259 lines
12 KiB
Python
259 lines
12 KiB
Python
"""Central permission configuration for all service routes.
|
|
|
|
Every route must be listed here. test_00_discover_routes.py enforces this.
|
|
|
|
Format:
|
|
ROUTE_PERMISSIONS[(method, path)] = (role1, role2, ...)
|
|
- "anonymous" means no auth required (public)
|
|
- "authenticated" means any logged-in user
|
|
|
|
Adding a new route? Add it here first — the discover test will fail otherwise.
|
|
"""
|
|
|
|
ROLES = ("owner", "engineer", "technician")
|
|
|
|
ROUTE_PERMISSIONS: dict[tuple[str, str], tuple[str, ...]] = {
|
|
# === PUBLIC ===
|
|
("GET", "/health"): ("anonymous",),
|
|
("GET", "/service/login"): ("anonymous",),
|
|
("POST", "/service/login"): ("anonymous",),
|
|
("GET", "/"): ("anonymous",),
|
|
|
|
# === AUTH ===
|
|
("GET", "/service/logout"): ("authenticated",),
|
|
|
|
# === DASHBOARD ===
|
|
("GET", "/service/dashboard"): ("owner", "engineer", "technician"),
|
|
|
|
# === USERS ===
|
|
("GET", "/service/users"): ("owner",),
|
|
("POST", "/service/users/create"): ("owner",),
|
|
("POST", "/service/users/edit"): ("owner",),
|
|
("POST", "/service/users/delete"): ("owner",),
|
|
|
|
# === CUSTOMERS ===
|
|
("GET", "/service/customers"): ("owner", "engineer"),
|
|
("POST", "/service/customers/create"): ("owner", "engineer"),
|
|
("POST", "/service/customers/edit"): ("owner", "engineer"),
|
|
("POST", "/service/customers/delete"): ("owner",),
|
|
|
|
# === OBJECTS ===
|
|
("GET", "/service/objects"): ("owner", "engineer"),
|
|
("POST", "/service/objects/create"): ("owner", "engineer"),
|
|
("POST", "/service/objects/edit"): ("owner", "engineer"),
|
|
("POST", "/service/objects/delete"): ("owner",),
|
|
|
|
# === ASSIGNMENTS ===
|
|
("GET", "/service/assignments"): ("owner",),
|
|
("POST", "/service/assignments/create"): ("owner",),
|
|
("POST", "/service/assignments/unassign"): ("owner",),
|
|
|
|
# === SLA ===
|
|
("GET", "/service/sla"): ("owner", "engineer"),
|
|
("POST", "/service/sla/create"): ("owner", "engineer"),
|
|
("POST", "/service/sla/edit"): ("owner", "engineer"),
|
|
|
|
# === CEO ===
|
|
("GET", "/service/ceo"): ("owner",),
|
|
("POST", "/service/ceo/calc"): ("owner",),
|
|
("POST", "/service/ceo/kpi"): ("owner",),
|
|
|
|
# === COEFFICIENTS ===
|
|
("GET", "/service/coefficients"): ("owner",),
|
|
("POST", "/service/coefficients/edit"): ("owner",),
|
|
("POST", "/service/coefficients/toggle"): ("owner",),
|
|
("POST", "/service/coefficients/create"): ("owner",),
|
|
("POST", "/service/coefficients/delete"): ("owner",),
|
|
("GET", "/service/coefficients/test"): ("owner",),
|
|
("POST", "/service/coefficients/test/{formula_name}"): ("owner",),
|
|
|
|
# === FORMULAS ===
|
|
("GET", "/service/formulas"): ("owner",),
|
|
|
|
# === TASKS ===
|
|
("GET", "/service/tasks"): ("owner", "engineer", "technician"),
|
|
("POST", "/service/tasks/create"): ("owner", "engineer"),
|
|
("POST", "/service/tasks/close"): ("owner", "engineer", "technician"),
|
|
|
|
# === REPORTS ===
|
|
("GET", "/service/reports"): ("owner", "engineer", "technician"),
|
|
("POST", "/service/reports/create"): ("owner", "engineer", "technician"),
|
|
|
|
# === INCIDENTS ===
|
|
("GET", "/service/incidents"): ("owner", "engineer", "technician"),
|
|
("POST", "/service/incidents/create"): ("owner", "engineer"),
|
|
("POST", "/service/incidents/resolve"): ("owner", "engineer", "technician"),
|
|
|
|
# === QUESTIONNAIRE ===
|
|
("GET", "/service/questionnaire"): ("owner", "engineer"),
|
|
("GET", "/service/questionnaire/step/{step}"): ("owner", "engineer"),
|
|
("POST", "/service/questionnaire/save/{step}"): ("owner", "engineer"),
|
|
|
|
# === QUESTIONNAIRE CONFIG ===
|
|
("GET", "/service/questionnaire-config"): ("owner",),
|
|
("POST", "/service/questionnaire-config/create"): ("owner",),
|
|
("POST", "/service/questionnaire-config/edit"): ("owner",),
|
|
("POST", "/service/questionnaire-config/toggle"): ("owner",),
|
|
("POST", "/service/questionnaire-config/delete"): ("owner",),
|
|
|
|
# === PASSPORTS ===
|
|
("GET", "/service/passports"): ("owner", "engineer"),
|
|
|
|
# === CHECKLIST ===
|
|
("GET", "/service/checklist"): ("owner", "technician"),
|
|
("POST", "/service/checklist/complete"): ("owner", "technician"),
|
|
|
|
# === BLOG ===
|
|
("GET", "/service/blog"): ("owner",),
|
|
("POST", "/service/blog/create"): ("owner",),
|
|
("POST", "/service/blog/edit"): ("owner",),
|
|
("POST", "/service/blog/delete"): ("owner",),
|
|
|
|
# === QUICK MENU ===
|
|
("GET", "/service/quick-menu"): ("owner", "engineer"),
|
|
("POST", "/service/quick-menu/save"): ("owner", "engineer"),
|
|
("GET", "/service/api/quick-menu"): ("authenticated",),
|
|
("GET", "/service/quick-menu/tech"): ("engineer",),
|
|
("POST", "/service/quick-menu/tech-save"): ("engineer",),
|
|
|
|
# === IDEAS ===
|
|
("GET", "/service/ideas"): ("owner",),
|
|
("POST", "/service/ideas/create"): ("owner",),
|
|
("POST", "/service/ideas/edit"): ("owner",),
|
|
("POST", "/service/ideas/status"): ("owner",),
|
|
("POST", "/service/ideas/delete"): ("owner",),
|
|
|
|
# === CHARTS ===
|
|
("GET", "/service/charts"): ("owner",),
|
|
("GET", "/service/api/charts/data"): ("owner",),
|
|
|
|
# === CASES ===
|
|
("GET", "/service/cases"): ("owner",),
|
|
("POST", "/service/cases/create"): ("owner",),
|
|
("POST", "/service/cases/edit"): ("owner",),
|
|
("POST", "/service/cases/delete"): ("owner",),
|
|
|
|
# === BOT SETTINGS (pages) ===
|
|
("GET", "/service/bot-settings"): ("owner",),
|
|
("GET", "/service/bot-settings/responses"): ("owner",),
|
|
("GET", "/service/bot-settings/features"): ("owner",),
|
|
("GET", "/service/bot-settings/categories"): ("owner",),
|
|
("GET", "/service/bot-settings/kb"): ("owner",),
|
|
("GET", "/service/bot-settings/conversations"): ("owner",),
|
|
("GET", "/service/bot-settings/users"): ("owner",),
|
|
("GET", "/service/bot-settings/test-runner"): ("owner",),
|
|
("GET", "/service/bot-settings/analytics"): ("owner",),
|
|
("GET", "/service/bot-settings/risk-questions"): ("owner",),
|
|
("GET", "/service/bot-settings/handoffs"): ("owner",),
|
|
("GET", "/service/bot-settings/notifications"): ("owner",),
|
|
("GET", "/service/bot-settings/broadcasts"): ("owner",),
|
|
("GET", "/service/bot-settings/storage"): ("owner",),
|
|
("GET", "/service/bot-settings/tickets"): ("owner",),
|
|
|
|
# === PORTAL / ROLE SETTINGS ===
|
|
("GET", "/service/portal-settings"): ("owner",),
|
|
("GET", "/service/role-settings"): ("owner",),
|
|
|
|
# === ROLE PERMISSIONS API ===
|
|
("GET", "/service/api/role-permissions"): ("owner",),
|
|
("POST", "/service/api/role-permissions/save"): ("owner",),
|
|
|
|
# === ROLE SWITCH API ===
|
|
("POST", "/service/api/role/switch"): ("owner", "engineer"),
|
|
("POST", "/service/api/role/reset"): ("authenticated",),
|
|
|
|
# === BOT API (proxied) ===
|
|
("GET", "/service/api/bot/settings"): ("owner",),
|
|
("POST", "/service/api/bot/settings/save"): ("owner",),
|
|
("GET", "/service/api/bot/templates"): ("owner",),
|
|
("POST", "/service/api/bot/templates/save"): ("owner",),
|
|
("GET", "/service/api/bot/features"): ("owner",),
|
|
("POST", "/service/api/bot/features/toggle"): ("owner",),
|
|
("GET", "/service/api/bot/categories"): ("owner",),
|
|
("POST", "/service/api/bot/categories/create"): ("owner",),
|
|
("POST", "/service/api/bot/categories/edit"): ("owner",),
|
|
("POST", "/service/api/bot/categories/delete"): ("owner",),
|
|
("GET", "/service/api/bot/kb"): ("owner",),
|
|
("POST", "/service/api/bot/kb/create"): ("owner",),
|
|
("POST", "/service/api/bot/kb/edit"): ("owner",),
|
|
("POST", "/service/api/bot/kb/delete"): ("owner",),
|
|
("GET", "/service/api/bot/conversations"): ("owner",),
|
|
("GET", "/service/api/bot/users"): ("owner",),
|
|
("GET", "/service/api/bot/analytics"): ("owner",),
|
|
("POST", "/service/api/bot/test-run"): ("owner",),
|
|
("GET", "/service/api/bot/broadcast/recipients"): ("owner",),
|
|
("GET", "/service/api/bot/broadcast/history"): ("owner",),
|
|
("POST", "/service/api/bot/broadcast"): ("owner",),
|
|
|
|
# === BOT RISK QUESTIONS ===
|
|
("GET", "/service/api/bot/risk-questions"): ("owner",),
|
|
("POST", "/service/api/bot/risk-questions/create"): ("owner",),
|
|
("POST", "/service/api/bot/risk-questions/edit"): ("owner",),
|
|
("POST", "/service/api/bot/risk-questions/toggle"): ("owner",),
|
|
("POST", "/service/api/bot/risk-questions/delete"): ("owner",),
|
|
|
|
# === BOT STORAGE ===
|
|
("GET", "/service/api/bot/storage/list"): ("owner",),
|
|
("GET", "/service/api/bot/storage/search"): ("owner",),
|
|
("GET", "/service/api/bot/storage/public-link"): ("owner",),
|
|
("GET", "/service/api/bot/storage/download"): ("owner",),
|
|
|
|
# === BOT TICKETS ===
|
|
("GET", "/service/api/bot/tickets"): ("owner",),
|
|
("GET", "/service/api/bot/tickets/{ticket_id}"): ("owner",),
|
|
("POST", "/service/api/bot/tickets/create"): ("owner",),
|
|
("POST", "/service/api/bot/tickets/{ticket_id}/message"): ("owner",),
|
|
("POST", "/service/api/bot/tickets/{ticket_id}/status"): ("owner",),
|
|
("GET", "/service/api/bot/engineers"): ("owner",),
|
|
|
|
# === BOT HANDOFFS / NOTIFICATIONS (non-standard paths) ===
|
|
("GET", "/service/bot-settings/handoffs/poll"): ("owner",),
|
|
("POST", "/service/bot-settings/handoffs/{handoff_id}/take"): ("owner",),
|
|
("POST", "/service/api/bot/handoffs/{handoff_id}/close"): ("owner",),
|
|
("GET", "/service/bot-settings/notifications/data"): ("owner",),
|
|
("POST", "/service/bot-settings/notifications/{notif_id}/read"): ("owner",),
|
|
|
|
# === OTHER API (main.py) ===
|
|
("GET", "/service/api/shs"): ("owner", "engineer", "technician"),
|
|
("GET", "/service/api/tasks"): ("owner", "engineer", "technician"),
|
|
("GET", "/service/api/changelog"): ("authenticated",),
|
|
|
|
# === DOCUMENTS ===
|
|
("GET", "/service/documents/"): ("owner", "engineer", "technician"),
|
|
("GET", "/service/documents/admin/permissions"): ("owner",),
|
|
("POST", "/service/documents/admin/permissions"): ("owner",),
|
|
("POST", "/service/documents/admin/create"): ("owner",),
|
|
("GET", "/service/documents/tech-access"): ("engineer",),
|
|
("POST", "/service/documents/tech-access"): ("engineer",),
|
|
("GET", "/service/documents/{slug}"): ("owner", "engineer", "technician"),
|
|
("GET", "/service/documents/{slug}/edit"): ("owner", "engineer"),
|
|
("POST", "/service/documents/{slug}/edit"): ("owner", "engineer"),
|
|
("GET", "/service/documents/{slug}/download"): ("owner",),
|
|
}
|
|
|
|
# Routes with path parameters — skipped in strict permission test
|
|
# but still verified to exist in discover test.
|
|
DYNAMIC_ROUTES: set[tuple[str, str]] = {
|
|
("POST", "/service/coefficients/test/{formula_name}"),
|
|
("GET", "/service/questionnaire/step/{step}"),
|
|
("POST", "/service/questionnaire/save/{step}"),
|
|
("GET", "/service/documents/{slug}"),
|
|
("GET", "/service/documents/{slug}/edit"),
|
|
("POST", "/service/documents/{slug}/edit"),
|
|
("GET", "/service/documents/{slug}/download"),
|
|
("POST", "/service/bot-settings/handoffs/{handoff_id}/take"),
|
|
("POST", "/service/bot-settings/notifications/{notif_id}/read"),
|
|
("POST", "/service/api/bot/handoffs/{handoff_id}/close"),
|
|
("GET", "/service/api/bot/tickets/{ticket_id}"),
|
|
("POST", "/service/api/bot/tickets/{ticket_id}/message"),
|
|
("POST", "/service/api/bot/tickets/{ticket_id}/status"),
|
|
}
|
|
|
|
# Routes excluded from discover test (internal framework routes)
|
|
EXCLUDED_ROUTES: set[tuple[str, str]] = {
|
|
("GET", "/docs"),
|
|
("GET", "/docs/oauth2-redirect"),
|
|
("GET", "/openapi.json"),
|
|
("GET", "/redoc"),
|
|
}
|