diff --git a/src/baby_monitor/models/auth.py b/src/baby_monitor/models/auth.py index 2b35530..2b4ae0f 100644 --- a/src/baby_monitor/models/auth.py +++ b/src/baby_monitor/models/auth.py @@ -16,6 +16,7 @@ class LoginResponse(BaseModel): message: str username: str access_token: str + is_admin: bool token_type: str = "bearer" @@ -33,4 +34,5 @@ class RegisterResponse(BaseModel): message: str username: str access_token: str + is_admin: bool token_type: str = "bearer" diff --git a/src/baby_monitor/routers/auth.py b/src/baby_monitor/routers/auth.py index bc5f27e..43edc48 100644 --- a/src/baby_monitor/routers/auth.py +++ b/src/baby_monitor/routers/auth.py @@ -57,15 +57,24 @@ def verify_admin( ], ) -> int: """Verify the user is an admin and return user_id.""" + # First try to get user from database user = user_repo.get_by_id(user_id) - if not user: - raise HTTPException(status_code=401, detail="User not found") + if user: + # Database user - check is_admin field + if not user.get("is_admin", False): + raise HTTPException( + status_code=403, detail="Admin access required" + ) + return user_id - if not user.get("is_admin", False): - raise HTTPException(status_code=403, detail="Admin access required") + # If not in database but has valid token with user_id=1, + # it's the environment-based admin (only assigned during env admin login) + if user_id == 1: + return user_id - return user_id + # User not found and not environment admin + raise HTTPException(status_code=401, detail="User not found") @router.post("/login", response_model=LoginResponse) @@ -101,6 +110,7 @@ def login( message="Login successful", username=credentials.username, access_token=access_token, + is_admin=user.get("is_admin", False), ) # Fallback to admin credentials from environment @@ -116,6 +126,7 @@ def login( message="Login successful", username=credentials.username, access_token=access_token, + is_admin=True, ) raise HTTPException( @@ -200,6 +211,7 @@ def register( message="Registration successful", username=user["username"], access_token=access_token, + is_admin=user.get("is_admin", False), ) @@ -209,12 +221,21 @@ def get_current_user( user_repo: Annotated[ UserRepositoryInterface, Depends(get_user_repository) ], + creds_repo: Annotated[ + CredentialsRepositoryInterface, Depends(get_credentials_repository) + ], ) -> dict: """Get current user info including admin status.""" user = user_repo.get_by_id(user_id) + # If user not found in DB, might be env-based admin if not user: - raise HTTPException(status_code=404, detail="User not found") + # Return admin info from environment + return { + "id": user_id, + "username": creds_repo.get_admin_username(), + "is_admin": True, # Env-based admin is always admin + } return { "id": user["id"], diff --git a/src/baby_monitor/static/login.html b/src/baby_monitor/static/login.html index 8b298c2..8d2ca9e 100644 --- a/src/baby_monitor/static/login.html +++ b/src/baby_monitor/static/login.html @@ -112,9 +112,14 @@ // Store token in localStorage localStorage.setItem("access_token", data.access_token); localStorage.setItem("username", data.username); - // Redirect to home page + + // Redirect based on is_admin from login response setTimeout(() => { - window.location.href = "/"; + if (data.is_admin === true) { + window.location.href = "/admin.html"; + } else { + window.location.href = "/"; + } }, 1000); } else { showMessage(data.detail || "Login failed", "error");