e41ecfad4c
Include Loyalty/Communication/Sports Center backends and registry updates alongside production nginx and compose wiring. Co-authored-by: Cursor <cursoragent@cursor.com>
41 lines
1.3 KiB
Python
41 lines
1.3 KiB
Python
"""Permission enforcement helpers for Communication APIs."""
|
|
from __future__ import annotations
|
|
|
|
from collections.abc import Callable
|
|
|
|
from fastapi import Depends
|
|
|
|
from app.core.config import settings
|
|
from app.core.security import get_current_user
|
|
from shared.exceptions import ForbiddenError
|
|
from shared.security import CurrentUser
|
|
|
|
_ADMIN_ROLES = frozenset({"platform_admin", "tenant_owner", "tenant_admin"})
|
|
|
|
|
|
def user_has_permission(user: CurrentUser, permission: str) -> bool:
|
|
if any(role in _ADMIN_ROLES for role in user.roles):
|
|
return True
|
|
if "communication.manage" in user.roles:
|
|
return True
|
|
return permission in user.roles
|
|
|
|
|
|
def require_permissions(*permissions: str) -> Callable:
|
|
"""Deny unless AUTH is off, user is admin, or any listed permission is present."""
|
|
|
|
async def _dependency(
|
|
user: CurrentUser = Depends(get_current_user),
|
|
) -> CurrentUser:
|
|
if not settings.auth_required:
|
|
return user
|
|
if any(user_has_permission(user, perm) for perm in permissions):
|
|
return user
|
|
raise ForbiddenError(
|
|
"دسترسی مجاز نیست",
|
|
error_code="permission_denied",
|
|
details={"required": list(permissions)},
|
|
)
|
|
|
|
return _dependency
|