Adriano Dal Pastro
6ff78b2150
Until now the out-of-tolerance authorization ("Autorizzazione capoturno")
required is_admin, conflating shift-leader authority with full system
administration. Introduce a combinable Supervisor role so a capoturno can
authorize overrides without admin privileges (roadmap D-0.8 / Phase 2).
Backend:
- users router: add "Supervisor" to the allowed roles (centralized as
VALID_ROLES, deduplicating the create/update validation).
- middleware: add require_supervisor dependency (admins still bypass).
Frontend:
- measure.validate_supervisor: authorize users with the Supervisor role OR
is_admin (was is_admin only).
- admin/users: Supervisor checkbox + orange role badge.
- profile: explicit Supervisor badge styling.
- EN translation for the new role label.
roles is a free JSON column, so no migration is required.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
29 lines
793 B
Python
29 lines
793 B
Python
"""FastAPI middleware for TieMeasureFlow."""
|
|
from src.backend.api.middleware.api_key import (
|
|
get_current_user,
|
|
require_role,
|
|
require_admin,
|
|
require_maker,
|
|
require_measurement_tec,
|
|
require_metrologist,
|
|
require_supervisor,
|
|
require_admin_user,
|
|
)
|
|
from src.backend.api.middleware.logging import AccessLogMiddleware
|
|
from src.backend.api.middleware.rate_limit import RateLimitMiddleware
|
|
from src.backend.api.middleware.security_headers import SecurityHeadersMiddleware
|
|
|
|
__all__ = [
|
|
"get_current_user",
|
|
"require_role",
|
|
"require_admin",
|
|
"require_maker",
|
|
"require_measurement_tec",
|
|
"require_metrologist",
|
|
"require_supervisor",
|
|
"require_admin_user",
|
|
"AccessLogMiddleware",
|
|
"RateLimitMiddleware",
|
|
"SecurityHeadersMiddleware",
|
|
]
|