apps.authentication — Identity, RBAC & Resellers

IMPLEMENTED

• Location: backend/apps/authentication/
• Responsibilities: User authentication, token issuance, staff tenant membership, role-based access control, and reseller financial ledgers.

1. Database Models (6 Models)

2. Authorization & RBAC Workflow

Permissions are defined in apps.authentication.permissions and verified via StaffMembership:

class HasPermissionScope(permissions.BasePermission):
    """
    Checks if the authenticated staff member possesses the required permission code
    within the resolved request.tenant.
    """
    def has_permission(self, request, view):
        if not request.user or not request.user.is_authenticated:
            return False
        if request.user.is_superuser:
            return True
        membership = StaffMembership.objects.filter(
            user=request.user,
            tenant=request.tenant,
            is_active=True
        ).select_related('role').first()
        if not membership or not membership.role:
            return False
        required_perm = getattr(view, 'required_permission', None)
        return membership.role.permissions.filter(code=required_perm).exists()

Authoritative Role Assignment & Seeding

• Default Roles: Initialized per tenant via seed_default_roles_for_tenant(tenant) in apps.authentication.services.rbac. Seeds default roles: Admin (permissions='__all__'), Manager, Accountant, Technician, and Support.
• Tenant Administrator: Provisioned via provision_tenant_admin() in apps.core.saas_views. Guarantees default role seeding, binds an authoritative StaffMembership(role=admin_role, scope='TENANT'), and generates auth tokens.
• Office Staff Delegation: Once authenticated with role: "Admin", the ISP Admin has access to /staff/ to provision and manage employee accounts with specific roles.

3. Endpoints

• POST /api/v1/auth/login/: Validates credentials, returns Token and tenant membership.
• GET /api/v1/auth/me/: Returns current profile, assigned role, and permitted capability flags.
• GET/POST /api/v1/staff/: Office staff CRUD within tenant (managed by ISP Admin).
• GET/POST /api/v1/roles/: Custom role management with permission checkbox assignment.