fix:handled the super adminlogin

app/middleware/auth.py

@@ -42,13 +42,15 @@ def _validate_saas_subscription(subscription_details: Optional[dict]) -> None:
     except ValueError:
         end_date = None
 
-    if is_active is False or status_value in {"INACTIVE", "EXPIRED"}:
+    can_sign_in = subscription_details.get("can_sign_in", True)
+    if can_sign_in is False or is_active is False or status_value in {"INACTIVE", "EXPIRED"}:
         raise HTTPException(status_code=403, detail="Tenant subscription is inactive")
 
+    if not (can_sign_in and is_active and status_value == "ACTIVE"):
         if start_date and today < start_date:
             raise HTTPException(status_code=403, detail="Tenant subscription is not active yet")
 
-    if end_date and today > end_date:
+    if end_date and today > end_date and not subscription_details.get("can_write", True):
         raise HTTPException(status_code=403, detail="Tenant subscription has expired")
 
 

app/modules/auth/routes/role_routes.py

@@ -54,7 +54,10 @@ def _assert_role_in_callers_tenant(role, current_user: User, db: Session = None,
     if role.tenant_id == current_user.tenant_id:
         return
         
-    if allow_system_roles and getattr(role, "is_system", False) and current_user.tenant_id and db:
+    if allow_system_roles:
+        if getattr(role, "tenant_id", None) is None and getattr(role, "name", "").lower() != "superadmin":
+            return
+        if getattr(role, "is_system", False) and current_user.tenant_id and db:
             from app.modules.billing.models.plan_model import TenantSubscription, PlanRole
             sub = db.query(TenantSubscription).filter(
                 TenantSubscription.tenant_id == current_user.tenant_id,

app/modules/auth/services/role_service.py

@@ -63,6 +63,7 @@ class RoleService:
         query = db.query(Role)
         if tenant_id is not None:
             from app.modules.billing.models.plan_model import TenantSubscription, PlanRole
+            from sqlalchemy import and_, func
             sub = db.query(TenantSubscription).filter(
                 TenantSubscription.tenant_id == tenant_id,
                 TenantSubscription.status == 'active'
@@ -72,7 +73,16 @@ class RoleService:
                 plan_role_ids = [pr.role_id for pr in plan_roles]
                 query = query.filter(or_(Role.tenant_id == tenant_id, Role.id.in_(plan_role_ids)))
             else:
-                query = query.filter(Role.tenant_id == tenant_id)
+                # Include tenant roles AND tenant-accessible default/system roles (excluding superadmin)
+                query = query.filter(
+                    or_(
+                        Role.tenant_id == tenant_id,
+                        and_(
+                            Role.tenant_id.is_(None),
+                            func.lower(Role.name) != 'superadmin'
+                        )
+                    )
+                )
         return query.all()
 
     @staticmethod
@@ -135,6 +145,7 @@ class RoleService:
         query = db.query(Role)
         if tenant_id is not None:
             from app.modules.billing.models.plan_model import TenantSubscription, PlanRole
+            from sqlalchemy import and_, func
             sub = db.query(TenantSubscription).filter(
                 TenantSubscription.tenant_id == tenant_id,
                 TenantSubscription.status == 'active'
@@ -144,7 +155,16 @@ class RoleService:
                 plan_role_ids = [pr.role_id for pr in plan_roles]
                 query = query.filter(or_(Role.tenant_id == tenant_id, Role.id.in_(plan_role_ids)))
             else:
-                query = query.filter(Role.tenant_id == tenant_id)
+                # Include tenant roles AND tenant-accessible default/system roles (excluding superadmin)
+                query = query.filter(
+                    or_(
+                        Role.tenant_id == tenant_id,
+                        and_(
+                            Role.tenant_id.is_(None),
+                            func.lower(Role.name) != 'superadmin'
+                        )
+                    )
+                )
         if search and search.strip():
             search_term = search.strip()
             query = query.filter(Role.name.ilike(f"%{search_term}%"))