From 1755e9759bd323307b398671ba3536ff9eb24005 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 8 Jun 2026 16:34:28 +0000 Subject: [PATCH] P2 tighten route auth --- backend/routers/admin.py | 5 +++-- backend/routers/cases.py | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/backend/routers/admin.py b/backend/routers/admin.py index fea07c0..1310535 100644 --- a/backend/routers/admin.py +++ b/backend/routers/admin.py @@ -5,12 +5,13 @@ import re import xml.etree.ElementTree as ET import zipfile -from fastapi import APIRouter, File, HTTPException, Query, UploadFile +from fastapi import APIRouter, Depends, File, HTTPException, Query, UploadFile from backend.database import db +from backend.routers.auth import require_roles from backend.schemas import CaseListResponse, CaseResponse, CaseUpdate, DashboardResponse, ParseDocResponse -router = APIRouter(prefix='/api/v1/admin', tags=['admin']) +router = APIRouter(prefix='/api/v1/admin', tags=['admin'], dependencies=[Depends(require_roles(['admin']))]) def _parse_bool(value: str | None) -> bool | None: diff --git a/backend/routers/cases.py b/backend/routers/cases.py index a4dcda8..61b82bb 100644 --- a/backend/routers/cases.py +++ b/backend/routers/cases.py @@ -1,11 +1,12 @@ from __future__ import annotations -from fastapi import APIRouter, HTTPException, Query +from fastapi import APIRouter, Depends, HTTPException, Query from backend.database import db +from backend.routers.auth import require_roles from backend.schemas import CaseCreate, CaseListResponse, CaseResponse, CaseUpdate -router = APIRouter(prefix='/api/v1/cases', tags=['cases']) +router = APIRouter(prefix='/api/v1/cases', tags=['cases'], dependencies=[Depends(require_roles(['operator', 'field', 'admin']))]) @router.post('', response_model=CaseResponse)