RBAC in the API

backend/app/api/endpoints/pprs.py

@@ -2,7 +2,7 @@ from typing import List, Optional
 from fastapi import APIRouter, Depends, HTTPException, status, Request
 from sqlalchemy.orm import Session
 from datetime import date
-from app.api.deps import get_db, get_current_active_user
+from app.api.deps import get_db, get_current_read_user, get_current_operator_user
 from app.crud.crud_ppr import ppr as crud_ppr
 from app.crud.crud_journal import journal as crud_journal
 from app.schemas.ppr import PPR, PPRCreate, PPRUpdate, PPRStatus, PPRStatusUpdate, Journal
@@ -21,7 +21,7 @@ async def get_pprs(
     date_from: Optional[date] = None,
     date_to: Optional[date] = None,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_active_user)
+    current_user: User = Depends(get_current_read_user)
 ):
     """Get PPR records with optional filtering"""
     pprs = crud_ppr.get_multi(
@@ -36,7 +36,7 @@ async def create_ppr(
     request: Request,
     ppr_in: PPRCreate,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_active_user)
+    current_user: User = Depends(get_current_operator_user)
 ):
     """Create a new PPR record"""
     client_ip = get_client_ip(request)
@@ -60,7 +60,7 @@ async def create_ppr(
 async def get_ppr(
     ppr_id: int,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_active_user)
+    current_user: User = Depends(get_current_read_user)
 ):
     """Get a specific PPR record"""
     ppr = crud_ppr.get(db, ppr_id=ppr_id)
@@ -78,7 +78,7 @@ async def update_ppr(
     ppr_id: int,
     ppr_in: PPRUpdate,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_active_user)
+    current_user: User = Depends(get_current_operator_user)
 ):
     """Update a PPR record"""
     db_ppr = crud_ppr.get(db, ppr_id=ppr_id)
@@ -111,7 +111,7 @@ async def patch_ppr(
     ppr_id: int,
     ppr_in: PPRUpdate,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_active_user)
+    current_user: User = Depends(get_current_operator_user)
 ):
     """Partially update a PPR record (only provided fields will be updated)"""
     db_ppr = crud_ppr.get(db, ppr_id=ppr_id)
@@ -144,7 +144,7 @@ async def update_ppr_status(
     ppr_id: int,
     status_update: PPRStatusUpdate,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_active_user)
+    current_user: User = Depends(get_current_operator_user)
 ):
     """Update PPR status (LANDED, DEPARTED, etc.)"""
     client_ip = get_client_ip(request)
@@ -182,7 +182,7 @@ async def delete_ppr(
     request: Request,
     ppr_id: int,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_active_user)
+    current_user: User = Depends(get_current_operator_user)
 ):
     """Delete (soft delete) a PPR record"""
     client_ip = get_client_ip(request)
@@ -210,7 +210,7 @@ async def delete_ppr(
 async def get_ppr_journal(
     ppr_id: int,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_active_user)
+    current_user: User = Depends(get_current_read_user)
 ):
     """Get journal entries for a specific PPR"""
     # Verify PPR exists