83 lines
2.7 KiB
Python
83 lines
2.7 KiB
Python
from flask import Blueprint, request, jsonify
|
|
from flask_jwt_extended import jwt_required, get_jwt_identity
|
|
from app.extensions import db
|
|
from app.models.user import User
|
|
from app.services.auth_service import AuthService
|
|
from app.utils.rbac import admin_required, get_current_user
|
|
|
|
users_bp = Blueprint('users', __name__, url_prefix='/api/v1/users')
|
|
|
|
@users_bp.route('', methods=['GET'])
|
|
@admin_required()
|
|
def list_users():
|
|
users = User.query.order_by(User.criado_em.desc()).all()
|
|
return jsonify([u.to_dict() for u in users]), 200
|
|
|
|
@users_bp.route('', methods=['POST'])
|
|
@admin_required()
|
|
def create_user():
|
|
data = request.get_json() or {}
|
|
nome = data.get('nome')
|
|
email = data.get('email')
|
|
password = data.get('password')
|
|
role = data.get('role', 'user')
|
|
|
|
res, error = AuthService.create_user(nome, email, password, role)
|
|
if error:
|
|
return jsonify({'error': error}), 400
|
|
|
|
return jsonify(res), 201
|
|
|
|
@users_bp.route('/<user_id>', methods=['GET'])
|
|
@jwt_required()
|
|
def get_user(user_id):
|
|
current_user = get_current_user()
|
|
if not current_user:
|
|
return jsonify({'error': 'Não autorizado.'}), 401
|
|
|
|
if not current_user.is_admin() and current_user.id != user_id:
|
|
return jsonify({'error': 'Acesso negado.'}), 403
|
|
|
|
user = db.session.get(User, user_id)
|
|
if not user:
|
|
return jsonify({'error': 'Usuário não encontrado.'}), 404
|
|
|
|
return jsonify(user.to_dict()), 200
|
|
|
|
@users_bp.route('/<user_id>', methods=['PUT'])
|
|
@admin_required()
|
|
def update_user(user_id):
|
|
user = db.session.get(User, user_id)
|
|
if not user:
|
|
return jsonify({'error': 'Usuário não encontrado.'}), 404
|
|
|
|
data = request.get_json() or {}
|
|
if 'nome' in data:
|
|
user.nome = data['nome'].strip()
|
|
if 'role' in data and data['role'] in ('admin', 'user'):
|
|
user.role = data['role']
|
|
if 'ativo' in data:
|
|
user.ativo = bool(data['ativo'])
|
|
if 'new_password' in data and data['new_password']:
|
|
if len(data['new_password']) < 6:
|
|
return jsonify({'error': 'A senha deve conter no mínimo 6 caracteres.'}), 400
|
|
user.set_password(data['new_password'])
|
|
|
|
db.session.commit()
|
|
return jsonify(user.to_dict()), 200
|
|
|
|
@users_bp.route('/<user_id>', methods=['DELETE'])
|
|
@admin_required()
|
|
def delete_user(user_id):
|
|
current_user = get_current_user()
|
|
if current_user and current_user.id == user_id:
|
|
return jsonify({'error': 'Não é possível excluir o próprio usuário em uso.'}), 400
|
|
|
|
user = db.session.get(User, user_id)
|
|
if not user:
|
|
return jsonify({'error': 'Usuário não encontrado.'}), 404
|
|
|
|
db.session.delete(user)
|
|
db.session.commit()
|
|
return jsonify({'message': f'Usuário {user.email} excluído com sucesso.'}), 200
|