The require_module_access dependency was using path-based detection to determine admin vs vendor authentication, which failed for API routes (/api/v1/admin/*) because it only checked for /admin/*. Changes: - Make frontend_type parameter mandatory (was optional with fallback) - Remove path-based detection logic from require_module_access - Update all 33 module route files to pass explicit FrontendType: - 15 admin routes use FrontendType.ADMIN - 18 vendor routes use FrontendType.VENDOR This ensures authentication method is explicitly declared at route definition time, making it independent of URL structure and future-proof for API version changes. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
34 lines
1.1 KiB
Python
34 lines
1.1 KiB
Python
# app/modules/cms/routes/api/admin.py
|
|
"""
|
|
CMS module admin API routes.
|
|
|
|
Aggregates all admin CMS routes:
|
|
- /content-pages/* - Content page management
|
|
- /images/* - Image upload and management
|
|
- /media/* - Vendor media libraries
|
|
- /vendor-themes/* - Vendor theme customization
|
|
"""
|
|
|
|
from fastapi import APIRouter, Depends
|
|
|
|
from app.api.deps import require_module_access
|
|
from app.modules.enums import FrontendType
|
|
|
|
from .admin_content_pages import admin_content_pages_router
|
|
from .admin_images import admin_images_router
|
|
from .admin_media import admin_media_router
|
|
from .admin_vendor_themes import admin_vendor_themes_router
|
|
|
|
admin_router = APIRouter(
|
|
dependencies=[Depends(require_module_access("cms", FrontendType.ADMIN))],
|
|
)
|
|
|
|
# For backwards compatibility with existing imports
|
|
router = admin_router
|
|
|
|
# Aggregate all CMS admin routes
|
|
admin_router.include_router(admin_content_pages_router, tags=["admin-content-pages"])
|
|
admin_router.include_router(admin_images_router, tags=["admin-images"])
|
|
admin_router.include_router(admin_media_router, tags=["admin-media"])
|
|
admin_router.include_router(admin_vendor_themes_router, tags=["admin-vendor-themes"])
|