admin felület különválasztva

backend/app/api/deps.py

@@ -1,5 +1,5 @@
 # /opt/docker/dev/service_finder/backend/app/api/deps.py
-from typing import Optional, Dict, Any, Union
+from typing import Optional, Dict, Any, Union, List
 import logging
 from fastapi import Depends, HTTPException, status
 from fastapi.security import OAuth2PasswordBearer
@@ -177,6 +177,65 @@ async def get_current_admin(
     return current_user
 
 
+# ═══════════════════════════════════════════════════════════════════════════════
+# RBAC Phase 1.5: Staff & Flexible Role Dependencies
+# ═══════════════════════════════════════════════════════════════════════════════
+
+# All internal staff roles that can access the Backoffice (admin.servicefinder.hu)
+STAFF_ROLES = {
+    UserRole.SUPERADMIN,
+    UserRole.ADMIN,
+    UserRole.MODERATOR,
+    UserRole.SALES_REP,
+    UserRole.SERVICE_MGR,
+}
+
+async def get_current_staff(
+    current_user: User = Depends(get_current_user)
+) -> User:
+    """
+    🎯 Staff-level access dependency.
+    
+    Admits all internal staff roles: SUPERADMIN, ADMIN, MODERATOR,
+    SALES_REP, and SERVICE_MGR.
+    
+    Use this for Backoffice (admin.servicefinder.hu) endpoints that
+    should be accessible to all staff members, not just superadmins.
+    """
+    if current_user.role not in STAFF_ROLES:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="AUTH.STAFF_ONLY"
+        )
+    return current_user
+
+
+def RequireRole(allowed_roles: List[UserRole]):
+    """
+    🎯 Flexible role-checking dependency factory.
+    
+    Accepts a list of UserRole values. If the current user's role is
+    in the list, access is granted. Otherwise, 403 Forbidden.
+    
+    Usage:
+        @router.get("/admin/sales")
+        async def sales_dashboard(
+            current_user: User = Depends(get_current_user),
+            _ = Depends(RequireRole([UserRole.SUPERADMIN, UserRole.SALES_REP]))
+        ):
+    """
+    async def role_checker(
+        current_user: User = Depends(get_current_user),
+    ) -> bool:
+        if current_user.role not in allowed_roles:
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="AUTH.INSUFFICIENT_PERMISSIONS"
+            )
+        return True
+    return role_checker
+
+
 # ═══════════════════════════════════════════════════════════════════════════════
 # RBAC Phase 2: Capability Dependencies (Kapuőrök)
 # ═══════════════════════════════════════════════════════════════════════════════