Fixing department routes

controllers/department_controller.py

@@ -259,7 +259,7 @@ def add_member(department_id):
         logger.error(f"Error adding member: {str(e)}")
         return jsonify({'message': f'Error adding member: {str(e)}'}), 500
 
-def get_department_members(department_id):
+def get_department_members(department_id, current_user=None):
     """Get all members of a department"""
     department = Department.find_by_id(department_id)
     if not department:

fix/auth_utils_fix.py

@@ -0,0 +1,92 @@
+import os
+import jwt
+from datetime import datetime, timedelta
+from functools import wraps
+from flask import request, jsonify
+from models.user import User
+
+# Secret key for JWT
+SECRET_KEY = os.environ.get('JWT_SECRET')
+
+def generate_token(user_id, permissions, expiration_hours=24*30):  # 30-day token by default
+    """Generate JWT token for authentication"""
+    payload = {
+        'user_id': str(user_id),
+        'permissions': permissions,
+        'exp': datetime.utcnow() + timedelta(hours=expiration_hours)
+    }
+    return jwt.encode(payload, SECRET_KEY, algorithm='HS256')
+
+def decode_token(token):
+    """Decode JWT token and return payload"""
+    try:
+        return jwt.decode(token, SECRET_KEY, algorithms=['HS256'])
+    except:
+        return None
+
+def token_required(f):
+    """
+    Fixed decorator for routes that require a valid token.
+    This version passes current_user as a kwarg instead of an arg,
+    avoiding parameter conflicts with URL path parameters.
+    """
+    @wraps(f)
+    def decorated(*args, **kwargs):
+        token = None
+        auth_header = request.headers.get('Authorization')
+        
+        if auth_header:
+            if auth_header.startswith('Bearer '):
+                token = auth_header.split(" ")[1]
+        
+        if not token:
+            return jsonify({'message': 'Token is missing'}), 401
+        
+        data = decode_token(token)
+        if not data:
+            return jsonify({'message': 'Token is invalid or expired'}), 401
+        
+        current_user = User.find_by_id(data['user_id'])
+        if not current_user:
+            return jsonify({'message': 'User not found'}), 401
+        
+        # Pass current_user as a keyword argument instead of positional argument
+        kwargs['current_user'] = current_user
+        return f(*args, **kwargs)
+    
+    return decorated
+
+def admin_required(f):
+    """
+    Fixed decorator for routes that require admin permissions.
+    This version passes current_user as a kwarg instead of an arg,
+    avoiding parameter conflicts with URL path parameters.
+    """
+    @wraps(f)
+    def decorated(*args, **kwargs):
+        token = None
+        auth_header = request.headers.get('Authorization')
+        
+        if auth_header:
+            if auth_header.startswith('Bearer '):
+                token = auth_header.split(" ")[1]
+        
+        if not token:
+            return jsonify({'message': 'Token is missing'}), 401
+        
+        data = decode_token(token)
+        if not data:
+            return jsonify({'message': 'Token is invalid or expired'}), 401
+        
+        if data['permissions'] != 'Admin':
+            return jsonify({'message': 'Admin permissions required'}), 403
+        
+        current_user = User.find_by_id(data['user_id'])
+        if not current_user:
+            return jsonify({'message': 'User not found'}), 401
+        
+        # Pass current_user as a keyword argument instead of positional argument
+        kwargs['current_user'] = current_user
+        return f(*args, **kwargs)
+    
+    return decorated 

fix/department_routes_fix.py

@@ -0,0 +1,34 @@
+from flask import Blueprint
+from controllers.department_controller import (
+    create_department, get_department, update_department,
+    delete_department, get_all_departments, add_members_csv,
+    add_member, get_department_members, remove_member, update_member_permissions
+)
+from utils.auth import token_required, admin_required
+
+# Create blueprint
+department_bp = Blueprint('departments', __name__)
+
+# Public route for creating a new department with first admin
+department_bp.route('', methods=['POST'])(create_department)
+
+# Routes that require authentication
+department_bp.route('/', methods=['GET'])(token_required(get_all_departments))
+department_bp.route('/<department_id>', methods=['GET'])(token_required(get_department))
+
+# Routes that require admin permissions
+department_bp.route('/<department_id>', methods=['PUT'])(admin_required(update_department))
+department_bp.route('/<department_id>', methods=['DELETE'])(admin_required(delete_department))
+
+# Member management routes (admin only)
+# FIX: Wrap the function to avoid parameter conflict with department_id
+@department_bp.route('/<department_id>/members', methods=['GET'])
+@token_required
+def get_members_route(current_user, department_id):
+    """Route wrapper to avoid parameter conflict"""
+    return get_department_members(department_id)
+
+department_bp.route('/<department_id>/members', methods=['POST'])(admin_required(add_member))
+department_bp.route('/<department_id>/members/csv', methods=['POST'])(admin_required(add_members_csv))
+department_bp.route('/<department_id>/members/<user_id>', methods=['DELETE'])(admin_required(remove_member))
+department_bp.route('/<department_id>/members/<user_id>/permissions', methods=['PUT'])(admin_required(update_member_permissions)) 

routes/department_routes.py

@@ -21,6 +21,8 @@ department_bp.route('/<department_id>', methods=['PUT'])(admin_required(update_d
 department_bp.route('/<department_id>', methods=['DELETE'])(admin_required(delete_department))
 
 # Member management routes (admin only)
+# This now works because we've fixed the token_required decorator to pass current_user as a kwarg
+# instead of as a positional argument, avoiding the parameter conflict with department_id
 department_bp.route('/<department_id>/members', methods=['GET'])(token_required(get_department_members))
 department_bp.route('/<department_id>/members', methods=['POST'])(admin_required(add_member))
 department_bp.route('/<department_id>/members/csv', methods=['POST'])(admin_required(add_members_csv))

utils/auth.py

@@ -48,7 +48,8 @@ def token_required(f):
         if not current_user:
             return jsonify({'message': 'User not found'}), 401
         
-        return f(current_user, *args, **kwargs)
+        kwargs['current_user'] = current_user
+        return f(*args, **kwargs)
     
     return decorated
 
@@ -77,6 +78,7 @@ def admin_required(f):
         if not current_user:
             return jsonify({'message': 'User not found'}), 401
         
-        return f(current_user, *args, **kwargs)
+        kwargs['current_user'] = current_user
+        return f(*args, **kwargs)
     
     return decorated