hzhang/HangmanLab.Backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add 'agent' API key role (content CRUD + backup)

Browse Source 
- ALLOWED_API_KEY_ROLES (+ apikey_cli ALLOWED_ROLES) gain 'agent'.
- 'agent' added to require_auth on markdown/patch/path create/update/
  delete/move and backup get/load. apikey mint, /backup/convert, logs,
  config, webhook and permission/template settings stay admin-only.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
h z
2026-05-17 15:06:17 +01:00
parent 9383f8cb03
commit b31480bf25
6 changed files with 18 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
api/apikey/__init__.py
View File

@@ -9,7 +9,7 @@ api_key_bp = Blueprint('apikey', __name__, url_prefix='/api/apikey')
# An API key must never be able to request a role broader than what the # An API key must never be able to request a role broader than what the
# product defines, regardless of what the request body asks for. # product defines, regardless of what the request body asks for.
ALLOWED_API_KEY_ROLES = {'admin', 'creator', 'user'} ALLOWED_API_KEY_ROLES = {'admin', 'creator', 'user', 'agent'}
# Validity window applied on create and on every renewal. # Validity window applied on create and on every renewal.
KEY_TTL = timedelta(days=15) KEY_TTL = timedelta(days=15)

4
api/backup.py
View File

@@ -346,7 +346,7 @@ def convert_backup_endpoint():
backup_lock = threading.Lock() backup_lock = threading.Lock()
@backup_bp.route('/', methods=['GET']) @backup_bp.route('/', methods=['GET'])
@require_auth(roles=['admin']) @require_auth(roles=['admin', 'agent'])
def get_backup(): def get_backup():
""" """
Create a backup of the application's data. Create a backup of the application's data.
@@ -558,7 +558,7 @@ def traverse(path_id, paths):
@backup_bp.route('/load', methods=['POST']) @backup_bp.route('/load', methods=['POST'])
@require_auth(roles=['admin']) @require_auth(roles=['admin', 'agent'])
def load_backup(): def load_backup():
""" """
Restore data from a backup file. Restore data from a backup file.

10
api/markdown.py
View File

@@ -194,7 +194,7 @@ def get_markdown(markdown_id):
return jsonify(markdown.to_dict()), 200 return jsonify(markdown.to_dict()), 200
@markdown_bp.route('/', methods=['POST']) @markdown_bp.route('/', methods=['POST'])
@require_auth(roles=['admin', 'creator']) @require_auth(roles=['admin', 'creator', 'agent'])
@limiter.limit(api.get_rate_limit) @limiter.limit(api.get_rate_limit)
def create_markdown(): def create_markdown():
""" """
@@ -250,7 +250,7 @@ def create_markdown():
return jsonify({"error": f"create failed - {errno}"}), 500 return jsonify({"error": f"create failed - {errno}"}), 500
@markdown_bp.route('/<int:markdown_id>', methods=['PUT', 'PATCH']) @markdown_bp.route('/<int:markdown_id>', methods=['PUT', 'PATCH'])
@require_auth(roles=['admin', 'creator']) @require_auth(roles=['admin', 'creator', 'agent'])
@limiter.limit(api.get_rate_limit) @limiter.limit(api.get_rate_limit)
def update_markdown(markdown_id): def update_markdown(markdown_id):
""" """
@@ -315,7 +315,7 @@ def update_markdown(markdown_id):
return jsonify(markdown.to_dict()), 200 return jsonify(markdown.to_dict()), 200
@markdown_bp.route('/<int:markdown_id>', methods=['DELETE']) @markdown_bp.route('/<int:markdown_id>', methods=['DELETE'])
@require_auth(roles=['admin']) @require_auth(roles=['admin', 'agent'])
@limiter.limit(api.get_rate_limit) @limiter.limit(api.get_rate_limit)
def delete_markdown(markdown_id): def delete_markdown(markdown_id):
""" """
@@ -391,7 +391,7 @@ def delete_markdown(markdown_id):
@markdown_bp.route('/move_forward/<int:markdown_id>', methods=['PATCH']) @markdown_bp.route('/move_forward/<int:markdown_id>', methods=['PATCH'])
@require_auth(roles=['admin']) @require_auth(roles=['admin', 'agent'])
@limiter.limit(api.get_rate_limit) @limiter.limit(api.get_rate_limit)
def move_forward(markdown_id): def move_forward(markdown_id):
""" """
@@ -428,7 +428,7 @@ def move_forward(markdown_id):
@markdown_bp.route('/move_backward/<int:markdown_id>', methods=['PATCH']) @markdown_bp.route('/move_backward/<int:markdown_id>', methods=['PATCH'])
@require_auth(roles=['admin']) @require_auth(roles=['admin', 'agent'])
@limiter.limit(api.get_rate_limit) @limiter.limit(api.get_rate_limit)
def move_backward(markdown_id): def move_backward(markdown_id):
""" """

6
api/patch.py
View File

@@ -51,7 +51,7 @@ def get_patches(markdown_id):
@patch_bp.route('/', methods=['POST']) @patch_bp.route('/', methods=['POST'])
@require_auth(roles=['admin', 'creator']) @require_auth(roles=['admin', 'creator', 'agent'])
@limiter.limit(api.get_rate_limit) @limiter.limit(api.get_rate_limit)
def create_patch(): def create_patch():
"""Create a patch card. Body: markdown_id, content, title?, order?""" """Create a patch card. Body: markdown_id, content, title?, order?"""
@@ -89,7 +89,7 @@ def create_patch():
@patch_bp.route('/<int:patch_id>', methods=['PUT', 'PATCH']) @patch_bp.route('/<int:patch_id>', methods=['PUT', 'PATCH'])
@require_auth(roles=['admin', 'creator']) @require_auth(roles=['admin', 'creator', 'agent'])
@limiter.limit(api.get_rate_limit) @limiter.limit(api.get_rate_limit)
def update_patch(patch_id): def update_patch(patch_id):
"""Update a patch card (title/content/order).""" """Update a patch card (title/content/order)."""
@@ -118,7 +118,7 @@ def update_patch(patch_id):
@patch_bp.route('/<int:patch_id>', methods=['DELETE']) @patch_bp.route('/<int:patch_id>', methods=['DELETE'])
@require_auth(roles=['admin']) @require_auth(roles=['admin', 'agent'])
@limiter.limit(api.get_rate_limit) @limiter.limit(api.get_rate_limit)
def delete_patch(patch_id): def delete_patch(patch_id):
"""Delete a patch card.""" """Delete a patch card."""

12
api/path.py
View File

@@ -82,7 +82,7 @@ def get_path_by_parent(parent_id):
@path_bp.route('/', methods=['POST']) @path_bp.route('/', methods=['POST'])
@limiter.limit(api.get_rate_limit) @limiter.limit(api.get_rate_limit)
@require_auth(roles=['admin', 'creator']) @require_auth(roles=['admin', 'creator', 'agent'])
def create_path(): def create_path():
""" """
Create a new path. Create a new path.
@@ -119,7 +119,7 @@ def create_path():
@path_bp.route('/<int:path_id>', methods=['PUT']) @path_bp.route('/<int:path_id>', methods=['PUT'])
@limiter.limit(api.get_rate_limit) @limiter.limit(api.get_rate_limit)
@require_auth(roles=['admin']) @require_auth(roles=['admin', 'agent'])
def update_path(path_id): def update_path(path_id):
""" """
Update a path. Update a path.
@@ -158,7 +158,7 @@ def update_path(path_id):
@path_bp.route('/<int:path_id>', methods=['PATCH']) @path_bp.route('/<int:path_id>', methods=['PATCH'])
@limiter.limit(api.get_rate_limit) @limiter.limit(api.get_rate_limit)
@require_auth(roles=['admin']) @require_auth(roles=['admin', 'agent'])
def patch_path(path_id): def patch_path(path_id):
""" """
Partially update a path. Partially update a path.
@@ -205,7 +205,7 @@ def patch_path(path_id):
@path_bp.route('/<int:path_id>', methods=['DELETE']) @path_bp.route('/<int:path_id>', methods=['DELETE'])
@limiter.limit(api.get_rate_limit) @limiter.limit(api.get_rate_limit)
@require_auth(roles=['admin']) @require_auth(roles=['admin', 'agent'])
def delete_path(path_id): def delete_path(path_id):
""" """
Delete a path. Delete a path.
@@ -240,7 +240,7 @@ def delete_path(path_id):
@path_bp.route('/move_forward/<int:path_id>', methods=['PATCH']) @path_bp.route('/move_forward/<int:path_id>', methods=['PATCH'])
@require_auth(roles=['admin']) @require_auth(roles=['admin', 'agent'])
@limiter.limit(api.get_rate_limit) @limiter.limit(api.get_rate_limit)
def move_forward(path_id): def move_forward(path_id):
""" """
@@ -277,7 +277,7 @@ def move_forward(path_id):
@path_bp.route('/move_backward/<int:path_id>', methods=['PATCH']) @path_bp.route('/move_backward/<int:path_id>', methods=['PATCH'])
@require_auth(roles=['admin']) @require_auth(roles=['admin', 'agent'])
@limiter.limit(api.get_rate_limit) @limiter.limit(api.get_rate_limit)
def move_backward(path_id): def move_backward(path_id):
""" """

2
apikey_cli.py
View File

@@ -24,7 +24,7 @@ from db import get_db
from db.models.APIKey import APIKey from db.models.APIKey import APIKey
# Keep in sync with api.apikey.ALLOWED_API_KEY_ROLES # Keep in sync with api.apikey.ALLOWED_API_KEY_ROLES
ALLOWED_ROLES = {"admin", "creator", "user"} ALLOWED_ROLES = {"admin", "creator", "user", "agent"}
KEY_TTL_DEFAULT_DAYS = 15 KEY_TTL_DEFAULT_DAYS = 15