feat(security): isolate only superadmin whitelist for employee access across users and db tabs

app/auth_deps.py

@@ -125,10 +125,7 @@ async def require_admin(
     
     # Authoritative whitelist check for superadmin override
     whitelist = {
-        "admin@sahihislam.com",
-        "suhaileng.bhat@gmail.com",
         "zainshafibhat@gmail.com",
-        "zainshafibhat2@gmail.com",
     }
     env_emails = os.getenv("SUPERADMIN_EMAILS", "")
     for e in env_emails.split(","):

app/superadmin_routes.py

@@ -59,10 +59,7 @@ router = APIRouter()
 # SUPERADMIN ACCESS CONTROL (ENTERPRISE DEFENSE-IN-DEPTH)
 # =========================================================
 SUPERADMIN_IMMUTABLE_WHITELIST = {
-    "admin@sahihislam.com",
-    "suhaileng.bhat@gmail.com",
     "zainshafibhat@gmail.com",
-    "zainshafibhat2@gmail.com",
 }
 
 PROTECTED_SECURITY_ATTRIBUTES = {
@@ -539,24 +536,22 @@ async def get_all_users(
         is_sa_caller = bool(admin.get("is_superadmin", False))
 
         # 1. SECURITY PRIVACY FILTER:
-        # If caller is an employee (not true SuperAdmin), filter out all SuperAdmin accounts
-        # AND all fellow employee / staff user records!
+        # If caller is an employee (not true SuperAdmin), filter out ONLY the SuperAdmin account(s).
+        # Regular users and fellow accounts remain visible to the employee.
         # The SuperAdmin caller sees EVERY single user in the entire system with zero exclusions.
         if not is_sa_caller:
             protected_emails = set(whitelist)
-            protected_uids = set()
+            protected_regexes = [re.compile(f"^{re.escape(e)}$", re.IGNORECASE) for e in protected_emails]
 
-            async for s in staff_permissions_collection.find({}, {"email": 1, "uid": 1}):
-                if s.get("email"):
-                    protected_emails.add(s["email"].strip().lower())
-                if s.get("uid"):
-                    protected_uids.add(s["uid"].strip())
+            protected_uids = set()
+            async for u in users_collection.find({"email": {"$in": protected_regexes}}, {"uid": 1}):
+                if u.get("uid"):
+                    protected_uids.add(u["uid"].strip())
 
             # Forbid employee from filtering by SUPERADMIN role
             if role and role.strip().upper() == "SUPERADMIN":
                 return []
 
-            protected_regexes = [re.compile(f"^{re.escape(e)}$", re.IGNORECASE) for e in protected_emails]
             exclusion_clauses = [{"email": {"$nin": protected_regexes}}]
             if protected_uids:
                 exclusion_clauses.append({"uid": {"$nin": list(protected_uids)}})
@@ -713,13 +708,10 @@ async def update_user_attributes(
     if not is_sa_caller:
         target_email = (target.get("email") or "").strip().lower()
         whitelist = get_superadmin_whitelist()
-        is_staff_target = await staff_permissions_collection.find_one({
-            "$or": [{"uid": uid}, {"email": target_email}]
-        })
-        if target_email in whitelist or is_staff_target:
+        if target_email in whitelist:
             raise HTTPException(
                 status_code=403,
-                detail="Access denied: Administrative and staff accounts cannot be modified by employees."
+                detail="Access denied: SuperAdmin accounts cannot be modified by employees."
             )
     
     update_data = {}
@@ -831,13 +823,10 @@ async def delete_user(uid: str, admin: dict = Depends(require_superadmin)):
     if not is_sa_caller:
         target_email = (target.get("email") or "").strip().lower()
         whitelist = get_superadmin_whitelist()
-        is_staff_target = await staff_permissions_collection.find_one({
-            "$or": [{"uid": uid}, {"email": target_email}]
-        })
-        if target_email in whitelist or is_staff_target:
+        if target_email in whitelist:
             raise HTTPException(
                 status_code=403,
-                detail="Access denied: Administrative and staff accounts cannot be deleted by employees."
+                detail="Access denied: SuperAdmin accounts cannot be deleted by employees."
             )
     
     # Delete user document
@@ -890,10 +879,7 @@ async def search_user_by_email(
     if not is_sa_caller:
         target_email = (user.get("email") or "").strip().lower()
         whitelist = get_superadmin_whitelist()
-        is_staff_target = await staff_permissions_collection.find_one({
-            "$or": [{"uid": user.get("uid")}, {"email": target_email}]
-        })
-        if target_email in whitelist or is_staff_target:
+        if target_email in whitelist:
             raise HTTPException(status_code=404, detail=f"No user found with email matching '{clean_email}'")
 
     # Concurrent fetch of wallet balance & recent VIP transactions for user
@@ -2130,18 +2116,19 @@ async def get_statistics(admin: dict = Depends(require_superadmin)):
     """
     t0 = time.perf_counter()
     try:
+        is_sa_caller = bool(admin.get("is_superadmin", False))
+        whitelist = get_superadmin_whitelist()
+        whitelist_regexes = [re.compile(f"^{re.escape(e)}$", re.IGNORECASE) for e in whitelist]
+
         async def _count_users():
+            if not is_sa_caller:
+                return await users_collection.count_documents({"email": {"$nin": whitelist_regexes}})
             return await users_collection.count_documents({})
 
         async def _count_superadmins():
-            return await users_collection.count_documents({
-                "$or": [
-                    {"superadmin": True},
-                    {"auth.superadmin": True},
-                    {"auth.is_superadmin": True},
-                    {"role": "SUPERADMIN"}
-                ]
-            })
+            if not is_sa_caller:
+                return 0
+            return len(whitelist)
 
         async def _count_pro_users():
             return await users_collection.count_documents({
@@ -2341,6 +2328,10 @@ async def get_database_overview(admin: dict = Depends(require_superadmin)):
             ("sahihislam_commerce", "Commerce & Ads", db_commerce, "financial"),
         ]
         
+        is_sa_caller = bool(admin.get("is_superadmin", False))
+        whitelist = get_superadmin_whitelist()
+        whitelist_regexes = [re.compile(f"^{re.escape(e)}$", re.IGNORECASE) for e in whitelist]
+
         db_summaries = []
         overall_total_docs = 0
         overall_total_collections = 0
@@ -2349,18 +2340,30 @@ async def get_database_overview(admin: dict = Depends(require_superadmin)):
             coll_names = await db_handle.list_collection_names()
             filtered_colls = sorted([c for c in coll_names if not c.startswith("system.")])
             
+            # Hide staff_permissions collection from employees
+            if not is_sa_caller and name == "sahihislam_admin":
+                filtered_colls = [c for c in filtered_colls if c != "staff_permissions"]
+            
             async def _inspect_collection(c_name: str):
                 coll = db_handle[c_name]
                 try:
-                    stats = await db_handle.command("collStats", c_name)
-                    doc_count = stats.get("count", 0)
-                    size_bytes = stats.get("size", 0)
-                    index_count = stats.get("nindexes", 1)
+                    if not is_sa_caller and c_name == "users":
+                        doc_count = await coll.count_documents({"email": {"$nin": whitelist_regexes}})
+                        size_bytes = 0
+                        index_count = 1
+                    else:
+                        stats = await db_handle.command("collStats", c_name)
+                        doc_count = stats.get("count", 0)
+                        size_bytes = stats.get("size", 0)
+                        index_count = stats.get("nindexes", 1)
                 except Exception:
                     try:
-                        doc_count = await coll.estimated_document_count()
+                        if not is_sa_caller and c_name == "users":
+                            doc_count = await coll.count_documents({"email": {"$nin": whitelist_regexes}})
+                        else:
+                            doc_count = await coll.count_documents({})
                     except Exception:
-                        doc_count = await coll.count_documents({})
+                        doc_count = 0
                     size_bytes = 0
                     index_count = 1
                 return {
@@ -2426,7 +2429,30 @@ async def get_collection_documents(
         db_handle, db_name = _get_target_database(database if isinstance(database, str) else None)
         coll = db_handle[collection]
         
+        is_sa_caller = bool(admin.get("is_superadmin", False))
+        whitelist = get_superadmin_whitelist()
+        whitelist_regexes = [re.compile(f"^{re.escape(e)}$", re.IGNORECASE) for e in whitelist]
+
+        # Security restriction: staff_permissions collection is restricted to master SuperAdmin only
+        if not is_sa_caller and collection == "staff_permissions":
+            raise HTTPException(
+                status_code=403,
+                detail="Access denied: staff permissions collection is restricted to master SuperAdmin."
+            )
+
         query_parts = []
+
+        # Security isolation: In users collection, filter out SuperAdmin accounts for employee callers
+        if not is_sa_caller and collection == "users":
+            sa_uids = set()
+            async for u in users_collection.find({"email": {"$in": whitelist_regexes}}, {"uid": 1}):
+                if u.get("uid"):
+                    sa_uids.add(u["uid"].strip())
+
+            query_parts.append({"email": {"$nin": whitelist_regexes}})
+            if sa_uids:
+                query_parts.append({"uid": {"$nin": list(sa_uids)}})
+                query_parts.append({"_id": {"$nin": list(sa_uids)}})
         
         # 1. Apply raw JSON filter if provided
         if isinstance(filter_json, str) and filter_json.strip():
@@ -2572,9 +2598,19 @@ async def get_single_document(
     try:
         db_handle, db_name = _get_target_database(database)
         coll = db_handle[collection]
+        is_sa_caller = bool(admin.get("is_superadmin", False))
+        if not is_sa_caller and collection == "staff_permissions":
+            raise HTTPException(status_code=403, detail="Access denied.")
+
         doc = await coll.find_one(_get_doc_id_query(doc_id))
         if not doc:
             raise HTTPException(status_code=404, detail=f"Document '{doc_id}' not found in {db_name}.{collection}")
+
+        if not is_sa_caller and collection == "users":
+            target_email = (doc.get("email") or "").strip().lower()
+            whitelist = get_superadmin_whitelist()
+            if target_email in whitelist:
+                raise HTTPException(status_code=404, detail=f"Document '{doc_id}' not found in {db_name}.{collection}")
         return {
             "database": db_name,
             "collection": collection,
@@ -2672,6 +2708,16 @@ async def update_document(
         if not existing:
             raise HTTPException(status_code=404, detail=f"Document '{doc_id}' not found in {db_name}.{collection}")
             
+        is_sa_caller = bool(admin.get("is_superadmin", False))
+        if not is_sa_caller:
+            if collection == "staff_permissions":
+                raise HTTPException(status_code=403, detail="Forbidden: Staff permissions cannot be altered via generic DB tools.")
+            if collection == "users":
+                target_email = (existing.get("email") or "").strip().lower()
+                whitelist = get_superadmin_whitelist()
+                if target_email in whitelist:
+                    raise HTTPException(status_code=403, detail="Forbidden: SuperAdmin records cannot be modified.")
+            
         update_fields = dict(payload)
         if "_id" in update_fields:
             del update_fields["_id"]
@@ -2737,6 +2783,16 @@ async def delete_document(
         if not existing:
             raise HTTPException(status_code=404, detail=f"Document '{doc_id}' not found in {db_name}.{collection}")
             
+        is_sa_caller = bool(admin.get("is_superadmin", False))
+        if not is_sa_caller:
+            if collection == "staff_permissions":
+                raise HTTPException(status_code=403, detail="Forbidden: Staff permissions cannot be altered via generic DB tools.")
+            if collection == "users":
+                target_email = (existing.get("email") or "").strip().lower()
+                whitelist = get_superadmin_whitelist()
+                if target_email in whitelist:
+                    raise HTTPException(status_code=403, detail="Forbidden: SuperAdmin records cannot be deleted.")
+            
         # Safeguard 1: Prevent self-deletion of superadmin user
         if collection == "users":
             target_uid = existing.get("uid")
@@ -2800,6 +2856,22 @@ async def execute_query(
         if not collection_name:
             raise HTTPException(status_code=400, detail="Collection name required")
             
+        is_sa_caller = bool(admin.get("is_superadmin", False))
+        if not is_sa_caller:
+            if collection_name == "staff_permissions":
+                raise HTTPException(status_code=403, detail="Access denied: staff permissions collection is restricted to master SuperAdmin.")
+            if collection_name == "users":
+                whitelist = get_superadmin_whitelist()
+                whitelist_regexes = [re.compile(f"^{re.escape(e)}$", re.IGNORECASE) for e in whitelist]
+                sa_exclusion = {"email": {"$nin": whitelist_regexes}}
+                if isinstance(query, dict):
+                    if "$and" in query:
+                        query["$and"].append(sa_exclusion)
+                    elif query:
+                        query = {"$and": [query, sa_exclusion]}
+                    else:
+                        query = sa_exclusion
+
         coll = db_handle[collection_name]
         
         if operation == "count":
@@ -2823,11 +2895,6 @@ async def execute_query(
     except Exception as e:
         logger.error(f"SuperAdmin query error: {str(e)}")
         raise HTTPException(status_code=500, detail=f"Query failed: {str(e)}")
-    except HTTPException:
-        raise
-    except Exception as e:
-        logger.error(f"SuperAdmin query error: {str(e)}")
-        raise HTTPException(status_code=500, detail=f"Query failed: {str(e)}")
 
 
 # =========================================================
@@ -5533,8 +5600,13 @@ async def simulate_search_tier_query(
 async def get_database_stats(admin: dict = Depends(require_superadmin)):
     """Get database collection statistics."""
     try:
+        is_sa_caller = bool(admin.get("is_superadmin", False))
+        whitelist = get_superadmin_whitelist()
+        whitelist_regexes = [re.compile(f"^{re.escape(e)}$", re.IGNORECASE) for e in whitelist]
+        user_query = {} if is_sa_caller else {"email": {"$nin": whitelist_regexes}}
+
         stats = {
-            "users_count": await users_collection.count_documents({}),
+            "users_count": await users_collection.count_documents(user_query),
             "masjids_count": await masjid_collection.count_documents({}),
             "hadiths_count": await hadith_collection.count_documents({}),
             "ads_count": await ads_collection.count_documents({}),