revert: remove partner role login block from AdminLoginView

Partner accounts must be able to log into admin.eventifyplus.com.
ProtectedRoute empty-module redirect (frontend) handles the access
boundary — no backend login gate needed.

CHANGELOG.md

@@ -5,13 +5,6 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), version
 
 ---
 
-## [1.14.1] — 2026-04-21
-
-### Security
-- **`AdminLoginView` now rejects non-admin roles** — users with `role` in `{customer, partner, partner_manager, partner_staff, partner_customer}` can no longer obtain an admin JWT via `POST /api/v1/auth/login/`. Returns HTTP 403 with `{'error': 'This account is not authorized for the admin dashboard.'}` and writes an `auth.admin_login_failed` audit row with `reason: 'non_admin_role'`. Superusers and any user with an attached `StaffProfile` remain allowed regardless of role, so existing admin staff are unaffected. Closes the gap where partner_manager accounts (e.g. `novakopro@gmail.com`) could log into `admin.eventifyplus.com` and hit protected routes
-
----
-
 ## [1.14.0] — 2026-04-21
 
 ### Added

admin_api/views.py

@@ -33,14 +33,6 @@ class AdminLoginView(APIView):
             _audit_log(request, 'auth.admin_login_failed', 'auth', str(user.id),
                        {'identifier': identifier, 'reason': 'account_disabled'}, user=user)
             return Response({'error': 'Account is disabled'}, status=status.HTTP_403_FORBIDDEN)
-        # Block non-admin roles from the admin dashboard (partner/customer roles must use their own portals)
-        NON_ADMIN_ROLES = {'customer', 'partner', 'partner_manager', 'partner_staff', 'partner_customer'}
-        has_staff_profile = hasattr(user, 'staff_profile') and user.staff_profile is not None
-        if user.role in NON_ADMIN_ROLES and not user.is_superuser and not has_staff_profile:
-            _audit_log(request, 'auth.admin_login_failed', 'auth', str(user.id),
-                       {'identifier': identifier, 'reason': 'non_admin_role', 'role': user.role}, user=user)
-            return Response({'error': 'This account is not authorized for the admin dashboard.'},
-                            status=status.HTTP_403_FORBIDDEN)
         refresh = RefreshToken.for_user(user)
         user_data = UserSerializer(user).data
         # RBAC: prefer StaffProfile for allowed_modules and scopes