Spaces:
Running on Zero
Running on Zero
feat(security): decouple superadmin from database attributes and anchor to code email whitelist
98f54a9 | #!/usr/bin/env python3 | |
| """ | |
| Check if a user has superadmin privileges. | |
| SuperAdmin is code-governed via immutable email whitelist (NEVER stored in DB). | |
| Usage: python check_superadmin.py <email> | |
| """ | |
| import sys | |
| import os | |
| sys.path.insert(0, os.path.dirname(os.path.abspath(__file__))) | |
| from app.superadmin_routes import get_superadmin_whitelist | |
| def check_superadmin(email: str): | |
| clean_email = email.strip().lower() | |
| whitelist = get_superadmin_whitelist() | |
| is_superadmin = clean_email in whitelist | |
| print(f"\n[CHECK] Checking email: {clean_email}") | |
| print("[POLICY] Architecture: Code-Governed Immutable Whitelist (DB Attributes Scrubbed)") | |
| print(f"[STATUS] SuperAdmin Status: {is_superadmin}") | |
| if is_superadmin: | |
| print(f"[ACCESS GRANTED] {clean_email} IS an authorized SuperAdmin platform owner in code.") | |
| else: | |
| print(f"[ACCESS DENIED] {clean_email} is NOT in the SuperAdmin email whitelist.") | |
| def main(): | |
| if len(sys.argv) < 2: | |
| print("Usage: python check_superadmin.py <email>") | |
| sys.exit(1) | |
| email = sys.argv[1].strip() | |
| check_superadmin(email) | |
| if __name__ == "__main__": | |
| main() | |