User management

An internal chatbot has admin work to do: new teammates, leavers, new document batches. If each of those needs a code change, the tool will drift away from the real org. The admin tab absorbs that operational reality.

Three gates on every admin action

Token presence, session validity, and role check. All three run on the server before any write.

Three checks, every action. UI gating is convenience. Server gating is the wall.
app.py
python
def check_admin_panel(token: str, role: str):
    if not token:
        return "## Admin Panel\nPlease log in first."
    if not user_auth.validate_session(token):
        return "## Admin Panel\nSession expired. Please log in again."
    if role != "admin":
        return "## Admin Panel\nAdmin privileges required."
    return "## Admin Panel\nYou have admin access. Use the sections below."


def add_new_user(token: str, current_role: str, username: str, password: str, role: str):
    if not token or current_role != "admin":
        return "Admin privileges required."
    if not user_auth.validate_session(token):
        return "Session expired."
    ok = user_auth.add_user(username, password, role)
    return f"Added user `{username}` with role `{role}`." if ok else "Failed to add user."

Every admin action checks token + role. Session validation on every call means no stale UI can perform writes after logout.

Quiz: Quiz

Loading practice…

Validation checklist: Verify user management

Loading practice…