Admin Role

The admin role provides users with unrestricted access to all clients in the system, effectively bypassing the client_list filtering that normally restricts users to viewing only data for clients they have been explicitly granted access to.

How It Works

Users with the admin role can:

• View data for all clients in the system
• Access all location history data regardless of client association
• See all trackers, production runs, and other client-specific data

The admin role is implemented as part of the JWT token authentication system. When a user with the admin role logs in, their JWT token includes a roles claim containing "admin". This role is then checked in the resolvers to determine whether to apply client filtering.

Granting Admin Role

To grant a user the admin role, use the provided utility script:

python scripts/add_admin_role.py user@example.com

This will add the "admin" role to the specified user. If the user already has the admin role, the script will indicate this.

Removing Admin Role

To remove the admin role from a user:

python scripts/add_admin_role.py user@example.com --remove

Listing Admin Users

To list all users with the admin role:

python scripts/add_admin_role.py --list

Implementation Details

The admin role feature is implemented through several components:

1. User Model: The User model includes a roles field that stores an array of roles.

2. JWT Token: When a user logs in, their roles are included in the JWT token.

3. Authentication Middleware: The middleware checks for the admin role when processing requests.

4. GraphQL Resolvers: Resolvers bypass client filtering for users with the admin role.

Security Considerations

The admin role grants significant access privileges. Consider the following security practices:

• Grant admin role only to trusted users who require full system access
• Regularly audit the list of admin users
• Consider implementing additional logging for actions performed by admin users
• Rotate admin user passwords regularly
• Use strong passwords for admin accounts

Technical Implementation

The admin role is implemented by checking for the presence of "admin" in the user's roles array:

async def is_admin_from_token(info) -> bool:
    """Check if the user has admin role in their token."""
    request = info.context["request"]
    access_token = extract_token(request)
    if access_token:
        token_data = await verify_token(access_token)
        roles = token_data.get("roles", [])
        return "admin" in roles
    return False

In resolvers, client filtering is bypassed for admin users:

# Skip client filter for admins
if not is_admin:
    # Apply client filtering
    filters.append(Brand.client_id.in_(client_list))

This approach allows for future expansion of the role system to include other roles with different permissions.