feat(roles): add dedicated Supervisor (capoturno) role

Until now the out-of-tolerance authorization ("Autorizzazione capoturno")
required is_admin, conflating shift-leader authority with full system
administration. Introduce a combinable Supervisor role so a capoturno can
authorize overrides without admin privileges (roadmap D-0.8 / Phase 2).

Backend:
- users router: add "Supervisor" to the allowed roles (centralized as
  VALID_ROLES, deduplicating the create/update validation).
- middleware: add require_supervisor dependency (admins still bypass).

Frontend:
- measure.validate_supervisor: authorize users with the Supervisor role OR
  is_admin (was is_admin only).
- admin/users: Supervisor checkbox + orange role badge.
- profile: explicit Supervisor badge styling.
- EN translation for the new role label.

roles is a free JSON column, so no migration is required.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

This commit is contained in:

Adriano Dal Pastro

2026-06-05 09:02:24 +00:00

parent bff577b461

commit 6ff78b2150

7 changed files with 25 additions and 8 deletions

									
										src/backend/api/middleware/api_key.py
									
		+1
		
												View File
												
				@@ -68,4 +68,5 @@ def require_admin():

				require_maker = require_role("Maker")

				require_measurement_tec = require_role("MeasurementTec")

				require_metrologist = require_role("Metrologist")

				require_supervisor = require_role("Supervisor")

				require_admin_user = require_admin()