sakshamandClaude Sonnet 5
4ee38b6241
Logs a distinct db_viewer_accessed event (not just the earlier session_created "requested" event) when an admin's browser actually completes the hand-off into Adminer. Adds a password-confirmed account-deletion box to Settings, relying on the existing ON DELETE CASCADE foreign keys to clean up everything the account owns. Adds an admin-only "require password change" flag that get_current_user enforces server-side (403 on everything except /auth/me, /auth/change-password, /auth/logout) - meant for handing a demo account to someone with a known sample password. Co-Authored-By: Claude Sonnet 5 <[email protected]>
56 lines
1.7 KiB
Python
56 lines
1.7 KiB
Python
from __future__ import annotations
|
|
|
|
import uuid
|
|
|
|
from sqlalchemy import select
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.models.user import User
|
|
|
|
|
|
class UserRepository:
|
|
def __init__(self, db: AsyncSession) -> None:
|
|
self.db = db
|
|
|
|
async def get_by_id(self, user_id: uuid.UUID) -> User | None:
|
|
return await self.db.get(User, user_id)
|
|
|
|
async def get_by_email(self, email: str) -> User | None:
|
|
result = await self.db.execute(select(User).where(User.email == email.lower()))
|
|
return result.scalar_one_or_none()
|
|
|
|
async def list_admin_emails(self) -> list[str]:
|
|
result = await self.db.execute(select(User.email).where(User.is_admin.is_(True)))
|
|
return list(result.scalars().all())
|
|
|
|
async def delete(self, user: User) -> None:
|
|
"""Cascades (ON DELETE CASCADE, see migrations) to every row the
|
|
user owns - companies and everything under them, refresh tokens,
|
|
security events, etc. Irreversible."""
|
|
await self.db.delete(user)
|
|
await self.db.flush()
|
|
|
|
async def create(
|
|
self,
|
|
*,
|
|
email: str,
|
|
password_hash: str | None,
|
|
display_name: str,
|
|
timezone: str,
|
|
user_id: uuid.UUID | None = None,
|
|
is_admin: bool = False,
|
|
email_verified: bool = False,
|
|
) -> User:
|
|
user = User(
|
|
id=user_id or uuid.uuid4(),
|
|
email=email.lower(),
|
|
password_hash=password_hash,
|
|
display_name=display_name,
|
|
timezone=timezone,
|
|
is_admin=is_admin,
|
|
email_verified=email_verified,
|
|
)
|
|
self.db.add(user)
|
|
await self.db.flush()
|
|
return user
|