angel
72b6879f4b
- Refactored max_bot from nested packages to flat module structure - Q2: Extended BotUser model (patronymic, email, org, address, vcf_raw, contact_hash, phone_verified, email_verified, last_interaction, total_conversations, total_tickets) - Q2: VCF parser (FN, N, TEL, EMAIL, ORG, ADR), upsert on re-contact, NLP history context (_get_user_history_context -> YandexGPT) - Q1: Broadcast preview modal with 10s confirmation timer - Q3: CSS var(--white)->var(--bg-card), var(--text)->var(--text-primary) - Q4: bot_settings showNotification(), editable max_bot_id - Q5: Webhook secret passthrough via X-Max-Bot-Api-Secret - Masking sensitive keys, dialog_cleared handler, migrate via _add_column_if_not_exists() - Rate limit (asyncio.sleep 0.5 per 10), dead code removed, conv.intent context in contact.py - Portal pages: bot_consent, bot_kb (edit), bot_settings, bot_test, bot_tickets, portal_settings - Tests: 21/21 passing, added test_yandex_gpt.py, test_email_sender.py - Deploy: deploy_full.sh, schema.sql, seed_knowledge_base.sql
185 lines
7.7 KiB
Python
185 lines
7.7 KiB
Python
"""Central permission configuration for all service routes.
|
|
|
|
Every route must be listed here. test_00_discover_routes.py enforces this.
|
|
|
|
Format:
|
|
ROUTE_PERMISSIONS[(method, path)] = (role1, role2, ...)
|
|
- "anonymous" means no auth required (public)
|
|
- "authenticated" means any logged-in user
|
|
|
|
Adding a new route? Add it here first — the discover test will fail otherwise.
|
|
"""
|
|
|
|
ROLES = ("owner", "engineer", "technician")
|
|
|
|
ROUTE_PERMISSIONS: dict[tuple[str, str], tuple[str, ...]] = {
|
|
# === PUBLIC ===
|
|
("GET", "/health"): ("anonymous",),
|
|
("GET", "/service/login"): ("anonymous",),
|
|
("POST", "/service/login"): ("anonymous",),
|
|
("GET", "/"): ("anonymous",),
|
|
|
|
# === AUTH ===
|
|
("GET", "/service/logout"): ("authenticated",),
|
|
|
|
# === DASHBOARD ===
|
|
("GET", "/service/dashboard"): ("owner", "engineer", "technician"),
|
|
|
|
# === USERS ===
|
|
("GET", "/service/users"): ("owner",),
|
|
("POST", "/service/users/create"): ("owner",),
|
|
("POST", "/service/users/edit"): ("owner",),
|
|
("POST", "/service/users/delete"): ("owner",),
|
|
|
|
# === CUSTOMERS ===
|
|
("GET", "/service/customers"): ("owner", "engineer"),
|
|
("POST", "/service/customers/create"): ("owner", "engineer"),
|
|
("POST", "/service/customers/edit"): ("owner", "engineer"),
|
|
("POST", "/service/customers/delete"): ("owner",),
|
|
|
|
# === OBJECTS ===
|
|
("GET", "/service/objects"): ("owner", "engineer"),
|
|
("POST", "/service/objects/create"): ("owner", "engineer"),
|
|
("POST", "/service/objects/edit"): ("owner", "engineer"),
|
|
("POST", "/service/objects/delete"): ("owner",),
|
|
|
|
# === ASSIGNMENTS ===
|
|
("GET", "/service/assignments"): ("owner",),
|
|
("POST", "/service/assignments/create"): ("owner",),
|
|
("POST", "/service/assignments/unassign"): ("owner",),
|
|
|
|
# === SLA ===
|
|
("GET", "/service/sla"): ("owner", "engineer"),
|
|
("POST", "/service/sla/create"): ("owner", "engineer"),
|
|
("POST", "/service/sla/edit"): ("owner", "engineer"),
|
|
|
|
# === CEO ===
|
|
("GET", "/service/ceo"): ("owner",),
|
|
("POST", "/service/ceo/calc"): ("owner",),
|
|
("POST", "/service/ceo/kpi"): ("owner",),
|
|
|
|
# === COEFFICIENTS ===
|
|
("GET", "/service/coefficients"): ("owner",),
|
|
("POST", "/service/coefficients/edit"): ("owner",),
|
|
("POST", "/service/coefficients/toggle"): ("owner",),
|
|
("POST", "/service/coefficients/create"): ("owner",),
|
|
("POST", "/service/coefficients/delete"): ("owner",),
|
|
("GET", "/service/coefficients/test"): ("owner",),
|
|
("POST", "/service/coefficients/test/{formula_name}"): ("owner",),
|
|
|
|
# === FORMULAS ===
|
|
("GET", "/service/formulas"): ("owner",),
|
|
|
|
# === TASKS ===
|
|
("GET", "/service/tasks"): ("owner", "engineer", "technician"),
|
|
("POST", "/service/tasks/create"): ("owner", "engineer"),
|
|
("POST", "/service/tasks/close"): ("owner", "engineer", "technician"),
|
|
|
|
# === REPORTS ===
|
|
("GET", "/service/reports"): ("owner", "engineer", "technician"),
|
|
("POST", "/service/reports/create"): ("owner", "engineer", "technician"),
|
|
|
|
# === INCIDENTS ===
|
|
("GET", "/service/incidents"): ("owner", "engineer", "technician"),
|
|
("POST", "/service/incidents/create"): ("owner", "engineer"),
|
|
("POST", "/service/incidents/resolve"): ("owner", "engineer", "technician"),
|
|
|
|
# === QUESTIONNAIRE ===
|
|
("GET", "/service/questionnaire"): ("owner", "engineer"),
|
|
("GET", "/service/questionnaire/step/{step}"): ("owner", "engineer"),
|
|
("POST", "/service/questionnaire/save/{step}"): ("owner", "engineer"),
|
|
|
|
# === QUESTIONNAIRE CONFIG ===
|
|
("GET", "/service/questionnaire-config"): ("owner",),
|
|
("POST", "/service/questionnaire-config/create"): ("owner",),
|
|
("POST", "/service/questionnaire-config/edit"): ("owner",),
|
|
("POST", "/service/questionnaire-config/toggle"): ("owner",),
|
|
("POST", "/service/questionnaire-config/delete"): ("owner",),
|
|
|
|
# === PASSPORTS ===
|
|
("GET", "/service/passports"): ("owner", "engineer"),
|
|
|
|
# === CHECKLIST ===
|
|
("GET", "/service/checklist"): ("owner", "technician"),
|
|
("POST", "/service/checklist/complete"): ("owner", "technician"),
|
|
|
|
# === BLOG ===
|
|
("GET", "/service/blog"): ("owner",),
|
|
("POST", "/service/blog/create"): ("owner",),
|
|
("POST", "/service/blog/edit"): ("owner",),
|
|
("POST", "/service/blog/delete"): ("owner",),
|
|
|
|
# === QUICK MENU ===
|
|
("GET", "/service/quick-menu"): ("owner", "engineer"),
|
|
("POST", "/service/quick-menu/save"): ("owner", "engineer"),
|
|
("GET", "/service/api/quick-menu"): ("authenticated",),
|
|
("GET", "/service/quick-menu/tech"): ("engineer",),
|
|
("POST", "/service/quick-menu/tech-save"): ("engineer",),
|
|
|
|
# === IDEAS ===
|
|
("GET", "/service/ideas"): ("owner",),
|
|
("POST", "/service/ideas/create"): ("owner",),
|
|
("POST", "/service/ideas/edit"): ("owner",),
|
|
("POST", "/service/ideas/status"): ("owner",),
|
|
("POST", "/service/ideas/delete"): ("owner",),
|
|
|
|
# === CHARTS ===
|
|
("GET", "/service/charts"): ("owner",),
|
|
("GET", "/service/api/charts/data"): ("owner",),
|
|
|
|
# === CASES ===
|
|
("GET", "/service/cases"): ("owner",),
|
|
("POST", "/service/cases/create"): ("owner",),
|
|
("POST", "/service/cases/edit"): ("owner",),
|
|
("POST", "/service/cases/delete"): ("owner",),
|
|
|
|
# === PORTAL / ROLE SETTINGS ===
|
|
("GET", "/service/portal-settings"): ("owner",),
|
|
("GET", "/service/role-settings"): ("owner",),
|
|
|
|
# === ROLE PERMISSIONS API ===
|
|
("GET", "/service/api/role-permissions"): ("owner",),
|
|
("POST", "/service/api/role-permissions/save"): ("owner",),
|
|
|
|
# === ROLE SWITCH API ===
|
|
("POST", "/service/api/role/switch"): ("owner", "engineer"),
|
|
("POST", "/service/api/role/reset"): ("authenticated",),
|
|
|
|
# === OTHER API (main.py) ===
|
|
("GET", "/service/api/shs"): ("owner", "engineer", "technician"),
|
|
("GET", "/service/api/tasks"): ("owner", "engineer", "technician"),
|
|
("GET", "/service/api/changelog"): ("authenticated",),
|
|
|
|
# === DOCUMENTS ===
|
|
("GET", "/service/documents/"): ("owner", "engineer", "technician"),
|
|
("GET", "/service/documents/admin/permissions"): ("owner",),
|
|
("POST", "/service/documents/admin/permissions"): ("owner",),
|
|
("POST", "/service/documents/admin/create"): ("owner",),
|
|
("GET", "/service/documents/tech-access"): ("engineer",),
|
|
("POST", "/service/documents/tech-access"): ("engineer",),
|
|
("GET", "/service/documents/{slug}"): ("owner", "engineer", "technician"),
|
|
("GET", "/service/documents/{slug}/edit"): ("owner", "engineer"),
|
|
("POST", "/service/documents/{slug}/edit"): ("owner", "engineer"),
|
|
("GET", "/service/documents/{slug}/download"): ("owner",),
|
|
}
|
|
|
|
# Routes with path parameters — skipped in strict permission test
|
|
# but still verified to exist in discover test.
|
|
DYNAMIC_ROUTES: set[tuple[str, str]] = {
|
|
("POST", "/service/coefficients/test/{formula_name}"),
|
|
("GET", "/service/questionnaire/step/{step}"),
|
|
("POST", "/service/questionnaire/save/{step}"),
|
|
("GET", "/service/documents/{slug}"),
|
|
("GET", "/service/documents/{slug}/edit"),
|
|
("POST", "/service/documents/{slug}/edit"),
|
|
("GET", "/service/documents/{slug}/download"),
|
|
}
|
|
|
|
# Routes excluded from discover test (internal framework routes)
|
|
EXCLUDED_ROUTES: set[tuple[str, str]] = {
|
|
("GET", "/docs"),
|
|
("GET", "/docs/oauth2-redirect"),
|
|
("GET", "/openapi.json"),
|
|
("GET", "/redoc"),
|
|
}
|