Fix /settings redirect issue and add OAuth admin support
- Convert require_admin_access to proper decorator pattern - Fix redirect loop that was sending all users to / - Add is_admin flag handling for OAuth users (checks groups) - Update SETTING_METADATA with all 102 settings from config.py - Improve API admin check with type hints Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
This commit is contained in:
+18
-11
@@ -3,6 +3,8 @@ Settings management views for the application.
|
||||
"""
|
||||
|
||||
import logging
|
||||
import inspect
|
||||
from functools import wraps
|
||||
from fastapi import Request, Depends, HTTPException, status
|
||||
from fastapi.responses import RedirectResponse
|
||||
from sqlalchemy.orm import Session
|
||||
@@ -15,25 +17,30 @@ logger = logging.getLogger(__name__)
|
||||
router = APIRouter()
|
||||
|
||||
|
||||
def require_admin_access(request: Request):
|
||||
"""Check if user is admin and redirect if not"""
|
||||
user = request.session.get("user")
|
||||
if not user or not user.get("is_admin"):
|
||||
logger.warning(f"Non-admin user attempted to access settings page")
|
||||
return RedirectResponse(url="/", status_code=status.HTTP_302_FOUND)
|
||||
return None
|
||||
def require_admin_access(func):
|
||||
"""Decorator to require admin access for a route"""
|
||||
@wraps(func)
|
||||
async def wrapper(request: Request, *args, **kwargs):
|
||||
user = request.session.get("user")
|
||||
if not user or not user.get("is_admin"):
|
||||
logger.warning(f"Non-admin user attempted to access settings page")
|
||||
return RedirectResponse(url="/", status_code=status.HTTP_302_FOUND)
|
||||
|
||||
# Check if the wrapped function is a coroutine function
|
||||
if inspect.iscoroutinefunction(func):
|
||||
return await func(request, *args, **kwargs)
|
||||
else:
|
||||
return func(request, *args, **kwargs)
|
||||
return wrapper
|
||||
|
||||
|
||||
@router.get("/settings")
|
||||
@require_login
|
||||
@require_admin_access
|
||||
async def settings_page(request: Request, db: Session = Depends(get_db)):
|
||||
"""
|
||||
Settings management page - admin only.
|
||||
"""
|
||||
# Check admin access
|
||||
redirect = require_admin_access(request)
|
||||
if redirect:
|
||||
return redirect
|
||||
|
||||
try:
|
||||
# Get settings organized by category
|
||||
|
||||
Reference in New Issue
Block a user