curo1305
456681fdfa
Backend: - schemas/user.py: is_admin (validation_alias=is_superuser) on UserOut and UserAdminOut; UserAdminCreate extends UserCreate with is_admin flag - deps.py: get_current_admin dependency — 403 for non-superusers - routers/admin.py: GET/POST /api/admin/users, DELETE and PATCH /active per user; self-delete and self-deactivate blocked - main.py: register /api/admin router - scripts/seed.py: seed test user with is_superuser=True; promotes existing user if already created without the flag Frontend: - api/client.ts: UserData type with is_admin, admin API functions - components/Nav.tsx: Admin link visible only when user.is_admin is true - pages/AdminPage.tsx: user table with add-user form, delete, toggle active - App.tsx: AdminRoute guard (403-redirects non-admins to /); /admin route Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
99 lines
3.2 KiB
Python
99 lines
3.2 KiB
Python
import re
|
|
|
|
from pydantic import BaseModel, EmailStr, Field, field_validator
|
|
|
|
from app.core.sanitize import normalize_email, sanitize_str
|
|
|
|
# Common words that must not appear as whole words inside a password.
|
|
# Checked case-insensitively with word boundaries.
|
|
_FORBIDDEN_WORDS = {
|
|
"password", "passwort", "secret", "welcome", "admin", "administrator",
|
|
"login", "user", "test", "guest", "master", "dragon", "monkey", "shadow",
|
|
"sunshine", "princess", "letmein", "football", "baseball", "soccer",
|
|
"hockey", "abc", "qwerty", "keyboard", "computer", "internet", "access",
|
|
"hello", "summer", "winter", "spring", "autumn", "flower", "mustang",
|
|
"batman", "superman", "donald", "michael", "jessica", "charlie",
|
|
}
|
|
|
|
|
|
def _validate_password(v: str) -> str:
|
|
errors = []
|
|
|
|
if len(v) < 8:
|
|
errors.append("at least 8 characters")
|
|
if not re.search(r"[A-Z]", v):
|
|
errors.append("at least one uppercase letter")
|
|
if not re.search(r"[a-z]", v):
|
|
errors.append("at least one lowercase letter")
|
|
if not re.search(r"\d", v):
|
|
errors.append("at least one digit")
|
|
if not re.search(r'[!@#$%^&*()\-_=+\[\]{};:\'",.<>?/\\|`~]', v):
|
|
errors.append("at least one special character")
|
|
|
|
lower = v.lower()
|
|
for word in _FORBIDDEN_WORDS:
|
|
# Match the word as a standalone token (surrounded by non-alpha or string boundary)
|
|
if re.search(rf"(?<![a-z]){re.escape(word)}(?![a-z])", lower):
|
|
errors.append(f'must not contain the word "{word}"')
|
|
break
|
|
|
|
if errors:
|
|
raise ValueError("; ".join(errors))
|
|
return v
|
|
|
|
|
|
class UserCreate(BaseModel):
|
|
email: EmailStr
|
|
password: str
|
|
full_name: str | None = None
|
|
|
|
@field_validator("email", mode="before")
|
|
@classmethod
|
|
def normalize_email_field(cls, v: str) -> str:
|
|
return normalize_email(v)
|
|
|
|
@field_validator("full_name", mode="before")
|
|
@classmethod
|
|
def sanitize_full_name(cls, v: str | None) -> str | None:
|
|
return sanitize_str(v, max_len=128)
|
|
|
|
@field_validator("password")
|
|
@classmethod
|
|
def password_strength(cls, v: str) -> str:
|
|
return _validate_password(v)
|
|
|
|
|
|
class UserOut(BaseModel):
|
|
id: str
|
|
email: str
|
|
full_name: str | None
|
|
is_active: bool
|
|
# validation_alias reads is_superuser from the ORM object; the JSON key
|
|
# in the response is the field name "is_admin" (not the alias).
|
|
is_admin: bool = Field(validation_alias="is_superuser", default=False)
|
|
|
|
model_config = {"from_attributes": True, "populate_by_name": True}
|
|
|
|
|
|
# ── Admin-facing schemas ───────────────────────────────────────────────────────
|
|
|
|
class UserAdminOut(BaseModel):
|
|
"""Full user record returned to admin endpoints."""
|
|
id: str
|
|
email: str
|
|
full_name: str | None
|
|
is_active: bool
|
|
is_admin: bool = Field(validation_alias="is_superuser", default=False)
|
|
|
|
model_config = {"from_attributes": True, "populate_by_name": True}
|
|
|
|
|
|
class UserAdminCreate(UserCreate):
|
|
"""Admin creates a user and can optionally grant admin rights."""
|
|
is_admin: bool = False
|
|
|
|
|
|
class Token(BaseModel):
|
|
access_token: str
|
|
token_type: str = "bearer"
|