Files
orion/app/modules/cms/routes/api/admin.py
Samir Boulahtit 9a0dd84035 fix: make FrontendType mandatory in require_module_access
The require_module_access dependency was using path-based detection to
determine admin vs vendor authentication, which failed for API routes
(/api/v1/admin/*) because it only checked for /admin/*.

Changes:
- Make frontend_type parameter mandatory (was optional with fallback)
- Remove path-based detection logic from require_module_access
- Update all 33 module route files to pass explicit FrontendType:
  - 15 admin routes use FrontendType.ADMIN
  - 18 vendor routes use FrontendType.VENDOR

This ensures authentication method is explicitly declared at route
definition time, making it independent of URL structure and future-proof
for API version changes.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-02 22:09:21 +01:00

34 lines
1.1 KiB
Python

# app/modules/cms/routes/api/admin.py
"""
CMS module admin API routes.
Aggregates all admin CMS routes:
- /content-pages/* - Content page management
- /images/* - Image upload and management
- /media/* - Vendor media libraries
- /vendor-themes/* - Vendor theme customization
"""
from fastapi import APIRouter, Depends
from app.api.deps import require_module_access
from app.modules.enums import FrontendType
from .admin_content_pages import admin_content_pages_router
from .admin_images import admin_images_router
from .admin_media import admin_media_router
from .admin_vendor_themes import admin_vendor_themes_router
admin_router = APIRouter(
dependencies=[Depends(require_module_access("cms", FrontendType.ADMIN))],
)
# For backwards compatibility with existing imports
router = admin_router
# Aggregate all CMS admin routes
admin_router.include_router(admin_content_pages_router, tags=["admin-content-pages"])
admin_router.include_router(admin_images_router, tags=["admin-images"])
admin_router.include_router(admin_media_router, tags=["admin-media"])
admin_router.include_router(admin_vendor_themes_router, tags=["admin-vendor-themes"])