Initial Claude implementation

app/web/admin.py

@@ -0,0 +1,204 @@
+"""HTMX-driven admin dashboard for users and roles."""
+from fastapi import APIRouter, Depends, Form, HTTPException, Request, status
+from fastapi.responses import HTMLResponse, RedirectResponse, Response
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.database import get_db
+from app.crud import role as role_crud
+from app.crud import user as user_crud
+from app.deps import get_current_web_user
+from app.models.user import User
+from app.web.templates import templates
+
+router = APIRouter(prefix="/admin", include_in_schema=False)
+
+
+def web_require(*perms: str):
+    """Web dependency: allow superusers or holders of all given permissions."""
+
+    async def checker(user: User = Depends(get_current_web_user)) -> User:
+        if user.is_superuser or set(perms).issubset(user.permissions):
+            return user
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="You do not have access to this page.",
+        )
+
+    return checker
+
+
+@router.get("", response_class=HTMLResponse)
+async def admin_home():
+    return RedirectResponse(url="/admin/users", status_code=status.HTTP_302_FOUND)
+
+
+# --- Users -------------------------------------------------------------------
+
+@router.get("/users", response_class=HTMLResponse)
+async def users_page(
+    request: Request,
+    db: AsyncSession = Depends(get_db),
+    user: User = Depends(web_require("users:read")),
+):
+    return templates.TemplateResponse(
+        request,
+        "admin/users.html",
+        {
+            "user": user,
+            "users": await user_crud.list_users(db),
+            "roles": await role_crud.list_roles(db),
+        },
+    )
+
+
+@router.post("/users", response_class=HTMLResponse)
+async def create_user(
+    request: Request,
+    email: str = Form(...),
+    password: str = Form(...),
+    full_name: str = Form(""),
+    is_superuser: bool = Form(False),
+    role_ids: list[int] = Form(default=[]),
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(web_require("users:write")),
+):
+    if not await user_crud.get_by_email(db, email):
+        await user_crud.create(
+            db,
+            email=email,
+            password=password,
+            full_name=full_name or None,
+            is_superuser=is_superuser,
+            role_ids=role_ids,
+        )
+    return templates.TemplateResponse(
+        request,
+        "admin/_users_table.html",
+        {"users": await user_crud.list_users(db), "roles": await role_crud.list_roles(db)},
+    )
+
+
+@router.get("/users/{user_id}/edit", response_class=HTMLResponse)
+async def edit_user_row(
+    request: Request,
+    user_id: int,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(web_require("users:write")),
+):
+    target = await user_crud.get(db, user_id)
+    if target is None:
+        raise HTTPException(status_code=404, detail="User not found")
+    return templates.TemplateResponse(
+        request,
+        "admin/_user_row_edit.html",
+        {"u": target, "roles": await role_crud.list_roles(db)},
+    )
+
+
+@router.get("/users/{user_id}/row", response_class=HTMLResponse)
+async def user_row(
+    request: Request,
+    user_id: int,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(web_require("users:read")),
+):
+    target = await user_crud.get(db, user_id)
+    if target is None:
+        raise HTTPException(status_code=404, detail="User not found")
+    return templates.TemplateResponse(request, "admin/_user_row.html", {"u": target})
+
+
+@router.post("/users/{user_id}", response_class=HTMLResponse)
+async def update_user(
+    request: Request,
+    user_id: int,
+    full_name: str = Form(""),
+    password: str = Form(""),
+    is_active: bool = Form(False),
+    is_superuser: bool = Form(False),
+    role_ids: list[int] = Form(default=[]),
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(web_require("users:write")),
+):
+    target = await user_crud.get(db, user_id)
+    if target is None:
+        raise HTTPException(status_code=404, detail="User not found")
+    await user_crud.update(
+        db,
+        target,
+        {
+            "full_name": full_name or None,
+            "password": password or None,
+            "is_active": is_active,
+            "is_superuser": is_superuser,
+            "role_ids": role_ids,
+        },
+    )
+    return templates.TemplateResponse(request, "admin/_user_row.html", {"u": target})
+
+
+@router.delete("/users/{user_id}")
+async def delete_user(
+    user_id: int,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(web_require("users:delete")),
+):
+    target = await user_crud.get(db, user_id)
+    if target is not None:
+        await user_crud.delete(db, target)
+    # Empty body — HTMX swaps the row out of existence.
+    return Response(status_code=status.HTTP_200_OK)
+
+
+# --- Roles -------------------------------------------------------------------
+
+@router.get("/roles", response_class=HTMLResponse)
+async def roles_page(
+    request: Request,
+    db: AsyncSession = Depends(get_db),
+    user: User = Depends(web_require("roles:read")),
+):
+    return templates.TemplateResponse(
+        request,
+        "admin/roles.html",
+        {
+            "user": user,
+            "roles": await role_crud.list_roles(db),
+            "permissions": await role_crud.list_permissions(db),
+        },
+    )
+
+
+@router.post("/roles", response_class=HTMLResponse)
+async def create_role(
+    request: Request,
+    name: str = Form(...),
+    description: str = Form(""),
+    permission_ids: list[int] = Form(default=[]),
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(web_require("roles:write")),
+):
+    if not await role_crud.get_by_name(db, name):
+        await role_crud.create(
+            db,
+            name=name,
+            description=description or None,
+            permission_ids=permission_ids,
+        )
+    return templates.TemplateResponse(
+        request,
+        "admin/_roles_table.html",
+        {"roles": await role_crud.list_roles(db)},
+    )
+
+
+@router.delete("/roles/{role_id}")
+async def delete_role(
+    role_id: int,
+    db: AsyncSession = Depends(get_db),
+    _: User = Depends(web_require("roles:write")),
+):
+    role = await role_crud.get(db, role_id)
+    if role is not None:
+        await role_crud.delete(db, role)
+    return Response(status_code=status.HTTP_200_OK)

app/web/pages.py

@@ -0,0 +1,69 @@
+from fastapi import APIRouter, Depends, Form, Request, status
+from fastapi.responses import HTMLResponse, RedirectResponse, Response
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.config import settings
+from app.core.database import get_db
+from app.crud import user as user_crud
+from app.deps import get_current_web_user
+from app.models.user import User
+from app.services.auth import issue_token_pair
+from app.web.templates import templates
+
+router = APIRouter(include_in_schema=False)
+
+
+def _set_auth_cookie(response: Response, access_token: str) -> None:
+    response.set_cookie(
+        key=settings.cookie_name,
+        value=access_token,
+        httponly=True,
+        secure=settings.cookie_secure,
+        samesite="lax",
+        max_age=settings.access_token_expire_minutes * 60,
+        path="/",
+    )
+
+
+@router.get("/", response_class=HTMLResponse)
+async def dashboard(
+    request: Request,
+    user: User = Depends(get_current_web_user),
+):
+    return templates.TemplateResponse(
+        request, "dashboard.html", {"user": user}
+    )
+
+
+@router.get("/login", response_class=HTMLResponse)
+async def login_page(request: Request):
+    return templates.TemplateResponse(request, "login.html", {})
+
+
+@router.post("/login")
+async def login_submit(
+    request: Request,
+    email: str = Form(...),
+    password: str = Form(...),
+    db: AsyncSession = Depends(get_db),
+):
+    user = await user_crud.authenticate(db, email, password)
+    if user is None:
+        # Re-render the form with an error (HTMX swaps the form partial).
+        return templates.TemplateResponse(
+            request,
+            "login.html",
+            {"error": "Incorrect email or password", "email": email},
+            status_code=status.HTTP_401_UNAUTHORIZED,
+        )
+    access, _ = await issue_token_pair(db, user)
+    response = RedirectResponse(url="/", status_code=status.HTTP_303_SEE_OTHER)
+    _set_auth_cookie(response, access)
+    return response
+
+
+@router.post("/logout")
+async def logout(request: Request):
+    response = RedirectResponse(url="/login", status_code=status.HTTP_303_SEE_OTHER)
+    response.delete_cookie(settings.cookie_name, path="/")
+    return response

app/web/templates.py

@@ -0,0 +1,10 @@
+from pathlib import Path
+
+from fastapi.templating import Jinja2Templates
+
+from app.core.config import settings
+
+TEMPLATES_DIR = Path(__file__).resolve().parent.parent / "templates"
+
+templates = Jinja2Templates(directory=str(TEMPLATES_DIR))
+templates.env.globals["app_name"] = settings.app_name