Lade ...
;
+ if (!isAuthenticated) return
+
+
+ );
+}
diff --git a/dashboard/src/logout.tsx b/dashboard/src/logout.tsx
index 2aecbe1..6c8b7b7 100644
--- a/dashboard/src/logout.tsx
+++ b/dashboard/src/logout.tsx
@@ -1,12 +1,41 @@
-import React from 'react';
+import React, { useEffect, useState } from 'react';
+import { useNavigate } from 'react-router-dom';
+import { useAuth } from './useAuth';
-const Logout: React.FC = () => (
-
-
-
+
);
diff --git a/dashboard/src/einstellungen.tsx b/dashboard/src/settings.tsx
similarity index 100%
rename from dashboard/src/einstellungen.tsx
rename to dashboard/src/settings.tsx
diff --git a/dashboard/src/useAuth.tsx b/dashboard/src/useAuth.tsx
new file mode 100644
index 0000000..cbadb45
--- /dev/null
+++ b/dashboard/src/useAuth.tsx
@@ -0,0 +1,145 @@
+/**
+ * Auth context and hook for managing current user state.
+ *
+ * Provides a React context and custom hook to access and manage
+ * the current authenticated user throughout the application.
+ */
+
+import { createContext, useContext, useState, useEffect } from 'react';
+import type { ReactNode } from 'react';
+import { fetchCurrentUser, login as apiLogin, logout as apiLogout } from './apiAuth';
+import type { User } from './apiAuth';
+
+interface AuthContextType {
+ user: User | null;
+ loading: boolean;
+ error: string | null;
+ login: (username: string, password: string) => Promise;
+ logout: () => Promise;
+ refreshUser: () => Promise;
+ isAuthenticated: boolean;
+}
+
+const AuthContext = createContext(undefined);
+
+interface AuthProviderProps {
+ children: ReactNode;
+}
+
+/**
+ * Auth provider component to wrap the application.
+ *
+ * Usage:
+ *
+ *
+ */
+export function AuthProvider({ children }: AuthProviderProps) {
+ const [user, setUser] = useState(null);
+ const [loading, setLoading] = useState(true);
+ const [error, setError] = useState(null);
+
+ // Fetch current user on mount
+ useEffect(() => {
+ refreshUser();
+ }, []);
+
+ const refreshUser = async () => {
+ try {
+ setLoading(true);
+ setError(null);
+ const currentUser = await fetchCurrentUser();
+ setUser(currentUser);
+ } catch (err) {
+ // Not authenticated or error - this is okay
+ setUser(null);
+ // Only set error if it's not a 401 (not authenticated is expected)
+ if (err instanceof Error && !err.message.includes('Not authenticated')) {
+ setError(err.message);
+ }
+ } finally {
+ setLoading(false);
+ }
+ };
+
+ const login = async (username: string, password: string) => {
+ try {
+ setLoading(true);
+ setError(null);
+ const response = await apiLogin(username, password);
+ setUser(response.user as User);
+ } catch (err) {
+ const errorMessage = err instanceof Error ? err.message : 'Login failed';
+ setError(errorMessage);
+ throw err; // Re-throw so the caller can handle it
+ } finally {
+ setLoading(false);
+ }
+ };
+
+ const logout = async () => {
+ try {
+ setLoading(true);
+ setError(null);
+ await apiLogout();
+ setUser(null);
+ } catch (err) {
+ const errorMessage = err instanceof Error ? err.message : 'Logout failed';
+ setError(errorMessage);
+ throw err;
+ } finally {
+ setLoading(false);
+ }
+ };
+
+ const value: AuthContextType = {
+ user,
+ loading,
+ error,
+ login,
+ logout,
+ refreshUser,
+ isAuthenticated: user !== null,
+ };
+
+ return {children} ;
+}
+
+/**
+ * Custom hook to access auth context.
+ *
+ * Usage:
+ * const { user, login, logout, isAuthenticated } = useAuth();
+ *
+ * @returns AuthContextType
+ * @throws Error if used outside AuthProvider
+ */
+export function useAuth(): AuthContextType {
+ const context = useContext(AuthContext);
+ if (context === undefined) {
+ throw new Error('useAuth must be used within an AuthProvider');
+ }
+ return context;
+}
+
+/**
+ * Convenience hook to get just the current user.
+ *
+ * Usage:
+ * const user = useCurrentUser();
+ */
+export function useCurrentUser(): User | null {
+ const { user } = useAuth();
+ return user;
+}
+
+/**
+ * Convenience hook to check if user is authenticated.
+ *
+ * Usage:
+ * const isAuthenticated = useIsAuthenticated();
+ */
+export function useIsAuthenticated(): boolean {
+ const { isAuthenticated } = useAuth();
+ return isAuthenticated;
+}
diff --git a/dashboard/vite.config.ts b/dashboard/vite.config.ts
index 6d59980..34d4a56 100644
--- a/dashboard/vite.config.ts
+++ b/dashboard/vite.config.ts
@@ -19,9 +19,11 @@ export default defineConfig({
include: [
'@syncfusion/ej2-react-navigations',
'@syncfusion/ej2-react-buttons',
+ '@syncfusion/ej2-react-splitbuttons',
'@syncfusion/ej2-base',
'@syncfusion/ej2-navigations',
'@syncfusion/ej2-buttons',
+ '@syncfusion/ej2-splitbuttons',
'@syncfusion/ej2-react-base',
],
// 🔧 NEU: Force dependency re-optimization
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index e208541..6485637 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -75,9 +75,12 @@ services:
DB_ROOT_PASSWORD: ${DB_ROOT_PASSWORD}
DB_HOST: db
FLASK_ENV: production
+ FLASK_SECRET_KEY: ${FLASK_SECRET_KEY}
MQTT_BROKER_URL: mqtt://mqtt:1883
MQTT_USER: ${MQTT_USER}
MQTT_PASSWORD: ${MQTT_PASSWORD}
+ DEFAULT_SUPERADMIN_USERNAME: ${DEFAULT_SUPERADMIN_USERNAME:-superadmin}
+ DEFAULT_SUPERADMIN_PASSWORD: ${DEFAULT_SUPERADMIN_PASSWORD}
networks:
- infoscreen-net
healthcheck:
diff --git a/docker-compose.yml b/docker-compose.yml
index 565e7f4..0f84030 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -18,6 +18,10 @@ services:
environment:
- DB_CONN=mysql+pymysql://${DB_USER}:${DB_PASSWORD}@db/${DB_NAME}
- DB_URL=mysql+pymysql://${DB_USER}:${DB_PASSWORD}@db/${DB_NAME}
+ - ENV=${ENV:-development}
+ - FLASK_SECRET_KEY=${FLASK_SECRET_KEY:-dev-secret-key-change-in-production}
+ - DEFAULT_SUPERADMIN_USERNAME=${DEFAULT_SUPERADMIN_USERNAME:-superadmin}
+ - DEFAULT_SUPERADMIN_PASSWORD=${DEFAULT_SUPERADMIN_PASSWORD}
# 🔧 ENTFERNT: Volume-Mount ist nur für die Entwicklung
networks:
- infoscreen-net
diff --git a/models/models.py b/models/models.py
index 2c3c75f..99dd48d 100644
--- a/models/models.py
+++ b/models/models.py
@@ -10,6 +10,7 @@ Base = declarative_base()
class UserRole(enum.Enum):
user = "user"
+ editor = "editor"
admin = "admin"
superadmin = "superadmin"
diff --git a/server/alembic/versions/488ce87c28ae_merge_all_heads_before_user_role_.py b/server/alembic/versions/488ce87c28ae_merge_all_heads_before_user_role_.py
new file mode 100644
index 0000000..a6eeb7a
--- /dev/null
+++ b/server/alembic/versions/488ce87c28ae_merge_all_heads_before_user_role_.py
@@ -0,0 +1,28 @@
+"""Merge all heads before user role migration
+
+Revision ID: 488ce87c28ae
+Revises: 12ab34cd56ef, 15c357c0cf31, add_userrole_editor_and_column
+Create Date: 2025-10-15 05:46:17.984934
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = '488ce87c28ae'
+down_revision: Union[str, None] = ('12ab34cd56ef', '15c357c0cf31', 'add_userrole_editor_and_column')
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+ """Upgrade schema."""
+ pass
+
+
+def downgrade() -> None:
+ """Downgrade schema."""
+ pass
diff --git a/server/alembic/versions/add_userrole_editor_and_column.py b/server/alembic/versions/add_userrole_editor_and_column.py
new file mode 100644
index 0000000..256b2b5
--- /dev/null
+++ b/server/alembic/versions/add_userrole_editor_and_column.py
@@ -0,0 +1,40 @@
+"""
+Add editor role to UserRole enum and ensure role column exists on users table
+"""
+from alembic import op
+import sqlalchemy as sa
+import enum
+
+# revision identifiers, used by Alembic.
+revision = 'add_userrole_editor_and_column'
+down_revision = None # Set this to the latest revision in your repo
+branch_labels = None
+depends_on = None
+
+# Define the new enum including 'editor'
+class userrole_enum(enum.Enum):
+ user = "user"
+ editor = "editor"
+ admin = "admin"
+ superadmin = "superadmin"
+
+def upgrade():
+ # MySQL: check if 'role' column exists
+ conn = op.get_bind()
+ insp = sa.inspect(conn)
+ columns = [col['name'] for col in insp.get_columns('users')]
+ if 'role' not in columns:
+ with op.batch_alter_table('users') as batch_op:
+ batch_op.add_column(sa.Column('role', sa.Enum('user', 'editor', 'admin', 'superadmin', name='userrole'), nullable=False, server_default='user'))
+ else:
+ # If the column exists, alter the ENUM to add 'editor' if not present
+ # MySQL: ALTER TABLE users MODIFY COLUMN role ENUM(...)
+ conn.execute(sa.text(
+ "ALTER TABLE users MODIFY COLUMN role ENUM('user','editor','admin','superadmin') NOT NULL DEFAULT 'user'"
+ ))
+
+def downgrade():
+ # ### commands auto generated by Alembic - please adjust! ###
+ with op.batch_alter_table('users') as batch_op:
+ batch_op.drop_column('role')
+ # ### end Alembic commands ###
diff --git a/server/init_defaults.py b/server/init_defaults.py
index 18ec0f3..4b1be69 100644
--- a/server/init_defaults.py
+++ b/server/init_defaults.py
@@ -20,19 +20,25 @@ with engine.connect() as conn:
)
print("✅ Default-Gruppe mit id=1 angelegt.")
- # Admin-Benutzer anlegen, falls nicht vorhanden
- admin_user = os.getenv("DEFAULT_ADMIN_USERNAME", "infoscreen_admin")
- admin_pw = os.getenv("DEFAULT_ADMIN_PASSWORD", "Info_screen_admin25!")
+ # Superadmin-Benutzer anlegen, falls nicht vorhanden
+ admin_user = os.getenv("DEFAULT_SUPERADMIN_USERNAME", "superadmin")
+ admin_pw = os.getenv("DEFAULT_SUPERADMIN_PASSWORD")
+
+ if not admin_pw:
+ print("⚠️ DEFAULT_SUPERADMIN_PASSWORD nicht gesetzt. Superadmin wird nicht erstellt.")
+ else:
# Passwort hashen mit bcrypt
- hashed_pw = bcrypt.hashpw(admin_pw.encode(
- 'utf-8'), bcrypt.gensalt()).decode('utf-8')
- # Prüfen, ob User existiert
- result = conn.execute(text(
- "SELECT COUNT(*) FROM users WHERE username=:username"), {"username": admin_user})
- if result.scalar() == 0:
- # Rolle: 1 = Admin (ggf. anpassen je nach Modell)
- conn.execute(
- text("INSERT INTO users (username, password_hash, role, is_active) VALUES (:username, :password_hash, 1, 1)"),
- {"username": admin_user, "password_hash": hashed_pw}
- )
- print(f"✅ Admin-Benutzer '{admin_user}' angelegt.")
+ hashed_pw = bcrypt.hashpw(admin_pw.encode(
+ 'utf-8'), bcrypt.gensalt()).decode('utf-8')
+ # Prüfen, ob User existiert
+ result = conn.execute(text(
+ "SELECT COUNT(*) FROM users WHERE username=:username"), {"username": admin_user})
+ if result.scalar() == 0:
+ # Rolle: 'superadmin' gemäß UserRole enum
+ conn.execute(
+ text("INSERT INTO users (username, password_hash, role, is_active) VALUES (:username, :password_hash, 'superadmin', 1)"),
+ {"username": admin_user, "password_hash": hashed_pw}
+ )
+ print(f"✅ Superadmin-Benutzer '{admin_user}' angelegt.")
+ else:
+ print(f"ℹ️ Superadmin-Benutzer '{admin_user}' existiert bereits.")
diff --git a/server/permissions.py b/server/permissions.py
new file mode 100644
index 0000000..b2ccf63
--- /dev/null
+++ b/server/permissions.py
@@ -0,0 +1,176 @@
+"""
+Permission decorators for role-based access control.
+
+This module provides decorators to protect Flask routes based on user roles.
+"""
+
+from functools import wraps
+from flask import session, jsonify
+import os
+from models.models import UserRole
+
+
+def require_auth(f):
+ """
+ Require user to be authenticated.
+
+ Usage:
+ @app.route('/protected')
+ @require_auth
+ def protected_route():
+ return "You are logged in"
+ """
+ @wraps(f)
+ def decorated_function(*args, **kwargs):
+ user_id = session.get('user_id')
+ if not user_id:
+ return jsonify({"error": "Authentication required"}), 401
+ return f(*args, **kwargs)
+ return decorated_function
+
+
+def require_role(*allowed_roles):
+ """
+ Require user to have one of the specified roles.
+
+ Args:
+ *allowed_roles: Variable number of role strings or UserRole enum values
+
+ Usage:
+ @app.route('/admin-only')
+ @require_role('admin', 'superadmin')
+ def admin_route():
+ return "Admin access"
+
+ # Or using enum:
+ @require_role(UserRole.admin, UserRole.superadmin)
+ def admin_route():
+ return "Admin access"
+ """
+ # Convert all roles to strings for comparison
+ allowed_role_strings = set()
+ for role in allowed_roles:
+ if isinstance(role, UserRole):
+ allowed_role_strings.add(role.value)
+ elif isinstance(role, str):
+ allowed_role_strings.add(role)
+ else:
+ raise ValueError(f"Invalid role type: {type(role)}")
+
+ def decorator(f):
+ @wraps(f)
+ def decorated_function(*args, **kwargs):
+ user_id = session.get('user_id')
+ user_role = session.get('role')
+
+ if not user_id or not user_role:
+ return jsonify({"error": "Authentication required"}), 401
+
+ # In development, allow superadmin to bypass all checks to prevent blocking
+ env = os.environ.get('ENV', 'production').lower()
+ if env in ('development', 'dev') and user_role == UserRole.superadmin.value:
+ return f(*args, **kwargs)
+
+ if user_role not in allowed_role_strings:
+ return jsonify({
+ "error": "Insufficient permissions",
+ "required_roles": list(allowed_role_strings),
+ "your_role": user_role
+ }), 403
+
+ return f(*args, **kwargs)
+ return decorated_function
+ return decorator
+
+
+def require_any_role(*allowed_roles):
+ """
+ Alias for require_role for better readability.
+ Require user to have ANY of the specified roles.
+
+ Usage:
+ @require_any_role('editor', 'admin', 'superadmin')
+ def edit_route():
+ return "Can edit"
+ """
+ return require_role(*allowed_roles)
+
+
+def require_all_roles(*required_roles):
+ """
+ Require user to have ALL of the specified roles.
+ Note: This is typically not needed since users only have one role,
+ but included for completeness.
+
+ Usage:
+ @require_all_roles('admin')
+ def strict_route():
+ return "Must have all roles"
+ """
+ # Convert all roles to strings
+ required_role_strings = set()
+ for role in required_roles:
+ if isinstance(role, UserRole):
+ required_role_strings.add(role.value)
+ elif isinstance(role, str):
+ required_role_strings.add(role)
+
+ def decorator(f):
+ @wraps(f)
+ def decorated_function(*args, **kwargs):
+ user_id = session.get('user_id')
+ user_role = session.get('role')
+
+ if not user_id or not user_role:
+ return jsonify({"error": "Authentication required"}), 401
+
+ # For single-role systems, check if user role is in required set
+ if user_role not in required_role_strings:
+ return jsonify({
+ "error": "Insufficient permissions",
+ "required_roles": list(required_role_strings),
+ "your_role": user_role
+ }), 403
+
+ return f(*args, **kwargs)
+ return decorated_function
+ return decorator
+
+
+def superadmin_only(f):
+ """
+ Convenience decorator for superadmin-only routes.
+
+ Usage:
+ @app.route('/critical-settings')
+ @superadmin_only
+ def critical_settings():
+ return "Superadmin only"
+ """
+ return require_role(UserRole.superadmin)(f)
+
+
+def admin_or_higher(f):
+ """
+ Convenience decorator for admin and superadmin routes.
+
+ Usage:
+ @app.route('/settings')
+ @admin_or_higher
+ def settings():
+ return "Admin or superadmin"
+ """
+ return require_role(UserRole.admin, UserRole.superadmin)(f)
+
+
+def editor_or_higher(f):
+ """
+ Convenience decorator for editor, admin, and superadmin routes.
+
+ Usage:
+ @app.route('/events', methods=['POST'])
+ @editor_or_higher
+ def create_event():
+ return "Can create events"
+ """
+ return require_role(UserRole.editor, UserRole.admin, UserRole.superadmin)(f)
diff --git a/server/routes/academic_periods.py b/server/routes/academic_periods.py
index 588ff0c..a8f3528 100644
--- a/server/routes/academic_periods.py
+++ b/server/routes/academic_periods.py
@@ -1,4 +1,5 @@
from flask import Blueprint, jsonify, request
+from server.permissions import admin_or_higher
from server.database import Session
from models.models import AcademicPeriod
from datetime import datetime
@@ -61,6 +62,7 @@ def get_period_for_date():
@academic_periods_bp.route('/active', methods=['POST'])
+@admin_or_higher
def set_active_academic_period():
data = request.get_json(silent=True) or {}
period_id = data.get('id')
diff --git a/server/routes/auth.py b/server/routes/auth.py
new file mode 100644
index 0000000..48c5ed5
--- /dev/null
+++ b/server/routes/auth.py
@@ -0,0 +1,210 @@
+"""
+Authentication and user management routes.
+
+This module provides endpoints for user authentication and role information.
+Currently implements a basic session-based auth that can be extended with
+JWT or Flask-Login later.
+"""
+
+from flask import Blueprint, request, jsonify, session
+import os
+from server.database import Session
+from models.models import User, UserRole
+import bcrypt
+import sys
+
+sys.path.append('/workspace')
+
+auth_bp = Blueprint("auth", __name__, url_prefix="/api/auth")
+
+
+@auth_bp.route("/login", methods=["POST"])
+def login():
+ """
+ Authenticate a user and create a session.
+
+ Request body:
+ {
+ "username": "string",
+ "password": "string"
+ }
+
+ Returns:
+ 200: {
+ "message": "Login successful",
+ "user": {
+ "id": int,
+ "username": "string",
+ "role": "string"
+ }
+ }
+ 401: {"error": "Invalid credentials"}
+ 400: {"error": "Username and password required"}
+ """
+ data = request.get_json()
+
+ if not data:
+ return jsonify({"error": "Request body required"}), 400
+
+ username = data.get("username")
+ password = data.get("password")
+
+ if not username or not password:
+ return jsonify({"error": "Username and password required"}), 400
+
+ db_session = Session()
+ try:
+ # Find user by username
+ user = db_session.query(User).filter_by(username=username).first()
+
+ if not user:
+ return jsonify({"error": "Invalid credentials"}), 401
+
+ # Check if user is active
+ if not user.is_active:
+ return jsonify({"error": "Account is disabled"}), 401
+
+ # Verify password
+ if not bcrypt.checkpw(password.encode('utf-8'), user.password_hash.encode('utf-8')):
+ return jsonify({"error": "Invalid credentials"}), 401
+
+ # Create session
+ session['user_id'] = user.id
+ session['username'] = user.username
+ session['role'] = user.role.value
+ # Persist session across browser restarts (uses PERMANENT_SESSION_LIFETIME)
+ session.permanent = True
+
+ return jsonify({
+ "message": "Login successful",
+ "user": {
+ "id": user.id,
+ "username": user.username,
+ "role": user.role.value
+ }
+ }), 200
+
+ finally:
+ db_session.close()
+
+
+@auth_bp.route("/logout", methods=["POST"])
+def logout():
+ """
+ End the current user session.
+
+ Returns:
+ 200: {"message": "Logout successful"}
+ """
+ session.clear()
+ return jsonify({"message": "Logout successful"}), 200
+
+
+@auth_bp.route("/me", methods=["GET"])
+def get_current_user():
+ """
+ Get the current authenticated user's information.
+
+ Returns:
+ 200: {
+ "id": int,
+ "username": "string",
+ "role": "string",
+ "is_active": bool
+ }
+ 401: {"error": "Not authenticated"}
+ """
+ user_id = session.get('user_id')
+
+ if not user_id:
+ return jsonify({"error": "Not authenticated"}), 401
+
+ db_session = Session()
+ try:
+ user = db_session.query(User).filter_by(id=user_id).first()
+
+ if not user:
+ # Session is stale, user was deleted
+ session.clear()
+ return jsonify({"error": "Not authenticated"}), 401
+
+ if not user.is_active:
+ # User was deactivated
+ session.clear()
+ return jsonify({"error": "Account is disabled"}), 401
+
+ return jsonify({
+ "id": user.id,
+ "username": user.username,
+ "role": user.role.value,
+ "is_active": user.is_active
+ }), 200
+
+ finally:
+ db_session.close()
+
+
+@auth_bp.route("/check", methods=["GET"])
+def check_auth():
+ """
+ Quick check if user is authenticated (lighter than /me).
+
+ Returns:
+ 200: {"authenticated": true, "role": "string"}
+ 200: {"authenticated": false}
+ """
+ user_id = session.get('user_id')
+ role = session.get('role')
+
+ if user_id and role:
+ return jsonify({
+ "authenticated": True,
+ "role": role
+ }), 200
+
+ return jsonify({"authenticated": False}), 200
+
+
+@auth_bp.route("/dev-login-superadmin", methods=["POST"])
+def dev_login_superadmin():
+ """
+ Development-only endpoint to quickly establish a superadmin session without a password.
+
+ Enabled only when ENV is 'development' or 'dev'. Returns 404 otherwise.
+ """
+ env = os.environ.get("ENV", "production").lower()
+ if env not in ("development", "dev"):
+ # Pretend the route does not exist in non-dev environments
+ return jsonify({"error": "Not found"}), 404
+
+ db_session = Session()
+ try:
+ # Prefer explicit username from env, else pick any superadmin
+ preferred_username = os.environ.get("DEFAULT_SUPERADMIN_USERNAME", "superadmin")
+ user = (
+ db_session.query(User)
+ .filter((User.username == preferred_username) | (User.role == UserRole.superadmin))
+ .order_by(User.id.asc())
+ .first()
+ )
+ if not user:
+ return jsonify({
+ "error": "No superadmin user found. Seed a superadmin first (DEFAULT_SUPERADMIN_PASSWORD)."
+ }), 404
+
+ # Establish session
+ session['user_id'] = user.id
+ session['username'] = user.username
+ session['role'] = user.role.value
+ session.permanent = True
+
+ return jsonify({
+ "message": "Dev login successful (superadmin)",
+ "user": {
+ "id": user.id,
+ "username": user.username,
+ "role": user.role.value
+ }
+ }), 200
+ finally:
+ db_session.close()
diff --git a/server/routes/clients.py b/server/routes/clients.py
index f393a0e..e6bcc13 100644
--- a/server/routes/clients.py
+++ b/server/routes/clients.py
@@ -1,6 +1,7 @@
from server.database import Session
from models.models import Client, ClientGroup
from flask import Blueprint, request, jsonify
+from server.permissions import admin_or_higher
from server.mqtt_helper import publish_client_group, delete_client_group_message, publish_multiple_client_groups
import sys
sys.path.append('/workspace')
@@ -9,6 +10,7 @@ clients_bp = Blueprint("clients", __name__, url_prefix="/api/clients")
@clients_bp.route("/sync-all-groups", methods=["POST"])
+@admin_or_higher
def sync_all_client_groups():
"""
Administrative Route: Synchronisiert alle bestehenden Client-Gruppenzuordnungen mit MQTT
@@ -73,6 +75,7 @@ def get_clients_without_description():
@clients_bp.route("//description", methods=["PUT"])
+@admin_or_higher
def set_client_description(uuid):
data = request.get_json()
description = data.get("description", "").strip()
@@ -127,6 +130,7 @@ def get_clients():
@clients_bp.route("/group", methods=["PUT"])
+@admin_or_higher
def update_clients_group():
data = request.get_json()
client_ids = data.get("client_ids", [])
@@ -178,6 +182,7 @@ def update_clients_group():
@clients_bp.route("/", methods=["PATCH"])
+@admin_or_higher
def update_client(uuid):
data = request.get_json()
session = Session()
@@ -234,6 +239,7 @@ def get_clients_with_alive_status():
@clients_bp.route("//restart", methods=["POST"])
+@admin_or_higher
def restart_client(uuid):
"""
Route to restart a specific client by UUID.
@@ -268,6 +274,7 @@ def restart_client(uuid):
@clients_bp.route("/", methods=["DELETE"])
+@admin_or_higher
def delete_client(uuid):
session = Session()
client = session.query(Client).filter_by(uuid=uuid).first()
diff --git a/server/routes/conversions.py b/server/routes/conversions.py
index c6dc770..d0afdc9 100644
--- a/server/routes/conversions.py
+++ b/server/routes/conversions.py
@@ -1,4 +1,5 @@
from flask import Blueprint, jsonify, request
+from server.permissions import editor_or_higher
from server.database import Session
from models.models import Conversion, ConversionStatus, EventMedia, MediaType
from server.task_queue import get_queue
@@ -19,6 +20,7 @@ def sha256_file(abs_path: str) -> str:
@conversions_bp.route("//pdf", methods=["POST"])
+@editor_or_higher
def ensure_conversion(media_id: int):
session = Session()
try:
diff --git a/server/routes/event_exceptions.py b/server/routes/event_exceptions.py
index 4030bfb..ed0f212 100644
--- a/server/routes/event_exceptions.py
+++ b/server/routes/event_exceptions.py
@@ -1,4 +1,5 @@
from flask import Blueprint, request, jsonify
+from server.permissions import editor_or_higher
from server.database import Session
from models.models import EventException, Event
from datetime import datetime, date
@@ -7,6 +8,7 @@ event_exceptions_bp = Blueprint("event_exceptions", __name__, url_prefix="/api/e
@event_exceptions_bp.route("", methods=["POST"])
+@editor_or_higher
def create_exception():
data = request.json
session = Session()
@@ -50,6 +52,7 @@ def create_exception():
@event_exceptions_bp.route("/", methods=["PUT"])
+@editor_or_higher
def update_exception(exc_id):
data = request.json
session = Session()
@@ -77,6 +80,7 @@ def update_exception(exc_id):
@event_exceptions_bp.route("/", methods=["DELETE"])
+@editor_or_higher
def delete_exception(exc_id):
session = Session()
exc = session.query(EventException).filter_by(id=exc_id).first()
diff --git a/server/routes/eventmedia.py b/server/routes/eventmedia.py
index 80a508b..f990b9b 100644
--- a/server/routes/eventmedia.py
+++ b/server/routes/eventmedia.py
@@ -1,5 +1,6 @@
from re import A
from flask import Blueprint, request, jsonify, send_from_directory
+from server.permissions import editor_or_higher
from server.database import Session
from models.models import EventMedia, MediaType, Conversion, ConversionStatus
from server.task_queue import get_queue
@@ -25,6 +26,7 @@ def get_param(key, default=None):
@eventmedia_bp.route('/filemanager/operations', methods=['GET', 'POST'])
+@editor_or_higher
def filemanager_operations():
action = get_param('action')
path = get_param('path', '/')
@@ -115,6 +117,7 @@ def filemanager_operations():
@eventmedia_bp.route('/filemanager/upload', methods=['POST'])
+@editor_or_higher
def filemanager_upload():
session = Session()
# Korrigiert: Erst aus request.form, dann aus request.args lesen
@@ -210,6 +213,7 @@ def list_media():
@eventmedia_bp.route('/', methods=['PUT'])
+@editor_or_higher
def update_media(media_id):
session = Session()
media = session.query(EventMedia).get(media_id)
diff --git a/server/routes/events.py b/server/routes/events.py
index a4b8bd8..35a67f4 100644
--- a/server/routes/events.py
+++ b/server/routes/events.py
@@ -1,4 +1,5 @@
from flask import Blueprint, request, jsonify
+from server.permissions import editor_or_higher
from server.database import Session
from models.models import Event, EventMedia, MediaType, EventException
from datetime import datetime, timezone, timedelta
@@ -140,6 +141,7 @@ def get_event(event_id):
@events_bp.route("/", methods=["DELETE"]) # delete series or single event
+@editor_or_higher
def delete_event(event_id):
session = Session()
event = session.query(Event).filter_by(id=event_id).first()
@@ -162,7 +164,7 @@ def delete_event(event_id):
@events_bp.route("//occurrences/", methods=["DELETE"]) # skip single occurrence
-
+@editor_or_higher
def delete_event_occurrence(event_id, occurrence_date):
"""Delete a single occurrence of a recurring event by creating an EventException."""
session = Session()
@@ -217,6 +219,7 @@ def delete_event_occurrence(event_id, occurrence_date):
@events_bp.route("//occurrences//detach", methods=["POST"]) # detach single occurrence into standalone event
+@editor_or_higher
def detach_event_occurrence(event_id, occurrence_date):
"""BULLETPROOF: Detach single occurrence without touching master event."""
session = Session()
@@ -322,6 +325,7 @@ def detach_event_occurrence(event_id, occurrence_date):
@events_bp.route("", methods=["POST"])
+@editor_or_higher
def create_event():
data = request.json
session = Session()
@@ -438,6 +442,7 @@ def create_event():
@events_bp.route("/", methods=["PUT"]) # update series or single event
+@editor_or_higher
def update_event(event_id):
data = request.json
session = Session()
diff --git a/server/routes/groups.py b/server/routes/groups.py
index a7d7403..79fe6a5 100644
--- a/server/routes/groups.py
+++ b/server/routes/groups.py
@@ -4,6 +4,7 @@ from models.models import Client
from server.database import Session
from models.models import ClientGroup
from flask import Blueprint, request, jsonify
+from server.permissions import admin_or_higher, require_role
from sqlalchemy import func
import sys
import os
@@ -41,6 +42,7 @@ def is_client_alive(last_alive, is_active):
@groups_bp.route("", methods=["POST"])
+@admin_or_higher
def create_group():
data = request.get_json()
name = data.get("name")
@@ -83,6 +85,7 @@ def get_groups():
@groups_bp.route("/", methods=["PUT"])
+@admin_or_higher
def update_group(group_id):
data = request.get_json()
session = Session()
@@ -106,6 +109,7 @@ def update_group(group_id):
@groups_bp.route("/", methods=["DELETE"])
+@admin_or_higher
def delete_group(group_id):
session = Session()
group = session.query(ClientGroup).filter_by(id=group_id).first()
@@ -119,6 +123,7 @@ def delete_group(group_id):
@groups_bp.route("/byname/", methods=["DELETE"])
+@admin_or_higher
def delete_group_by_name(group_name):
session = Session()
group = session.query(ClientGroup).filter_by(name=group_name).first()
@@ -132,6 +137,7 @@ def delete_group_by_name(group_name):
@groups_bp.route("/byname/", methods=["PUT"])
+@admin_or_higher
def rename_group_by_name(old_name):
data = request.get_json()
new_name = data.get("newName")
diff --git a/server/routes/holidays.py b/server/routes/holidays.py
index 09b2b72..3e697df 100644
--- a/server/routes/holidays.py
+++ b/server/routes/holidays.py
@@ -1,4 +1,5 @@
from flask import Blueprint, request, jsonify
+from server.permissions import admin_or_higher
from server.database import Session
from models.models import SchoolHoliday
from datetime import datetime
@@ -22,6 +23,7 @@ def list_holidays():
@holidays_bp.route("/upload", methods=["POST"])
+@admin_or_higher
def upload_holidays():
"""
Accepts a CSV/TXT file upload (multipart/form-data).
diff --git a/server/wsgi.py b/server/wsgi.py
index 9a77285..e2a8680 100644
--- a/server/wsgi.py
+++ b/server/wsgi.py
@@ -8,6 +8,7 @@ from server.routes.holidays import holidays_bp
from server.routes.academic_periods import academic_periods_bp
from server.routes.groups import groups_bp
from server.routes.clients import clients_bp
+from server.routes.auth import auth_bp
from server.database import Session, engine
from flask import Flask, jsonify, send_from_directory, request
import glob
@@ -17,8 +18,25 @@ sys.path.append('/workspace')
app = Flask(__name__)
+# Configure Flask session
+# In production, use a secure random key from environment variable
+app.config['SECRET_KEY'] = os.environ.get('FLASK_SECRET_KEY', 'dev-secret-key-change-in-production')
+app.config['SESSION_COOKIE_HTTPONLY'] = True
+app.config['SESSION_COOKIE_SAMESITE'] = 'Lax'
+# In production, set to True if using HTTPS
+app.config['SESSION_COOKIE_SECURE'] = os.environ.get('ENV', 'development').lower() == 'production'
+# Session lifetime: longer in development for convenience
+from datetime import timedelta
+_env = os.environ.get('ENV', 'development').lower()
+if _env in ('development', 'dev'):
+ app.config['PERMANENT_SESSION_LIFETIME'] = timedelta(days=30)
+else:
+ # Keep modest in production; can be tuned via env later
+ app.config['PERMANENT_SESSION_LIFETIME'] = timedelta(days=1)
+
# Blueprints importieren und registrieren
+app.register_blueprint(auth_bp)
app.register_blueprint(clients_bp)
app.register_blueprint(groups_bp)
app.register_blueprint(events_bp)
diff --git a/userrole-management.md b/userrole-management.md
new file mode 100644
index 0000000..930442c
--- /dev/null
+++ b/userrole-management.md
@@ -0,0 +1,139 @@
+# User Role Management Integration Guide
+
+This document outlines a step-by-step workpath to introduce user management and role-based access control (RBAC) into the infoscreen_2025 project. It is designed to minimize friction and allow incremental rollout.
+
+---
+
+## 1. Define Roles and Permissions
+
+- **Roles:**
+ - `superadmin`: Developer, can edit all settings (including critical/system settings), manage all users.
+ - `admin`: Organization employee, can edit all organization-relevant settings, manage users (except superadmin), manage groups/clients.
+ - `editor`: Can create, read, update, delete (CRUD) events and media.
+ - `user`: Can view events only.
+- **Permission Matrix:**
+ - See summary in the main design notes above for CRUD rights per area.
+
+---
+
+## 2. Extend Database Schema
+
+- Add a `role` column to the `users` table (Enum: superadmin, admin, editor, user; default: user).
+- Create an Alembic migration for this change.
+- Update SQLAlchemy models accordingly.
+
+---
+
+## 3. Seed Initial Superadmin
+
+- Update `server/init_defaults.py` to create a default superadmin user (with secure password, ideally from env or prompt).
+
+---
+
+## 4. Backend: Auth Context and Role Exposure
+
+- Ensure current user is determined per request (session or token-based).
+- Add `/api/me` endpoint to return current user's id, username, and role.
+
+---
+
+## 5. Backend: Permission Decorators
+
+- Implement decorators (e.g., `@require_role('admin')`, `@require_any_role(['editor','admin','superadmin'])`).
+- Apply to sensitive routes:
+ - User management (admin+)
+ - Program settings (admin/superadmin)
+ - Event settings (admin+)
+ - Event CRUD (editor+)
+
+---
+
+## 6. Frontend: Role Awareness and Gating
+
+- Add a `useCurrentUser()` hook or similar to fetch `/api/me` and store role in context.
+- Gate navigation and UI controls based on role:
+ - Hide or disable settings/actions not permitted for current role.
+ - Show/hide user management UI for admin+ only.
+
+---
+
+## 7. Frontend: User Management UI
+
+- Add a Users page (admin+):
+ - List users (GridComponent)
+ - Create/invite user (Dialog)
+ - Set/reset role (DropDownList, prevent superadmin assignment unless current is superadmin)
+ - Reset password (Dialog)
+
+---
+
+## 8. Rollout Strategy
+
+- **Stage 1:** Implement model, seed, and minimal enforcement (now)
+- **Stage 2:** Expand backend enforcement and frontend gating (before wider testing)
+- **Stage 3:** Polish UI, add audit logging if needed (before production)
+
+---
+
+## 9. Testing
+
+- Test each role for correct access and UI visibility.
+- Ensure superadmin cannot be demoted or deleted by non-superadmin.
+- Validate that critical settings are only editable by superadmin.
+
+---
+
+## 10. Optional: Audit Logging
+
+- For production, consider logging critical changes (role changes, user creation/deletion, settings changes) for traceability.
+
+---
+
+## References
+- See `models/models.py`, `server/routes/`, and `dashboard/src/` for integration points.
+- Syncfusion: Use GridComponent, Dialog, DropDownList for user management UI.
+
+---
+
+This guide is designed for incremental, low-friction integration. Adjust steps as needed for your workflow and deployment practices.
+
+---
+
+## Stage 1: Concrete Step-by-Step Checklist
+
+1. **Extend the User Model**
+ - Add a `role` column to the `users` table in your SQLAlchemy model (`models/models.py`).
+ - Use an Enum for roles: `superadmin`, `admin`, `editor`, `user` (default: `user`).
+ - Create an Alembic migration to add this column to the database.
+
+2. **Seed a Superadmin User** ✅
+ - Update `server/init_defaults.py` to create a default superadmin user with a secure password (from environment variable).
+ - Ensure this user is only created if not already present.
+ - **Status:** Completed. See `server/init_defaults.py` - requires `DEFAULT_SUPERADMIN_PASSWORD` environment variable.
+
+ 3. **Expose Current User Role** ✅
+ - Add a `/api/me` endpoint (e.g., in `server/routes/auth.py`) that returns the current user's id, username, and role.
+ - Ensure the frontend can fetch and store this information on login or page load.
+ - **Status:** Completed. See:
+ - Backend: `server/routes/auth.py` (login, logout, /me, /check endpoints)
+ - Frontend: `dashboard/src/apiAuth.ts` and `dashboard/src/useAuth.tsx`
+ - Permissions: `server/permissions.py` (decorators for route protection)
+
+4. **Implement Minimal Role Enforcement** ✅
+ - Decorators added in `server/permissions.py`: `require_auth`, `require_role`, `editor_or_higher`, `admin_or_higher`, `superadmin_only`.
+ - Applied to sensitive endpoints:
+ - Groups (admin+): create, update, delete, rename (`server/routes/groups.py`)
+ - Clients (admin+): sync-all-groups, set description, bulk group update, patch, restart, delete (`server/routes/clients.py`)
+ - Academic periods (admin+): set active (`server/routes/academic_periods.py`)
+ - Events (editor+): create, update, delete, delete occurrence, detach occurrence (`server/routes/events.py`)
+ - Event media (editor+): filemanager operations/upload, metadata update (`server/routes/eventmedia.py`)
+ - Event exceptions (editor+): create, update, delete (`server/routes/event_exceptions.py`)
+ - Conversions (editor+): ensure conversion (`server/routes/conversions.py`)
+ - Superadmin dev bypass: In development (`ENV=development`), `superadmin` bypasses checks for unblocking.
+
+5. **Test the Flow**
+ - Confirm that the superadmin can access all protected endpoints.
+ - Confirm that users with other roles are denied access to protected endpoints.
+ - Ensure the frontend can correctly gate UI elements based on the current user's role.
+
+---
- (null);
+
+ useEffect(() => {
+ let mounted = true;
+ (async () => {
+ try {
+ await logout();
+ } catch (err) {
+ if (mounted) {
+ const msg = err instanceof Error ? err.message : 'Logout fehlgeschlagen';
+ setError(msg);
+ }
+ } finally {
+ // Weiter zur Login-Seite, auch wenn Logout-Request fehlschlägt
+ navigate('/login', { replace: true });
+ }
+ })();
+ return () => {
+ mounted = false;
+ };
+ }, [logout, navigate]);
+
+ return (
+
-);
+ );
+};
export default Logout;
diff --git a/dashboard/src/main.tsx b/dashboard/src/main.tsx
index 9e115d7..6a71cc0 100644
--- a/dashboard/src/main.tsx
+++ b/dashboard/src/main.tsx
@@ -2,6 +2,7 @@ import { StrictMode } from 'react';
import { createRoot } from 'react-dom/client';
import './index.css';
import App from './App.tsx';
+import { AuthProvider } from './useAuth';
import { registerLicense } from '@syncfusion/ej2-base';
import '@syncfusion/ej2-base/styles/material3.css';
import '@syncfusion/ej2-navigations/styles/material3.css';
@@ -28,6 +29,8 @@ registerLicense(
createRoot(document.getElementById('root')!).render(
Abmeldung
-Sie haben sich erfolgreich abgemeldet.
+const Logout: React.FC = () => { + const navigate = useNavigate(); + const { logout } = useAuth(); + const [error, setError] = useState
+
-
+
Abmeldung
+{error ? `Hinweis: ${error}` : 'Sie werden abgemeldet …'}
+Falls nichts passiert: Zur Login-Seite
+