36 lines
1.5 KiB
Python
36 lines
1.5 KiB
Python
# retoor <retoor@molodetz.nl>
|
|
from fastapi import APIRouter, HTTPException, Request
|
|
|
|
from molodetz.database import get_user, list_users, set_role
|
|
from molodetz.dependencies import json_or_form
|
|
from molodetz.models import RoleForm
|
|
from molodetz.responses import action_result, respond
|
|
from molodetz.routers.admin._shared import admin_seo
|
|
from molodetz.schemas.admin import AdminUsersOut
|
|
from molodetz.utils.audit import record
|
|
from molodetz.utils.auth import invalidate_user_cache, is_senior_admin, not_found, require_admin
|
|
|
|
router = APIRouter()
|
|
|
|
|
|
@router.get("/users")
|
|
async def users_index(request: Request):
|
|
require_admin(request)
|
|
return respond(request, "admin/users.html", {"users": list_users(), "seo": admin_seo(request, "Accounts")}, model=AdminUsersOut)
|
|
|
|
|
|
@router.post("/users/{uid}/role")
|
|
async def users_role(request: Request, uid: str):
|
|
actor = require_admin(request)
|
|
target = get_user(uid)
|
|
if target is None:
|
|
not_found("Account not found")
|
|
data = await json_or_form(request, RoleForm)
|
|
if is_senior_admin(actor, target) or (target["uid"] == actor["uid"] and data.role != "Admin"):
|
|
record(request, "admin.user.role", result="denied", targets=[("user", uid)], user=actor)
|
|
raise HTTPException(403, "You cannot manage a more senior administrator")
|
|
set_role(uid, data.role)
|
|
invalidate_user_cache(propagate=True)
|
|
record(request, "admin.user.role", payload={"role": data.role}, targets=[("user", uid)], user=actor)
|
|
return action_result(request, "/admin/users", data={"uid": uid, "role": data.role})
|