87 lines
3.1 KiB
Python
87 lines
3.1 KiB
Python
"""
|
|
Access control for Real Estate interface.
|
|
Handles user access management and permission checks.
|
|
"""
|
|
|
|
import logging
|
|
from typing import Dict, Any, List, Optional
|
|
from modules.datamodels.datamodelUam import User, UserPrivilege
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
|
|
class RealEstateAccess:
|
|
"""
|
|
Access control class for Real Estate interface.
|
|
Handles user access management and permission checks.
|
|
"""
|
|
|
|
def __init__(self, currentUser: User, db):
|
|
"""Initialize with user context."""
|
|
self.currentUser = currentUser
|
|
self.mandateId = currentUser.mandateId
|
|
self.userId = currentUser.id
|
|
self.privilege = currentUser.privilege
|
|
|
|
if not self.mandateId or not self.userId:
|
|
raise ValueError("Invalid user context: mandateId and userId are required")
|
|
|
|
self.db = db
|
|
|
|
def uam(self, model_class: type, recordset: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
|
|
"""
|
|
Unified user access management function that filters data based on user privileges.
|
|
|
|
Args:
|
|
model_class: Pydantic model class for the table
|
|
recordset: Recordset to filter based on access rules
|
|
|
|
Returns:
|
|
Filtered recordset with access control attributes
|
|
"""
|
|
filtered_records = []
|
|
|
|
# System admins see all records
|
|
if self.privilege == UserPrivilege.SYSADMIN:
|
|
filtered_records = recordset
|
|
# Admins see records in their mandate
|
|
elif self.privilege == UserPrivilege.ADMIN:
|
|
filtered_records = [r for r in recordset if r.get("mandateId", "-") == self.mandateId]
|
|
# Regular users see only their records
|
|
else:
|
|
filtered_records = [
|
|
r for r in recordset
|
|
if r.get("mandateId", "-") == self.mandateId and r.get("_createdBy") == self.userId
|
|
]
|
|
|
|
# Add access control attributes
|
|
for record in filtered_records:
|
|
record["_hideView"] = False
|
|
record["_hideEdit"] = not self.canModify(model_class, record.get("id"))
|
|
record["_hideDelete"] = not self.canModify(model_class, record.get("id"))
|
|
|
|
return filtered_records
|
|
|
|
def canModify(self, model_class: type, recordId: Optional[str] = None) -> bool:
|
|
"""Checks if the current user can modify records."""
|
|
if self.privilege == UserPrivilege.SYSADMIN:
|
|
return True
|
|
|
|
if recordId is not None:
|
|
records = self.db.getRecordset(model_class, recordFilter={"id": recordId})
|
|
if not records:
|
|
return False
|
|
|
|
record = records[0]
|
|
|
|
if self.privilege == UserPrivilege.ADMIN and record.get("mandateId", "-") == self.mandateId:
|
|
return True
|
|
|
|
if (record.get("mandateId", "-") == self.mandateId and
|
|
record.get("_createdBy") == self.userId):
|
|
return True
|
|
|
|
return False
|
|
else:
|
|
return True # Regular users can create records
|
|
|