fix: make FrontendType mandatory in require_module_access
The require_module_access dependency was using path-based detection to determine admin vs vendor authentication, which failed for API routes (/api/v1/admin/*) because it only checked for /admin/*. Changes: - Make frontend_type parameter mandatory (was optional with fallback) - Remove path-based detection logic from require_module_access - Update all 33 module route files to pass explicit FrontendType: - 15 admin routes use FrontendType.ADMIN - 18 vendor routes use FrontendType.VENDOR This ensures authentication method is explicitly declared at route definition time, making it independent of URL structure and future-proof for API version changes. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
@@ -14,6 +14,7 @@ Aggregates all admin monitoring routes:
|
||||
from fastapi import APIRouter, Depends
|
||||
|
||||
from app.api.deps import require_module_access
|
||||
from app.modules.enums import FrontendType
|
||||
|
||||
from .admin_logs import admin_logs_router
|
||||
from .admin_tasks import admin_tasks_router
|
||||
@@ -23,7 +24,7 @@ from .admin_audit import admin_audit_router
|
||||
from .admin_platform_health import admin_platform_health_router
|
||||
|
||||
admin_router = APIRouter(
|
||||
dependencies=[Depends(require_module_access("monitoring"))],
|
||||
dependencies=[Depends(require_module_access("monitoring", FrontendType.ADMIN))],
|
||||
)
|
||||
|
||||
# Aggregate all monitoring admin routes
|
||||
|
||||
Reference in New Issue
Block a user