RABC fejlesztése és beélesítése hibák kijavításával

backend/app/api/v1/endpoints/users.py

@@ -41,13 +41,15 @@ class NetworkResponse(BaseModel):
     level3: List[NetworkMemberL2L3]
 
 
-def _build_user_response(user: User, active_org_id: Optional[int] = None) -> dict:
+def _build_user_response(user: User, active_org_id: Optional[int] = None, db: Optional[AsyncSession] = None) -> dict:
     """
     Segédfüggvény a UserResponse dict előállításához.
     Beágyazza a Person és Address adatokat a 'person' mezőbe.
+    RBAC Phase 3: system_capabilities és org_capabilities is bekerül a válaszba.
     """
     from app.models.marketplace.organization import Organization, OrganizationMember
     from app.models.marketplace.organization import OrgUserRole
+    from app.core.capabilities import get_capabilities_for_role
 
     # Determine active organization ID
     if active_org_id is None:
@@ -101,6 +103,17 @@ def _build_user_response(user: User, active_org_id: Optional[int] = None) -> dic
     first_name = person.first_name if person else ""
     last_name = person.last_name if person else ""
 
+    # ── RBAC Phase 3: Resolve system capabilities ──
+    role_key = user.role.value if hasattr(user.role, 'value') else str(user.role)
+    system_capabilities = get_capabilities_for_role(role_key)
+
+    # ── RBAC Phase 3: Resolve org capabilities ──
+    org_capabilities: Dict[str, Dict[str, bool]] = {}
+    if db is not None:
+        # We need to run this synchronously since _build_user_response is not async
+        # The async version is handled in read_users_me directly
+        pass
+
     return {
         "id": user.id,
         "email": user.email,
@@ -109,7 +122,7 @@ def _build_user_response(user: User, active_org_id: Optional[int] = None) -> dic
         "is_active": user.is_active,
         "region_code": user.region_code,
         "person_id": user.person_id,
-        "role": user.role.value if hasattr(user.role, 'value') else str(user.role),
+        "role": role_key,
         "subscription_plan": user.subscription_plan,
         "scope_level": user.scope_level or "individual",
         "scope_id": str(active_org_id) if active_org_id else None,
@@ -118,6 +131,10 @@ def _build_user_response(user: User, active_org_id: Optional[int] = None) -> dic
         "preferred_language": user.preferred_language or "hu",
         "person": person_data,
         "is_last_admin": False,  # Default, will be overridden in read_users_me
+        # RBAC Phase 3: Rendszerszintű képességek
+        "system_capabilities": system_capabilities,
+        # RBAC Phase 3: Szervezeti képességek (feltöltve a read_users_me végpontban)
+        "org_capabilities": {},
     }
 
 
@@ -126,9 +143,11 @@ async def read_users_me(
     db: AsyncSession = Depends(get_db),
     current_user: User = Depends(get_current_user),
 ):
-    """Visszaadja a bejelentkezett felhasználó profilját beágyazott Person és Address adatokkal."""
+    """Visszaadja a bejelentkezett felhasználó profilját beágyazott Person és Address adatokkal.
+    RBAC Phase 3: system_capabilities és org_capabilities is bekerül a válaszba."""
     from app.models.marketplace.organization import Organization, OrganizationMember
     from app.models.marketplace.organization import OrgUserRole
+    from app.core.capabilities import get_capabilities_for_role
 
     # Determine active organization ID
     active_org_id = None
@@ -178,8 +197,53 @@ async def read_users_me(
 
     # Check if user is the last admin in any organization
     is_last_admin = await AuthService.check_is_last_admin(db, current_user.id)
+
+    # ── RBAC Phase 3: Build base response ──
     response_data = _build_user_response(current_user, active_org_id)
     response_data["is_last_admin"] = is_last_admin
+
+    # ── RBAC Phase 3: Resolve org_capabilities ──
+    # Get all organizations the user is a member of
+    org_memberships_stmt = select(
+        OrganizationMember.organization_id,
+        OrganizationMember.role
+    ).where(
+        OrganizationMember.user_id == current_user.id,
+        OrganizationMember.status == "active"
+    )
+    org_memberships_result = await db.execute(org_memberships_stmt)
+    org_memberships = org_memberships_result.all()
+
+    org_capabilities: Dict[str, Dict[str, bool]] = {}
+    for membership in org_memberships:
+        org_id = str(membership.organization_id)
+        org_role_name = membership.role
+
+        # Try to get permissions from OrgRole table first
+        role_stmt = select(OrgRole.permissions).where(
+            OrgRole.name_key == org_role_name,
+            OrgRole.is_active == True
+        ).limit(1)
+        role_result = await db.execute(role_stmt)
+        permissions = role_result.scalar_one_or_none()
+
+        if not permissions:
+            # Fallback: use OrganizationMember.permissions
+            member_perm_stmt = select(OrganizationMember.permissions).where(
+                OrganizationMember.user_id == current_user.id,
+                OrganizationMember.organization_id == membership.organization_id,
+                OrganizationMember.status == "active"
+            ).limit(1)
+            member_perm_result = await db.execute(member_perm_stmt)
+            permissions = member_perm_result.scalar_one_or_none() or {}
+
+        if not isinstance(permissions, dict):
+            permissions = {}
+
+        org_capabilities[org_id] = permissions
+
+    response_data["org_capabilities"] = org_capabilities
+
     return UserResponse.model_validate(response_data)