2 Commits

Include renames

Author	SHA1	Message	Date
Logan CusanoandClaude Opus 5.5	17da2ff739	Admin-created users join an org, so viewers can actually see data ... POST /admin/users set a role claim but never an org_id/org_role claim or an org_members doc. firestore.rules gates every read on the org_id claim, so a viewer created from the Users page saw no incidents or calls. New users now join the requested org (default: the acting admin's own, else 'founding') as org_role 'member', with the same org_members doc POST /auth/signup writes. PATCH /admin/users/{uid} attaches an org-less user the same way, which heals accounts created before this fix; it never silently moves a user who already has an org. Verified: c2-core pytest 495 passed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-27 18:16:16 -04:00
Logan	1f17b6c0d2	feat: add role-based user management, audit log, and session tracking ... Introduces a full user management system with three roles (admin, operator, viewer), an audit log, and per-session login history. Backend: - app/internal/audit.py: write_audit() helper → audit_log Firestore collection - app/internal/auth.py: get_role() helper; require_admin_token accepts both legacy admin:true claim and new role:"admin" claim for backward compat - app/routers/users.py: CRUD under /admin/users — list, create (returns one-time invite link), get (with sessions), patch role/nodes/name, disable, enable, delete; operator role requires ≥1 owned node - app/routers/links.py: POST /auth/session records sign-in events to user_sessions Firestore collection - app/routers/admin.py: GET /admin/audit paginated endpoint - app/main.py: register users router Frontend: - AuthProvider: exposes role, isAdmin, isOperator, ownedNodeIds from claims - Nav: role-gated links — viewers get dashboard/calls/incidents/map/alerts/ trips; operators add nodes/systems/tokens; admins add admin - admin/page.tsx: new Users tab (list table, create modal, inline edit panel with role/nodes editor, disable/enable/delete, login history) and Audit Log tab (paginated, color-coded actions) - login/page.tsx: calls recordSession() on email and Google sign-in - nodes, systems, tokens pages: role guards redirect viewers to dashboard - profile/page.tsx: shows accurate role badge and label - lib/types.ts: UserRole, UserRecord, UserSession, AuditEntry types - lib/c2api.ts: user management methods + recordSession Firestore collections added: user_profiles, audit_log, user_sessions Firebase custom claims schema: { role, owned_node_ids, admin (legacy) }	2026-06-22 00:02:09 -04:00