From b9ed1d89e21d877e1dfec732b9aaed903814c30b Mon Sep 17 00:00:00 2001 From: lucasbutzke Date: Thu, 24 Jul 2025 16:43:41 -0400 Subject: [PATCH] [RTOP-26] Future use for admin user --- webserver/restapi.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/webserver/restapi.py b/webserver/restapi.py index cef06b3..af91df6 100644 --- a/webserver/restapi.py +++ b/webserver/restapi.py @@ -28,6 +28,11 @@ class User(db.Model): id: int = db.Column(db.Integer, primary_key=True) username: str = db.Column(db.Text, nullable=False, unique=True) password_hash: str = db.Column(db.Text, nullable=False) + # TODO implement roles + # For now, we will just use "user" and "admin" + # In the future, we can implement more roles like "guest", "editor", etc + # and use them to control access to different parts of the API + role = db.Column(db.String(20), default="user") # Use PBKDF2 with SHA256 and 600,000 iterations for password hashing derivation_method: str = "pbkdf2:sha256:600000" @@ -43,6 +48,9 @@ class User(db.Model): print(f"Checking password {self.password_hash} | {password}") return check_password_hash(self.password_hash, password) + def to_dict(self): + return {"id": self.id, "username": self.username, "role": self.role} + @jwt.user_identity_loader def user_identity_lookup(user): @@ -63,6 +71,10 @@ def register_callback_post(callback: Callable[[str, dict], dict]): _handler_callback_post = callback print("POST Callback registered successfully for rest_blueprint!") +# TODO implement role-based access control +# For now, we will just check if the user is an admin +def is_admin(): + return current_user.role == "admin" @restapi_bp.route("/users", methods=["POST"]) def create_user():