Private
Public Access
ksmithandClaude Sonnet 5
4aa8ef89c5
Adds is_site_admin-gated site administration: user management (list, deactivate/reactivate, reset password, promote/demote), room management (list all rooms including private ones, archive/unarchive, force-transfer ownership), and an audit log of every admin action. Backend: User.is_active (deactivation) and Room.is_archived (archive) are new columns; AdminAuditLog is a new table matching ARCHITECTURE.md's admin_audit_log design, written to in the same transaction as every mutating admin action. require_site_admin (dependencies.py) gates all /api/admin/* routes. get_current_user now rechecks is_active on every request, so deactivating a user kills their already-open session immediately, not just future logins. An admin can't deactivate or demote their own account (the one self-lockout guard included). Archived rooms drop out of the open-room browse list but stay readable for existing members. Frontend: new /admin route (AdminRoute guard, redirects non-admins to /rooms) with a tabbed Users / Rooms / Audit log / Settings page, plus an "Admin" link in the account menu for site admins. Bot/integration management and system settings -- both listed in the original issue -- are intentionally not here: bot management has nothing to manage until Phase 7 builds the actual bot data model, and there's no settings storage or concrete setting to configure yet. Settings has an empty placeholder tab; bot management is deferred entirely to Phase 7. Confirmed this scope cut with the repo owner before implementing. New tests/test_admin.py (14 tests, full suite now 58/58) covers every admin endpoint's permission gate, the self-action guards, deactivation's immediate effect on an already-open session, and that every mutating action produces exactly one audit log row. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
49 lines
984 B
Python
49 lines
984 B
Python
import uuid
|
|
from datetime import datetime
|
|
|
|
from pydantic import BaseModel, ConfigDict, EmailStr, Field
|
|
|
|
|
|
class AdminUserRead(BaseModel):
|
|
model_config = ConfigDict(from_attributes=True)
|
|
|
|
id: uuid.UUID
|
|
username: str
|
|
email: EmailStr
|
|
is_bot: bool
|
|
is_site_admin: bool
|
|
is_active: bool
|
|
created_at: datetime
|
|
|
|
|
|
class AdminRoomRead(BaseModel):
|
|
model_config = ConfigDict(from_attributes=True)
|
|
|
|
id: uuid.UUID
|
|
name: str
|
|
description: str | None
|
|
is_private: bool
|
|
is_archived: bool
|
|
owner_id: uuid.UUID
|
|
created_at: datetime
|
|
member_count: int
|
|
|
|
|
|
class AuditLogEntryRead(BaseModel):
|
|
id: uuid.UUID
|
|
actor_id: uuid.UUID
|
|
actor_username: str
|
|
action: str
|
|
target_type: str
|
|
target_id: uuid.UUID
|
|
metadata: dict | None
|
|
created_at: datetime
|
|
|
|
|
|
class ResetPasswordRequest(BaseModel):
|
|
new_password: str = Field(min_length=8, max_length=200)
|
|
|
|
|
|
class TransferOwnershipRequest(BaseModel):
|
|
new_owner_id: uuid.UUID
|