revert: remove partner role login block from AdminLoginView
Partner accounts must be able to log into admin.eventifyplus.com. ProtectedRoute empty-module redirect (frontend) handles the access boundary — no backend login gate needed.
This commit is contained in:
@@ -33,14 +33,6 @@ class AdminLoginView(APIView):
|
||||
_audit_log(request, 'auth.admin_login_failed', 'auth', str(user.id),
|
||||
{'identifier': identifier, 'reason': 'account_disabled'}, user=user)
|
||||
return Response({'error': 'Account is disabled'}, status=status.HTTP_403_FORBIDDEN)
|
||||
# Block non-admin roles from the admin dashboard (partner/customer roles must use their own portals)
|
||||
NON_ADMIN_ROLES = {'customer', 'partner', 'partner_manager', 'partner_staff', 'partner_customer'}
|
||||
has_staff_profile = hasattr(user, 'staff_profile') and user.staff_profile is not None
|
||||
if user.role in NON_ADMIN_ROLES and not user.is_superuser and not has_staff_profile:
|
||||
_audit_log(request, 'auth.admin_login_failed', 'auth', str(user.id),
|
||||
{'identifier': identifier, 'reason': 'non_admin_role', 'role': user.role}, user=user)
|
||||
return Response({'error': 'This account is not authorized for the admin dashboard.'},
|
||||
status=status.HTTP_403_FORBIDDEN)
|
||||
refresh = RefreshToken.for_user(user)
|
||||
user_data = UserSerializer(user).data
|
||||
# RBAC: prefer StaffProfile for allowed_modules and scopes
|
||||
|
||||
Reference in New Issue
Block a user