Add RBAC: admin user management, audit log, runtime settings, delete PC

server/routes/web_routes.py

@@ -7,9 +7,10 @@ from datetime import datetime, timezone, timedelta
 from typing import Optional
 
 from database import get_db
-from auth import verify_token
-from models import Computer, Heartbeat, User, Notification
+from auth import verify_token, require_admin
+from models import Computer, Heartbeat, User, Notification, AuditLog, Setting
 from notifications import check_offline_computers, get_unread_count
+from settings_store import get_all_settings
 
 router = APIRouter()
 templates = Jinja2Templates(directory="templates")
@@ -25,6 +26,10 @@ def user_or_redirect(request: Request, db: Session):
     return db.query(User).filter(User.username == payload["sub"]).first()
 
 
+def has_admin(db: Session) -> bool:
+    return db.query(User).filter(User.role == "admin").count() > 0
+
+
 @router.get("/", response_class=HTMLResponse)
 def index(
     request: Request,
@@ -85,8 +90,10 @@ def index(
 
 
 @router.get("/login", response_class=HTMLResponse)
-def login_page(request: Request):
-    return templates.TemplateResponse("login.html", {"request": request, "error": None})
+def login_page(request: Request, db: Session = Depends(get_db)):
+    # Allow public registration only while no admin exists
+    registration_open = not has_admin(db)
+    return templates.TemplateResponse("login.html", {"request": request, "error": None, "registration_open": registration_open})
 
 
 @router.get("/computers/{computer_id}", response_class=HTMLResponse)
@@ -153,3 +160,64 @@ def notifications_page(request: Request, db: Session = Depends(get_db)):
             "unread_count": get_unread_count(db),
         },
     )
+
+
+# Admin pages
+
+@router.get("/admin/users", response_class=HTMLResponse)
+def admin_users_page(request: Request, db: Session = Depends(get_db)):
+    current_user = user_or_redirect(request, db)
+    if not current_user or current_user.role != "admin":
+        return RedirectResponse(url="/login")
+
+    users = db.query(User).order_by(User.username).all()
+    return templates.TemplateResponse(
+        "admin_users.html",
+        {
+            "request": request,
+            "user": current_user,
+            "users": users,
+            "unread_count": get_unread_count(db),
+        },
+    )
+
+
+@router.get("/admin/audit", response_class=HTMLResponse)
+def admin_audit_page(request: Request, db: Session = Depends(get_db)):
+    current_user = user_or_redirect(request, db)
+    if not current_user or current_user.role != "admin":
+        return RedirectResponse(url="/login")
+
+    audit = (
+        db.query(AuditLog)
+        .order_by(desc(AuditLog.timestamp))
+        .limit(200)
+        .all()
+    )
+    return templates.TemplateResponse(
+        "admin_audit.html",
+        {
+            "request": request,
+            "user": current_user,
+            "audit": audit,
+            "unread_count": get_unread_count(db),
+        },
+    )
+
+
+@router.get("/admin/settings", response_class=HTMLResponse)
+def admin_settings_page(request: Request, db: Session = Depends(get_db)):
+    current_user = user_or_redirect(request, db)
+    if not current_user or current_user.role != "admin":
+        return RedirectResponse(url="/login")
+
+    settings = get_all_settings(db)
+    return templates.TemplateResponse(
+        "admin_settings.html",
+        {
+            "request": request,
+            "user": current_user,
+            "settings": settings,
+            "unread_count": get_unread_count(db),
+        },
+    )