c7692e30d3
The function only checked that the caller was an authenticated user (not an agent) but its name implied privilege enforcement. Rename to require_user_actor and add docstring clarifying the distinction between actor-type checks and privilege/role checks (require_org_admin, is_super_admin). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
22 lines
699 B
Python
22 lines
699 B
Python
"""Access control helpers for actor-type checks."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from typing import TYPE_CHECKING
|
|
|
|
from fastapi import HTTPException, status
|
|
|
|
if TYPE_CHECKING:
|
|
from app.core.auth import AuthContext
|
|
|
|
|
|
def require_user_actor(auth: AuthContext) -> None:
|
|
"""Raise HTTP 403 unless the authenticated actor is a human user (not an agent).
|
|
|
|
NOTE: This is an actor-type check, NOT a privilege/role check.
|
|
For admin privilege enforcement, use ``require_org_admin`` (organization-level)
|
|
or check ``user.is_super_admin`` (global-level).
|
|
"""
|
|
if auth.actor_type != "user" or auth.user is None:
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN)
|