admin felület fejlesztése garázs, előfizeztési csomagok

backend/app/api/deps.py

@@ -210,28 +210,63 @@ async def get_current_staff(
     return current_user
 
 
-def RequireRole(allowed_roles: List[UserRole]):
+def RequireRole(allowed_roles: List[UserRole], target_org_id: Optional[int] = None):
     """
-    🎯 Flexible role-checking dependency factory.
+    🎯 Flexible role-checking dependency factory with scope-based access.
     
     Accepts a list of UserRole values. If the current user's role is
     in the list, access is granted. Otherwise, 403 Forbidden.
     
+    When target_org_id is provided, the RBACService is automatically
+    invoked to check if the staff member has scope-based access to
+    that specific organization.
+    
     Usage:
+        # Simple role check
         @router.get("/admin/sales")
         async def sales_dashboard(
             current_user: User = Depends(get_current_user),
             _ = Depends(RequireRole([UserRole.SUPERADMIN, UserRole.SALES_REP]))
         ):
+        
+        # Scope-based access check
+        @router.get("/admin/organizations/{org_id}")
+        async def get_organization(
+            org_id: int,
+            current_user: User = Depends(get_current_user),
+            _ = Depends(RequireRole(
+                [UserRole.SUPERADMIN, UserRole.ADMIN, UserRole.SALES_REP],
+                target_org_id=org_id  # ← triggers scope check
+            ))
+        ):
     """
     async def role_checker(
         current_user: User = Depends(get_current_user),
+        db: AsyncSession = Depends(get_db),
     ) -> bool:
+        # 1. Check if the user's role is in the allowed list
         if current_user.role not in allowed_roles:
             raise HTTPException(
                 status_code=status.HTTP_403_FORBIDDEN,
                 detail="AUTH.INSUFFICIENT_PERMISSIONS"
             )
+        
+        # 2. If target_org_id is provided, perform scope-based access check
+        if target_org_id is not None:
+            from app.services.rbac_service import rbac_service
+            try:
+                await rbac_service.check_admin_access(
+                    db=db,
+                    user=current_user,
+                    action="VIEW_DATA",  # Generic read access for the dependency
+                    target_org_id=target_org_id,
+                )
+            except PermissionError as e:
+                raise HTTPException(
+                    status_code=status.HTTP_403_FORBIDDEN,
+                    detail=str(e)
+                )
+        
         return True
     return role_checker