Rakseeibra/arrr-erp
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Phase 2 fix remaining RBAC safe responses and work route aliases

Browse Source
This commit is contained in:
A R R R Associates
2026-06-25 22:30:49 +05:30
parent b97af0ea1e
commit 4ce5556e9d
4 changed files with 64 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/modules/email_integration/ui.py
+15 -14
View File
@@ -4,6 +4,7 @@ from datetime import datetime, timedelta, timezone
from fastapi import APIRouter, Form, Request
from fastapi.responses import RedirectResponse
from app.core.http_responses import forbidden_response
from sqlalchemy import desc, func, or_, select
from app.core.db.common import CommonSessionLocal
@@ -72,7 +73,7 @@ def email_audit_dashboard_page(request: Request):
if not user:
return _redirect_login()
if not _user_can_manage_email(db, user):
return RedirectResponse(url="/employee/dashboard", status_code=303)
return forbidden_response(request, "Access denied: email settings require administrator permission")
tenant_id, branch_id = _scope_from_request(request, user)
now = datetime.now(timezone.utc)
since_24h = now - timedelta(hours=24)
@@ -197,7 +198,7 @@ def email_settings_page(request: Request, flash: str | None = None):
if not user:
return _redirect_login()
if not _user_can_manage_email(db, user):
return RedirectResponse(url="/employee/dashboard", status_code=303)
return forbidden_response(request, "Access denied: email settings require administrator permission")
tenant_id, branch_id = _scope_from_request(request, user)
if not tenant_id:
return RedirectResponse(url="/system-settings", status_code=303)
@@ -258,7 +259,7 @@ def save_email_settings(
if not user:
return _redirect_login()
if not _user_can_manage_email(db, user):
return RedirectResponse(url="/employee/dashboard", status_code=303)
return forbidden_response(request, "Access denied: email settings require administrator permission")
tenant_id, branch_id = _scope_from_request(request, user)
setting = get_or_create_email_setting(db, int(tenant_id), branch_id, actor_user_id=int(user.id))
setting.smtp_host = smtp_host.strip() or None
@@ -305,7 +306,7 @@ def test_email_settings(request: Request, csrf_token: str = Form(...), test_emai
if not user:
return _redirect_login()
if not _user_can_manage_email(db, user):
return RedirectResponse(url="/employee/dashboard", status_code=303)
return forbidden_response(request, "Access denied: email settings require administrator permission")
tenant_id, branch_id = _scope_from_request(request, user)
recipient = (test_email or getattr(user, "email", "")).strip()
send_template_email(
@@ -333,7 +334,7 @@ def email_logs_page(request: Request):
if not user:
return _redirect_login()
if not _user_can_manage_email(db, user):
return RedirectResponse(url="/employee/dashboard", status_code=303)
return forbidden_response(request, "Access denied: email settings require administrator permission")
tenant_id, branch_id = _scope_from_request(request, user)
q = select(EmailLog).where(EmailLog.tenant_id == tenant_id)
if branch_id:
@@ -356,7 +357,7 @@ def email_queue_page(request: Request, flash: str | None = None):
if not user:
return _redirect_login()
if not _user_can_manage_email(db, user):
return RedirectResponse(url="/employee/dashboard", status_code=303)
return forbidden_response(request, "Access denied: email settings require administrator permission")
tenant_id, branch_id = _scope_from_request(request, user)
q = select(EmailLog).where(EmailLog.tenant_id == tenant_id, EmailLog.status.in_(["PENDING", "FAILED"]))
if branch_id:
@@ -379,7 +380,7 @@ def process_email_queue_page(request: Request, csrf_token: str = Form(...), limi
if not user:
return _redirect_login()
if not _user_can_manage_email(db, user):
return RedirectResponse(url="/employee/dashboard", status_code=303)
return forbidden_response(request, "Access denied: email settings require administrator permission")
tenant_id, branch_id = _scope_from_request(request, user)
result = process_pending_email_queue(db, tenant_id=tenant_id, branch_id=branch_id, limit=limit)
db.commit()
@@ -397,7 +398,7 @@ def email_inbox_page(request: Request, flash: str | None = None):
if not user:
return _redirect_login()
if not _user_can_manage_email(db, user):
return RedirectResponse(url="/employee/dashboard", status_code=303)
return forbidden_response(request, "Access denied: email settings require administrator permission")
tenant_id, branch_id = _scope_from_request(request, user)
q = select(EmailIncomingMessage).where(EmailIncomingMessage.tenant_id == tenant_id)
if branch_id:
@@ -427,7 +428,7 @@ def fetch_email_inbox_page(
if not user:
return _redirect_login()
if not _user_can_manage_email(db, user):
return RedirectResponse(url="/employee/dashboard", status_code=303)
return forbidden_response(request, "Access denied: email settings require administrator permission")
tenant_id, branch_id = _scope_from_request(request, user)
setting = get_or_create_email_setting(db, int(tenant_id), branch_id, actor_user_id=int(user.id))
result = fetch_incoming_emails(
@@ -458,7 +459,7 @@ def email_inbox_detail_page(request: Request, message_id: int):
if not user:
return _redirect_login()
if not _user_can_manage_email(db, user):
return RedirectResponse(url="/employee/dashboard", status_code=303)
return forbidden_response(request, "Access denied: email settings require administrator permission")
tenant_id, branch_id = _scope_from_request(request, user)
filters = [EmailIncomingMessage.id == message_id, EmailIncomingMessage.tenant_id == tenant_id]
if branch_id:
@@ -503,7 +504,7 @@ def email_inbox_map_all(request: Request, csrf_token: str = Form(...), limit: in
if not user:
return _redirect_login()
if not _user_can_manage_email(db, user):
return RedirectResponse(url="/employee/dashboard", status_code=303)
return forbidden_response(request, "Access denied: email settings require administrator permission")
tenant_id, branch_id = _scope_from_request(request, user)
result = auto_map_unmapped_emails(db, tenant_id=tenant_id, branch_id=branch_id, limit=limit)
db.commit()
@@ -529,7 +530,7 @@ def email_inbox_manual_map_page(
if not user:
return _redirect_login()
if not _user_can_manage_email(db, user):
return RedirectResponse(url="/employee/dashboard", status_code=303)
return forbidden_response(request, "Access denied: email settings require administrator permission")
tenant_id, branch_id = _scope_from_request(request, user)
filters = [EmailIncomingMessage.id == message_id, EmailIncomingMessage.tenant_id == tenant_id]
if branch_id:
@@ -557,7 +558,7 @@ def email_templates_page(request: Request):
if not user:
return _redirect_login()
if not _user_can_manage_email(db, user):
return RedirectResponse(url="/employee/dashboard", status_code=303)
return forbidden_response(request, "Access denied: email settings require administrator permission")
tenant_id, branch_id = _scope_from_request(request, user)
seed_default_email_templates(db, tenant_id=tenant_id, branch_id=branch_id)
db.commit()
@@ -590,7 +591,7 @@ def update_email_template(
if not user:
return _redirect_login()
if not _user_can_manage_email(db, user):
return RedirectResponse(url="/employee/dashboard", status_code=303)
return forbidden_response(request, "Access denied: email settings require administrator permission")
tenant_id, branch_id = _scope_from_request(request, user)
row = db.execute(
select(EmailTemplate).where(