revert: remove partner role login block from AdminLoginView

Partner accounts must be able to log into admin.eventifyplus.com.
ProtectedRoute empty-module redirect (frontend) handles the access
boundary — no backend login gate needed.
This commit is contained in:
2026-04-21 18:38:10 +05:30
parent 64ff08b2b2
commit f85188ca6b
2 changed files with 0 additions and 15 deletions

View File

@@ -5,13 +5,6 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), version
---
## [1.14.1] — 2026-04-21
### Security
- **`AdminLoginView` now rejects non-admin roles** — users with `role` in `{customer, partner, partner_manager, partner_staff, partner_customer}` can no longer obtain an admin JWT via `POST /api/v1/auth/login/`. Returns HTTP 403 with `{'error': 'This account is not authorized for the admin dashboard.'}` and writes an `auth.admin_login_failed` audit row with `reason: 'non_admin_role'`. Superusers and any user with an attached `StaffProfile` remain allowed regardless of role, so existing admin staff are unaffected. Closes the gap where partner_manager accounts (e.g. `novakopro@gmail.com`) could log into `admin.eventifyplus.com` and hit protected routes
---
## [1.14.0] — 2026-04-21
### Added