3f9c395b17
- New Users page tabs (Users & roles / Access requests / Demo) and a tab-ified Configuration page, both via a reusable Tabs component (persisted active tab). - Admin can suspend/unsuspend (migration 0023 adds users.is_suspended) and delete accounts from the Users & roles tab, with guards (demo / self / last admin). - Email notifications to the affected user: suspended (reactive, on a blocked sign-in), reinstated, role changed, and account deleted; the approval email now carries a clickable app link. The scheduled/manual demo reset also seeds sample channel subscriptions. - Hide the 'unverified email' chip for Google accounts (Google attests the email).
387 lines
14 KiB
Python
387 lines
14 KiB
Python
"""Admin-only onboarding: review access requests (Invites), approve/deny, manual add.
|
|
Also the demo-account admin surface: the demo email whitelist + a manual state reset."""
|
|
import re
|
|
from datetime import datetime, timezone
|
|
|
|
from fastapi import APIRouter, BackgroundTasks, Depends, HTTPException
|
|
from sqlalchemy import delete, func, select
|
|
from sqlalchemy.orm import Session
|
|
|
|
from app import email as email_mod
|
|
from app.auth import current_user, get_or_create_demo_user, operator_contact, purge_user
|
|
from app.db import get_db
|
|
from app.models import (
|
|
DemoWhitelist,
|
|
Invite,
|
|
Playlist,
|
|
PlaylistItem,
|
|
Subscription,
|
|
User,
|
|
Video,
|
|
VideoState,
|
|
)
|
|
|
|
router = APIRouter(prefix="/api/admin", tags=["admin"])
|
|
|
|
_EMAIL_RE = re.compile(r"^[^@\s]+@[^@\s]+\.[^@\s]+$")
|
|
|
|
|
|
def admin_user(user: User = Depends(current_user)) -> User:
|
|
if user.role != "admin":
|
|
raise HTTPException(status_code=403, detail="Admin only")
|
|
return user
|
|
|
|
|
|
def _serialize(inv: Invite) -> dict:
|
|
return {
|
|
"id": inv.id,
|
|
"email": inv.email,
|
|
"status": inv.status,
|
|
"note": inv.note,
|
|
"requested_at": inv.requested_at.isoformat() if inv.requested_at else None,
|
|
"decided_at": inv.decided_at.isoformat() if inv.decided_at else None,
|
|
"decided_by": inv.decided_by,
|
|
}
|
|
|
|
|
|
@router.get("/invites")
|
|
def list_invites(
|
|
status: str | None = None,
|
|
_: User = Depends(admin_user),
|
|
db: Session = Depends(get_db),
|
|
) -> list[dict]:
|
|
stmt = select(Invite)
|
|
if status:
|
|
stmt = stmt.where(Invite.status == status)
|
|
# Pending first, then most-recently requested.
|
|
rows = db.execute(stmt.order_by(Invite.requested_at.desc())).scalars().all()
|
|
order = {"pending": 0, "approved": 1, "denied": 2}
|
|
rows.sort(key=lambda i: order.get(i.status, 9))
|
|
return [_serialize(i) for i in rows]
|
|
|
|
|
|
def _activate_user_by_email(db: Session, email: str) -> None:
|
|
"""Approving access activates a matching (e.g. pending password-registration) account so
|
|
it can sign in. No-op if no such user exists yet (a Google user is created at first login)."""
|
|
user = db.execute(select(User).where(User.email == email.lower())).scalar_one_or_none()
|
|
if user is not None and not user.is_active:
|
|
user.is_active = True
|
|
db.commit()
|
|
|
|
|
|
def _decide(db: Session, invite_id: int, admin: User, approved: bool) -> Invite:
|
|
inv = db.get(Invite, invite_id)
|
|
if inv is None:
|
|
raise HTTPException(status_code=404, detail="No such invite")
|
|
inv.status = "approved" if approved else "denied"
|
|
inv.decided_at = datetime.now(timezone.utc)
|
|
inv.decided_by = admin.email
|
|
db.commit()
|
|
return inv
|
|
|
|
|
|
@router.post("/invites/{invite_id}/approve")
|
|
def approve_invite(
|
|
invite_id: int,
|
|
background: BackgroundTasks,
|
|
admin: User = Depends(admin_user),
|
|
db: Session = Depends(get_db),
|
|
) -> dict:
|
|
inv = _decide(db, invite_id, admin, approved=True)
|
|
_activate_user_by_email(db, inv.email)
|
|
background.add_task(email_mod.send_access_approved, inv.email)
|
|
return _serialize(inv)
|
|
|
|
|
|
@router.post("/invites/{invite_id}/deny")
|
|
def deny_invite(
|
|
invite_id: int,
|
|
admin: User = Depends(admin_user),
|
|
db: Session = Depends(get_db),
|
|
) -> dict:
|
|
return _serialize(_decide(db, invite_id, admin, approved=False))
|
|
|
|
|
|
@router.post("/invites")
|
|
def add_invite(
|
|
payload: dict,
|
|
admin: User = Depends(admin_user),
|
|
db: Session = Depends(get_db),
|
|
) -> dict:
|
|
"""Manually whitelist an email (approved straight away). Convenience for the admin."""
|
|
email = (payload.get("email") or "").strip().lower()
|
|
if "@" not in email:
|
|
raise HTTPException(status_code=400, detail="Enter a valid email address.")
|
|
inv = db.execute(select(Invite).where(Invite.email == email)).scalar_one_or_none()
|
|
if inv is None:
|
|
inv = Invite(email=email)
|
|
db.add(inv)
|
|
inv.status = "approved"
|
|
inv.decided_at = datetime.now(timezone.utc)
|
|
inv.decided_by = admin.email
|
|
db.commit()
|
|
_activate_user_by_email(db, email)
|
|
return _serialize(inv)
|
|
|
|
|
|
# --- Users & roles --------------------------------------------------------------------
|
|
|
|
def _serialize_user(u: User) -> dict:
|
|
return {
|
|
"id": u.id,
|
|
"email": u.email,
|
|
"display_name": u.display_name,
|
|
"role": u.role,
|
|
"is_active": u.is_active,
|
|
"is_suspended": u.is_suspended,
|
|
"email_verified": u.email_verified,
|
|
"is_demo": u.is_demo,
|
|
"has_password": u.password_hash is not None,
|
|
"has_google": u.google_sub is not None,
|
|
"created_at": u.created_at.isoformat() if u.created_at else None,
|
|
}
|
|
|
|
|
|
@router.get("/users")
|
|
def list_users(_: User = Depends(admin_user), db: Session = Depends(get_db)) -> list[dict]:
|
|
rows = db.execute(select(User).order_by(User.created_at.desc())).scalars().all()
|
|
return [_serialize_user(u) for u in rows]
|
|
|
|
|
|
@router.patch("/users/{user_id}/role")
|
|
def set_user_role(
|
|
user_id: int,
|
|
payload: dict,
|
|
background: BackgroundTasks,
|
|
admin: User = Depends(admin_user),
|
|
db: Session = Depends(get_db),
|
|
) -> dict:
|
|
"""Promote/demote a user. Guards: can't change your own role, can't touch the demo
|
|
account, and can't remove the last remaining admin. Emails the user when it actually changes."""
|
|
role = payload.get("role")
|
|
if role not in ("user", "admin"):
|
|
raise HTTPException(status_code=400, detail="role must be 'user' or 'admin'")
|
|
target = db.get(User, user_id)
|
|
if target is None:
|
|
raise HTTPException(status_code=404, detail="No such user")
|
|
if target.is_demo:
|
|
raise HTTPException(status_code=400, detail="The demo account's role can't be changed.")
|
|
if target.id == admin.id:
|
|
raise HTTPException(status_code=400, detail="You can't change your own role.")
|
|
if target.role == "admin" and role == "user":
|
|
admin_count = db.scalar(select(func.count()).select_from(User).where(User.role == "admin"))
|
|
if (admin_count or 0) <= 1:
|
|
raise HTTPException(status_code=400, detail="Can't remove the last admin.")
|
|
changed = target.role != role
|
|
target.role = role
|
|
db.commit()
|
|
if changed:
|
|
background.add_task(email_mod.send_role_changed, target.email, role, operator_contact())
|
|
return _serialize_user(target)
|
|
|
|
|
|
@router.patch("/users/{user_id}/suspend")
|
|
def set_user_suspended(
|
|
user_id: int,
|
|
payload: dict,
|
|
background: BackgroundTasks,
|
|
admin: User = Depends(admin_user),
|
|
db: Session = Depends(get_db),
|
|
) -> dict:
|
|
"""Suspend or un-suspend an account. A suspended user can't sign in by any method and any
|
|
live session is dropped on its next request. Guards: can't suspend the demo account, can't
|
|
suspend yourself, and can't suspend the last active admin (that would lock admin out). On
|
|
un-suspend the user is emailed they can return (suspend is announced reactively, on a blocked
|
|
sign-in)."""
|
|
suspended = bool(payload.get("suspended"))
|
|
target = db.get(User, user_id)
|
|
if target is None:
|
|
raise HTTPException(status_code=404, detail="No such user")
|
|
if target.is_demo:
|
|
raise HTTPException(status_code=400, detail="The demo account can't be suspended.")
|
|
if target.id == admin.id:
|
|
raise HTTPException(status_code=400, detail="You can't suspend your own account.")
|
|
if suspended and target.role == "admin" and not target.is_suspended:
|
|
active_admins = db.scalar(
|
|
select(func.count())
|
|
.select_from(User)
|
|
.where(User.role == "admin", User.is_suspended.is_(False))
|
|
)
|
|
if (active_admins or 0) <= 1:
|
|
raise HTTPException(status_code=400, detail="Can't suspend the last active admin.")
|
|
was_suspended = target.is_suspended
|
|
target.is_suspended = suspended
|
|
db.commit()
|
|
if was_suspended and not suspended:
|
|
background.add_task(
|
|
email_mod.send_account_unsuspended, target.email, operator_contact()
|
|
)
|
|
return _serialize_user(target)
|
|
|
|
|
|
@router.delete("/users/{user_id}")
|
|
def admin_delete_user(
|
|
user_id: int,
|
|
background: BackgroundTasks,
|
|
admin: User = Depends(admin_user),
|
|
db: Session = Depends(get_db),
|
|
) -> dict:
|
|
"""Admin-triggered account deletion — the same full erasure a user can perform on themselves
|
|
(cascade delete of all personal data + access-request cleanup + Google-grant revoke). Guards:
|
|
not the demo account, not yourself (use Settings → Account), and not the last admin."""
|
|
target = db.get(User, user_id)
|
|
if target is None:
|
|
raise HTTPException(status_code=404, detail="No such user")
|
|
if target.is_demo:
|
|
raise HTTPException(status_code=400, detail="The demo account can't be deleted.")
|
|
if target.id == admin.id:
|
|
raise HTTPException(
|
|
status_code=400, detail="Delete your own account from Settings → Account."
|
|
)
|
|
if target.role == "admin":
|
|
admin_count = db.scalar(
|
|
select(func.count()).select_from(User).where(User.role == "admin")
|
|
)
|
|
if (admin_count or 0) <= 1:
|
|
raise HTTPException(status_code=400, detail="Can't delete the last admin.")
|
|
purge_user(db, target, background)
|
|
return {"deleted": user_id}
|
|
|
|
|
|
# --- Demo account: email whitelist + state reset -------------------------------------
|
|
|
|
def _serialize_demo(row: DemoWhitelist) -> dict:
|
|
return {
|
|
"id": row.id,
|
|
"email": row.email,
|
|
"note": row.note,
|
|
"added_by": row.added_by,
|
|
"created_at": row.created_at.isoformat() if row.created_at else None,
|
|
}
|
|
|
|
|
|
@router.get("/demo/whitelist")
|
|
def list_demo_whitelist(
|
|
_: User = Depends(admin_user), db: Session = Depends(get_db)
|
|
) -> list[dict]:
|
|
rows = (
|
|
db.execute(select(DemoWhitelist).order_by(DemoWhitelist.created_at.desc()))
|
|
.scalars()
|
|
.all()
|
|
)
|
|
return [_serialize_demo(r) for r in rows]
|
|
|
|
|
|
@router.post("/demo/whitelist")
|
|
def add_demo_whitelist(
|
|
payload: dict,
|
|
admin: User = Depends(admin_user),
|
|
db: Session = Depends(get_db),
|
|
) -> dict:
|
|
"""Add an email that may enter the shared demo account from the login page (no Google
|
|
sign-in). Idempotent — re-adding an existing email just returns it."""
|
|
email = (payload.get("email") or "").strip().lower()
|
|
if not _EMAIL_RE.match(email):
|
|
raise HTTPException(status_code=400, detail="Enter a valid email address.")
|
|
row = db.execute(
|
|
select(DemoWhitelist).where(DemoWhitelist.email == email)
|
|
).scalar_one_or_none()
|
|
if row is None:
|
|
row = DemoWhitelist(
|
|
email=email,
|
|
note=(payload.get("note") or "").strip() or None,
|
|
added_by=admin.email,
|
|
)
|
|
db.add(row)
|
|
db.commit()
|
|
return _serialize_demo(row)
|
|
|
|
|
|
@router.delete("/demo/whitelist/{entry_id}")
|
|
def remove_demo_whitelist(
|
|
entry_id: int,
|
|
_: User = Depends(admin_user),
|
|
db: Session = Depends(get_db),
|
|
) -> dict:
|
|
row = db.get(DemoWhitelist, entry_id)
|
|
if row is not None:
|
|
db.delete(row)
|
|
db.commit()
|
|
return {"deleted": entry_id}
|
|
|
|
|
|
def _seed_demo_playlists(db: Session, demo: User) -> int:
|
|
"""Seed a few sample playlists from the shared catalog so a freshly-reset demo isn't
|
|
empty — gives visitors something to play with. Best-effort: skips silently if the
|
|
catalog is too small."""
|
|
recent = (
|
|
db.execute(
|
|
select(Video.id)
|
|
.where(Video.is_short.is_(False), Video.live_status == "none")
|
|
.order_by(Video.published_at.desc().nullslast())
|
|
.limit(60)
|
|
)
|
|
.scalars()
|
|
.all()
|
|
)
|
|
if not recent:
|
|
return 0
|
|
samples = [
|
|
("Fresh picks", recent[0:10]),
|
|
("Quick watch", recent[10:18]),
|
|
("Saved for later", recent[18:26]),
|
|
]
|
|
created = 0
|
|
for pos, (name, vids) in enumerate(samples):
|
|
if not vids:
|
|
continue
|
|
pl = Playlist(user_id=demo.id, name=name, position=pos)
|
|
db.add(pl)
|
|
db.flush()
|
|
for ipos, vid in enumerate(vids):
|
|
db.add(PlaylistItem(playlist_id=pl.id, video_id=vid, position=ipos))
|
|
created += 1
|
|
return created
|
|
|
|
|
|
def _seed_demo_subscriptions(db: Session, demo: User, n: int = 14) -> int:
|
|
"""Seed the demo with a handful of catalog channels (the ones with the most videos) so its
|
|
Channel manager isn't empty — gives visitors something to explore and matches the landing-page
|
|
screenshot. Idempotent: clears the demo's subscriptions first, then re-adds the top N."""
|
|
db.execute(delete(Subscription).where(Subscription.user_id == demo.id))
|
|
top = db.execute(
|
|
select(Video.channel_id)
|
|
.where(Video.channel_id.is_not(None))
|
|
.group_by(Video.channel_id)
|
|
.order_by(func.count().desc())
|
|
.limit(n)
|
|
).scalars().all()
|
|
for channel_id in top:
|
|
db.add(Subscription(user_id=demo.id, channel_id=channel_id))
|
|
return len(top)
|
|
|
|
|
|
def reset_demo_state(db: Session, demo: User) -> int:
|
|
"""Wipe the demo account's per-user state (watch/save/hide states, playlists, preferences)
|
|
back to a clean baseline and re-seed a few sample playlists + channel subscriptions. Returns
|
|
the seeded playlist count. Shared by the admin's manual reset button and the scheduled demo
|
|
reset (see scheduler)."""
|
|
db.execute(delete(VideoState).where(VideoState.user_id == demo.id))
|
|
# Playlist items cascade on playlist delete (ondelete="CASCADE").
|
|
db.execute(delete(Playlist).where(Playlist.user_id == demo.id))
|
|
demo.preferences = {"language": "en"}
|
|
db.commit()
|
|
seeded = _seed_demo_playlists(db, demo)
|
|
_seed_demo_subscriptions(db, demo)
|
|
db.commit()
|
|
return seeded
|
|
|
|
|
|
@router.post("/demo/reset")
|
|
def reset_demo(
|
|
_: User = Depends(admin_user), db: Session = Depends(get_db)
|
|
) -> dict:
|
|
"""Manually clean up the shared demo sandbox back to a baseline. A scheduled job does the
|
|
same automatically (admin-tunable interval); this is the admin's on-demand button."""
|
|
demo = get_or_create_demo_user(db)
|
|
return {"reset": True, "playlists_seeded": reset_demo_state(db, demo)}
|