From b2babfe382127f936333350b31222699cd047d84 Mon Sep 17 00:00:00 2001 From: momorew Date: Wed, 9 Sep 2026 19:18:56 +0530 Subject: [PATCH] fix:handled the super adminlogin --- app/middleware/auth.py | 10 ++++---- app/modules/auth/routes/role_routes.py | 29 +++++++++++++---------- app/modules/auth/services/role_service.py | 24 +++++++++++++++++-- 3 files changed, 44 insertions(+), 19 deletions(-) diff --git a/app/middleware/auth.py b/app/middleware/auth.py index f37a0ba..7f9eea6 100644 --- a/app/middleware/auth.py +++ b/app/middleware/auth.py @@ -42,13 +42,15 @@ def _validate_saas_subscription(subscription_details: Optional[dict]) -> None: except ValueError: end_date = None - if is_active is False or status_value in {"INACTIVE", "EXPIRED"}: + can_sign_in = subscription_details.get("can_sign_in", True) + if can_sign_in is False or is_active is False or status_value in {"INACTIVE", "EXPIRED"}: raise HTTPException(status_code=403, detail="Tenant subscription is inactive") - if start_date and today < start_date: - raise HTTPException(status_code=403, detail="Tenant subscription is not active yet") + if not (can_sign_in and is_active and status_value == "ACTIVE"): + if start_date and today < start_date: + raise HTTPException(status_code=403, detail="Tenant subscription is not active yet") - if end_date and today > end_date: + if end_date and today > end_date and not subscription_details.get("can_write", True): raise HTTPException(status_code=403, detail="Tenant subscription has expired") diff --git a/app/modules/auth/routes/role_routes.py b/app/modules/auth/routes/role_routes.py index 65a63aa..37d7fda 100644 --- a/app/modules/auth/routes/role_routes.py +++ b/app/modules/auth/routes/role_routes.py @@ -54,19 +54,22 @@ def _assert_role_in_callers_tenant(role, current_user: User, db: Session = None, if role.tenant_id == current_user.tenant_id: return - if allow_system_roles and getattr(role, "is_system", False) and current_user.tenant_id and db: - from app.modules.billing.models.plan_model import TenantSubscription, PlanRole - sub = db.query(TenantSubscription).filter( - TenantSubscription.tenant_id == current_user.tenant_id, - TenantSubscription.status == 'active' - ).order_by(TenantSubscription.created_at.desc()).first() - if sub and sub.plan_id: - has_role = db.query(PlanRole).filter( - PlanRole.plan_id == sub.plan_id, - PlanRole.role_id == role.id - ).first() - if has_role: - return + if allow_system_roles: + if getattr(role, "tenant_id", None) is None and getattr(role, "name", "").lower() != "superadmin": + return + if getattr(role, "is_system", False) and current_user.tenant_id and db: + from app.modules.billing.models.plan_model import TenantSubscription, PlanRole + sub = db.query(TenantSubscription).filter( + TenantSubscription.tenant_id == current_user.tenant_id, + TenantSubscription.status == 'active' + ).order_by(TenantSubscription.created_at.desc()).first() + if sub and sub.plan_id: + has_role = db.query(PlanRole).filter( + PlanRole.plan_id == sub.plan_id, + PlanRole.role_id == role.id + ).first() + if has_role: + return raise HTTPException( status_code=status.HTTP_404_NOT_FOUND, detail="Role not found" diff --git a/app/modules/auth/services/role_service.py b/app/modules/auth/services/role_service.py index 1708421..e04c0a0 100644 --- a/app/modules/auth/services/role_service.py +++ b/app/modules/auth/services/role_service.py @@ -63,6 +63,7 @@ class RoleService: query = db.query(Role) if tenant_id is not None: from app.modules.billing.models.plan_model import TenantSubscription, PlanRole + from sqlalchemy import and_, func sub = db.query(TenantSubscription).filter( TenantSubscription.tenant_id == tenant_id, TenantSubscription.status == 'active' @@ -72,7 +73,16 @@ class RoleService: plan_role_ids = [pr.role_id for pr in plan_roles] query = query.filter(or_(Role.tenant_id == tenant_id, Role.id.in_(plan_role_ids))) else: - query = query.filter(Role.tenant_id == tenant_id) + # Include tenant roles AND tenant-accessible default/system roles (excluding superadmin) + query = query.filter( + or_( + Role.tenant_id == tenant_id, + and_( + Role.tenant_id.is_(None), + func.lower(Role.name) != 'superadmin' + ) + ) + ) return query.all() @staticmethod @@ -135,6 +145,7 @@ class RoleService: query = db.query(Role) if tenant_id is not None: from app.modules.billing.models.plan_model import TenantSubscription, PlanRole + from sqlalchemy import and_, func sub = db.query(TenantSubscription).filter( TenantSubscription.tenant_id == tenant_id, TenantSubscription.status == 'active' @@ -144,7 +155,16 @@ class RoleService: plan_role_ids = [pr.role_id for pr in plan_roles] query = query.filter(or_(Role.tenant_id == tenant_id, Role.id.in_(plan_role_ids))) else: - query = query.filter(Role.tenant_id == tenant_id) + # Include tenant roles AND tenant-accessible default/system roles (excluding superadmin) + query = query.filter( + or_( + Role.tenant_id == tenant_id, + and_( + Role.tenant_id.is_(None), + func.lower(Role.name) != 'superadmin' + ) + ) + ) if search and search.strip(): search_term = search.strip() query = query.filter(Role.name.ilike(f"%{search_term}%"))