revert: remove partner role login block from AdminLoginView

Partner accounts must be able to log into admin.eventifyplus.com.
ProtectedRoute empty-module redirect (frontend) handles the access
boundary — no backend login gate needed.
This commit is contained in:
2026-04-21 18:38:10 +05:30
parent 64ff08b2b2
commit f85188ca6b
2 changed files with 0 additions and 15 deletions

View File

@@ -33,14 +33,6 @@ class AdminLoginView(APIView):
_audit_log(request, 'auth.admin_login_failed', 'auth', str(user.id),
{'identifier': identifier, 'reason': 'account_disabled'}, user=user)
return Response({'error': 'Account is disabled'}, status=status.HTTP_403_FORBIDDEN)
# Block non-admin roles from the admin dashboard (partner/customer roles must use their own portals)
NON_ADMIN_ROLES = {'customer', 'partner', 'partner_manager', 'partner_staff', 'partner_customer'}
has_staff_profile = hasattr(user, 'staff_profile') and user.staff_profile is not None
if user.role in NON_ADMIN_ROLES and not user.is_superuser and not has_staff_profile:
_audit_log(request, 'auth.admin_login_failed', 'auth', str(user.id),
{'identifier': identifier, 'reason': 'non_admin_role', 'role': user.role}, user=user)
return Response({'error': 'This account is not authorized for the admin dashboard.'},
status=status.HTTP_403_FORBIDDEN)
refresh = RefreshToken.for_user(user)
user_data = UserSerializer(user).data
# RBAC: prefer StaffProfile for allowed_modules and scopes