alban/gmao
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Attribuer super_admin au premier compte
Some checks are pending
CI - Tests et Syntax / lint-and-test (push) Waiting to run
Details

Browse source
This commit is contained in:
root 2026-08-21 20:45:24 +00:00
parent 20362fb31e
commit 9a540c600f
1 changed files with 25 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

31
app_new/core/routes/setup_wizard.py
View file

@ -14,7 +14,7 @@ from ..models.user import User
from ..models.college import College, Building, Zone, Room from ..models.college import College, Building, Zone, Room
from ..models.equipment import EquipmentCategory from ..models.equipment import EquipmentCategory
from ..models.maintenance import Lot from ..models.maintenance import Lot
from ..models.rbac import Role from ..models.rbac import Role, Permission, RolePermission, UserRole
from ..services.rbac import replace_user_roles from ..services.rbac import replace_user_roles
from ..authorization import has_permission from ..authorization import has_permission
from ..models.planning import WorkSchedule, CollegeClosure, ClosureWorkDay from ..models.planning import WorkSchedule, CollegeClosure, ClosureWorkDay
@ -264,16 +264,33 @@ def api_save_step(step):
user = User( user = User(
username=username, username=username,
email=f'{username}@gmao.local', email=f'{username}@gmao.local',
role='admin', role='admin', # LEGACY uniquement ; la sécurité utilise UserRole.
is_active=True is_active=True
) )
user.set_password(password) user.set_password(password)
db.session.add(user) db.session.add(user)
db.session.flush() db.session.flush()
admin_role = Role.query.filter_by(slug='admin', is_active=True).first() # Le premier compte est le compte de récupération de l'installation
if admin_role: # et doit recevoir explicitement le rôle protégé super_admin.
replace_user_roles(user, [admin_role.id]) super_role = Role.query.filter_by(slug='super_admin', is_active=True).first()
if not super_role:
super_role = Role(slug='super_admin', name='Super administrateur',
description="Rôle système protégé donnant un accès complet à l'application.",
is_system=True, is_active=True)
db.session.add(super_role)
db.session.flush()
wildcard = Permission.query.filter_by(code='*').first()
if not wildcard:
wildcard = Permission(code='*', name="Accès complet à l'application",
module='system', action='all',
description="Accès complet réservé au super administrateur.",
is_active=True)
db.session.add(wildcard)
db.session.flush()
if not RolePermission.query.filter_by(role_id=super_role.id, permission_id=wildcard.id).first():
db.session.add(RolePermission(role_id=super_role.id, permission_id=wildcard.id, effect='allow'))
replace_user_roles(user, [super_role.id])
progress.admin_username = username progress.admin_username = username
progress.step = 2 progress.step = 2
@ -588,7 +605,9 @@ def api_complete():
try: try:
progress = SetupProgress.get() progress = SetupProgress.get()
admin = User.query.filter_by(role='admin', is_active=True).first() super_role = Role.query.filter_by(slug='super_admin', is_active=True).first()
admin = next((link.user for link in (super_role.user_links if super_role else [])
if link.user and link.user.is_active), None)
if not admin: if not admin:
return jsonify({'error': 'Un administrateur actif est requis'}), 400 return jsonify({'error': 'Un administrateur actif est requis'}), 400
if progress.step < 10: if progress.step < 10: