Merge lavoro/daitarn-trafilo-monitor

src/backend/api/routers/production.py

@@ -20,7 +20,8 @@ from src.backend.models.api.production import (
 )
 from src.backend.models.orm.production import ProductionRun
 from src.backend.models.orm.user import User
-from src.backend.services import auth_service, production_service
+from src.backend.models.api.monitor import MonitorRun
+from src.backend.services import auth_service, monitor_service, production_service
 
 router = APIRouter(prefix="/api/production-runs", tags=["production"])
 
@@ -81,6 +82,27 @@ async def get_current_production_run(
     return await _as_response(db, run) if run is not None else None
 
 
+async def _require_high_authority(user: User = Depends(get_current_user)) -> User:
+    """Monitor of all stations (#57): admin or Supervisor (capoturno) only."""
+    if user.is_admin or user.has_role("Supervisor"):
+        return user
+    raise HTTPException(
+        status_code=status.HTTP_403_FORBIDDEN, detail="Supervisor role required",
+    )
+
+
+@router.get("/open", response_model=list[MonitorRun])
+async def list_open_production_runs(
+    user: User = Depends(_require_high_authority),
+    db: AsyncSession = Depends(get_db),
+):
+    """Every open run with timer, last event and recent measurements (#57).
+
+    Declared before /{run_id} so "open" is not parsed as a run id.
+    """
+    return await monitor_service.list_open_runs(db)
+
+
 @router.get("/{run_id}", response_model=ProductionRunWithEventsResponse)
 async def get_production_run(
     run_id: int,