the37lab-authlib 0.1.1757062387__tar.gz → 0.1.1758264497__tar.gz

{the37lab_authlib-0.1.1757062387 → the37lab_authlib-0.1.1758264497}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: the37lab_authlib
-Version: 0.1.1757062387
+Version: 0.1.1758264497
 Summary: Python SDK for the Authlib
 Author-email: the37lab <info@the37lab.com>
 Classifier: Programming Language :: Python :: 3

{the37lab_authlib-0.1.1757062387 → the37lab_authlib-0.1.1758264497}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "the37lab_authlib"
-version = "0.1.1757062387"
+version = "0.1.1758264497"
 description = "Python SDK for the Authlib"
 authors = [{name = "the37lab", email = "info@the37lab.com"}]
 dependencies = ["flask", "psycopg2-binary", "pyjwt", "python-dotenv", "requests", "authlib", "bcrypt", "msal"]

{the37lab_authlib-0.1.1757062387 → the37lab_authlib-0.1.1758264497}/src/the37lab_authlib/auth.py

@@ -488,6 +488,291 @@ class AuthManager:
                 roles = cur.fetchall()
             return jsonify(roles)
 
+        # Admin endpoints - require administrator role
+        @bp.route('/admin/users', methods=['GET'])
+        def admin_get_users():
+            self._require_admin_role()
+            with self.db.get_cursor() as cur:
+                cur.execute("""
+                    SELECT u.*, 
+                           COALESCE(array_agg(r.name) FILTER (WHERE r.name IS NOT NULL), '{}') as roles
+                    FROM users u
+                    LEFT JOIN user_roles ur ON ur.user_id = u.id
+                    LEFT JOIN roles r ON ur.role_id = r.id
+                    GROUP BY u.id, u.username, u.email, u.real_name, u.created_at, u.updated_at
+                    ORDER BY u.created_at DESC
+                """)
+                users = cur.fetchall()
+            return jsonify(users)
+
+        @bp.route('/admin/users', methods=['POST'])
+        def admin_create_user():
+            self._require_admin_role()
+            data = request.get_json()
+            
+            # Validate required fields
+            required_fields = ['username', 'email', 'real_name', 'password']
+            for field in required_fields:
+                if not data.get(field):
+                    raise AuthError(f'{field} is required', 400)
+            
+            # Hash the password
+            salt = bcrypt.gensalt()
+            password_hash = bcrypt.hashpw(data['password'].encode('utf-8'), salt)
+            
+            with self.db.get_cursor() as cur:
+                # Check if username or email already exists
+                cur.execute("SELECT id FROM users WHERE username = %s OR email = %s", 
+                           (data['username'], data['email']))
+                if cur.fetchone():
+                    raise AuthError('Username or email already exists', 400)
+                
+                # Create user
+                cur.execute("""
+                    INSERT INTO users (username, email, real_name, password_hash, created_at, updated_at)
+                    VALUES (%s, %s, %s, %s, %s, %s)
+                    RETURNING id
+                """, (data['username'], data['email'], data['real_name'], 
+                      password_hash.decode('utf-8'), datetime.utcnow(), datetime.utcnow()))
+                user_id = cur.fetchone()['id']
+                
+                # Assign roles if provided
+                if data.get('roles'):
+                    for role_name in data['roles']:
+                        cur.execute("SELECT id FROM roles WHERE name = %s", (role_name,))
+                        role = cur.fetchone()
+                        if role:
+                            cur.execute("""
+                                INSERT INTO user_roles (user_id, role_id)
+                                VALUES (%s, %s)
+                                ON CONFLICT (user_id, role_id) DO NOTHING
+                            """, (user_id, role['id']))
+            
+            return jsonify({'id': user_id}), 201
+
+        @bp.route('/admin/users/<user_id>', methods=['PUT'])
+        def admin_update_user(user_id):
+            self._require_admin_role()
+            data = request.get_json()
+            
+            with self.db.get_cursor() as cur:
+                # Check if user exists
+                cur.execute("SELECT id FROM users WHERE id = %s", (user_id,))
+                if not cur.fetchone():
+                    raise AuthError('User not found', 404)
+                
+                # Update user fields
+                update_fields = []
+                update_values = []
+                
+                if 'username' in data:
+                    update_fields.append('username = %s')
+                    update_values.append(data['username'])
+                if 'email' in data:
+                    update_fields.append('email = %s')
+                    update_values.append(data['email'])
+                if 'real_name' in data:
+                    update_fields.append('real_name = %s')
+                    update_values.append(data['real_name'])
+                if 'password' in data:
+                    salt = bcrypt.gensalt()
+                    password_hash = bcrypt.hashpw(data['password'].encode('utf-8'), salt)
+                    update_fields.append('password_hash = %s')
+                    update_values.append(password_hash.decode('utf-8'))
+                
+                if update_fields:
+                    update_fields.append('updated_at = %s')
+                    update_values.append(datetime.utcnow())
+                    update_values.append(user_id)
+                    
+                    cur.execute(f"""
+                        UPDATE users 
+                        SET {', '.join(update_fields)}
+                        WHERE id = %s
+                    """, update_values)
+                
+                # Update roles if provided
+                if 'roles' in data:
+                    # Remove existing roles
+                    cur.execute("DELETE FROM user_roles WHERE user_id = %s", (user_id,))
+                    
+                    # Add new roles
+                    for role_name in data['roles']:
+                        cur.execute("SELECT id FROM roles WHERE name = %s", (role_name,))
+                        role = cur.fetchone()
+                        if role:
+                            cur.execute("""
+                                INSERT INTO user_roles (user_id, role_id)
+                                VALUES (%s, %s)
+                            """, (user_id, role['id']))
+            
+            return jsonify({'success': True})
+
+        @bp.route('/admin/users/<user_id>', methods=['DELETE'])
+        def admin_delete_user(user_id):
+            self._require_admin_role()
+            
+            with self.db.get_cursor() as cur:
+                # Check if user exists
+                cur.execute("SELECT id FROM users WHERE id = %s", (user_id,))
+                if not cur.fetchone():
+                    raise AuthError('User not found', 404)
+                
+                # Delete user (cascade will handle related records)
+                cur.execute("DELETE FROM users WHERE id = %s", (user_id,))
+            
+            return jsonify({'success': True})
+
+        @bp.route('/admin/roles', methods=['GET'])
+        def admin_get_roles():
+            self._require_admin_role()
+            with self.db.get_cursor() as cur:
+                cur.execute("SELECT * FROM roles ORDER BY name")
+                roles = cur.fetchall()
+            return jsonify(roles)
+
+        @bp.route('/admin/roles', methods=['POST'])
+        def admin_create_role():
+            self._require_admin_role()
+            data = request.get_json()
+            
+            if not data.get('name'):
+                raise AuthError('Role name is required', 400)
+            
+            with self.db.get_cursor() as cur:
+                # Check if role already exists
+                cur.execute("SELECT id FROM roles WHERE name = %s", (data['name'],))
+                if cur.fetchone():
+                    raise AuthError('Role already exists', 400)
+                
+                cur.execute("""
+                    INSERT INTO roles (name, description, created_at)
+                    VALUES (%s, %s, %s)
+                    RETURNING id
+                """, (data['name'], data.get('description', ''), datetime.utcnow()))
+                role_id = cur.fetchone()['id']
+            
+            return jsonify({'id': role_id}), 201
+
+        @bp.route('/admin/roles/<role_id>', methods=['PUT'])
+        def admin_update_role(role_id):
+            self._require_admin_role()
+            data = request.get_json()
+            
+            with self.db.get_cursor() as cur:
+                # Check if role exists
+                cur.execute("SELECT id FROM roles WHERE id = %s", (role_id,))
+                if not cur.fetchone():
+                    raise AuthError('Role not found', 404)
+                
+                update_fields = []
+                update_values = []
+                
+                if 'name' in data:
+                    update_fields.append('name = %s')
+                    update_values.append(data['name'])
+                if 'description' in data:
+                    update_fields.append('description = %s')
+                    update_values.append(data['description'])
+                
+                if update_fields:
+                    update_values.append(role_id)
+                    cur.execute(f"""
+                        UPDATE roles 
+                        SET {', '.join(update_fields)}
+                        WHERE id = %s
+                    """, update_values)
+            
+            return jsonify({'success': True})
+
+        @bp.route('/admin/roles/<role_id>', methods=['DELETE'])
+        def admin_delete_role(role_id):
+            self._require_admin_role()
+            
+            with self.db.get_cursor() as cur:
+                # Check if role exists
+                cur.execute("SELECT id FROM roles WHERE id = %s", (role_id,))
+                if not cur.fetchone():
+                    raise AuthError('Role not found', 404)
+                
+                # Check if role is assigned to any users
+                cur.execute("SELECT COUNT(*) as count FROM user_roles WHERE role_id = %s", (role_id,))
+                count = cur.fetchone()['count']
+                if count > 0:
+                    raise AuthError('Cannot delete role that is assigned to users', 400)
+                
+                cur.execute("DELETE FROM roles WHERE id = %s", (role_id,))
+            
+            return jsonify({'success': True})
+
+        @bp.route('/admin/api-tokens', methods=['GET'])
+        def admin_get_all_tokens():
+            self._require_admin_role()
+            with self.db.get_cursor() as cur:
+                cur.execute("""
+                    SELECT t.*, u.username, u.email
+                    FROM api_tokens t
+                    JOIN users u ON t.user_id = u.id
+                    ORDER BY t.created_at DESC
+                """)
+                tokens = cur.fetchall()
+            return jsonify(tokens)
+
+        @bp.route('/admin/api-tokens', methods=['POST'])
+        def admin_create_token():
+            self._require_admin_role()
+            data = request.get_json()
+            
+            if not data.get('user_id') or not data.get('name'):
+                raise AuthError('user_id and name are required', 400)
+            
+            expires_in_days = data.get('expires_in_days')
+            token = self.create_api_token(data['user_id'], data['name'], expires_in_days)
+            
+            return jsonify({
+                'id': token.id,
+                'name': token.name,
+                'token': token.get_full_token(),
+                'created_at': token.created_at,
+                'expires_at': token.expires_at
+            }), 201
+
+        @bp.route('/admin/api-tokens/<token_id>', methods=['DELETE'])
+        def admin_delete_token(token_id):
+            self._require_admin_role()
+            
+            with self.db.get_cursor() as cur:
+                cur.execute("DELETE FROM api_tokens WHERE id = %s", (token_id,))
+                if cur.rowcount == 0:
+                    raise AuthError('Token not found', 404)
+            
+            return jsonify({'success': True})
+
+        @bp.route('/admin/invite', methods=['POST'])
+        def admin_send_invitation():
+            self._require_admin_role()
+            data = request.get_json()
+            
+            if not data.get('email'):
+                raise AuthError('Email is required', 400)
+            
+            # Check if user already exists
+            with self.db.get_cursor() as cur:
+                cur.execute("SELECT id FROM users WHERE email = %s", (data['email'],))
+                if cur.fetchone():
+                    raise AuthError('User with this email already exists', 400)
+            
+            # Send invitation email (placeholder - implement actual email sending)
+            invitation_token = str(uuid.uuid4())
+            
+            # Store invitation in database (you might want to create an invitations table)
+            # For now, we'll just return success
+            return jsonify({
+                'success': True,
+                'message': f'Invitation sent to {data["email"]}',
+                'invitation_token': invitation_token
+            })
+
         return bp
 
     def validate_token(self, token):
@@ -616,6 +901,12 @@ class AuthManager:
     def get_current_user(self):
         return self._authenticate_request()
 
+    def _require_admin_role(self):
+        """Require the current user to have administrator role."""
+        user = g.requesting_user
+        if not user or 'administrator' not in user.get('roles', []):
+            raise AuthError('Administrator role required', 403)
+
     def get_user_api_tokens(self, user_id):
         """Get all API tokens for a user."""
         with self.db.get_cursor() as cur:

{the37lab_authlib-0.1.1757062387 → the37lab_authlib-0.1.1758264497}/src/the37lab_authlib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: the37lab_authlib
-Version: 0.1.1757062387
+Version: 0.1.1758264497
 Summary: Python SDK for the Authlib
 Author-email: the37lab <info@the37lab.com>
 Classifier: Programming Language :: Python :: 3