadata). Cannot delete services or access admin areas.
+#   admin     – full access, including deleting services and the Administration / Users area.
+
+def is_admin(user: dict | None) -> bool:
+    return bool(user) and (user.get("role") or "").lower() == "admin"
+
+
+def is_developer(user: dict | None) -> bool:
+    """True for developers and admins — the roles allowed to operate on services."""
+    return bool(user) and (user.get("role") or "").lower() in ("admin", "developer")
+
+
+def require_admin(request: Request) -> dict[str, Any]:
+    user = require_user(request)
+    if not is_admin(user):
+        raise HTTPException(status_code=403, detail="Tato akce je dostupná jen administrátorům.")
+    return user
+
+
+def require_developer(request: Request) -> dict[str, Any]:
+    user = require_user(request)
+    if not is_developer(user):
+        raise HTTPException(status_code=403, detail="Tato akce je dostupná jen vývojářům a administrátorům.")
+    return user