Enforce strict SuperAdmin vs Author panel separation.

Block SuperAdmin from /api/admin and /admin UI; validate author_slug matches JWT user; redirect each role to the correct panel.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/admin/router.py

@@ -25,7 +25,7 @@ from fastapi import APIRouter, Depends, File, Query, UploadFile
 from sqlalchemy import Integer
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.dependencies import get_db, get_current_user, get_redis
+from app.dependencies import get_db, get_current_author_scoped, get_redis
 from app.repositories.book_repo import BookRepository
 from app.repositories.audit_repo import AuditRepository
 
@@ -35,7 +35,7 @@ router = APIRouter()
 @router.get("/{author_slug}/dashboard")
 async def dashboard(
     author_slug: str,
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """Return high-level dashboard stats for the author."""
@@ -63,7 +63,7 @@ async def list_sessions(
     author_slug: str,
     limit: int = Query(50, ge=1, le=200),
     offset: int = 0,
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """List reader sessions with pagination."""
@@ -102,7 +102,7 @@ async def search_sessions(
     q: str = Query("", min_length=0, max_length=200),
     page: int = Query(1, ge=1),
     per_page: int = Query(20, ge=1, le=100),
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """Full-text search across chat messages for the author."""
@@ -164,7 +164,7 @@ async def search_sessions(
 async def block_session(
     author_slug: str,
     session_id: str,
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """Block a reader session (403 on next message)."""
@@ -183,7 +183,7 @@ async def block_session(
 async def unblock_session(
     author_slug: str,
     session_id: str,
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """Unblock a reader session."""
@@ -201,7 +201,7 @@ async def unblock_session(
 @router.get("/{author_slug}/books")
 async def list_books(
     author_slug: str,
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """List all books for the author."""
@@ -230,7 +230,7 @@ async def list_books(
 async def delete_book(
     author_slug: str,
     book_id: str,
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """Delete a book and its ChromaDB collection."""
@@ -252,7 +252,7 @@ async def delete_book(
 async def upload_book_cover(
     author_slug: str,
     book_id: str,
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
     file: UploadFile = File(...),
 ):
@@ -333,7 +333,7 @@ async def upload_book_cover(
 async def get_analytics(
     author_slug: str,
     days: int = Query(30, ge=1, le=365),
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """Return analytics data for dashboard charts."""
@@ -362,7 +362,7 @@ async def get_analytics(
 async def get_conversion_funnel(
     author_slug: str,
     days: int = Query(30, ge=1, le=365),
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """Return conversion funnel data derived from analytics events."""
@@ -430,7 +430,7 @@ async def get_conversion_funnel(
 async def get_intent_distribution(
     author_slug: str,
     days: int = Query(30, ge=1, le=365),
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """Return distribution of detected intents."""
@@ -462,7 +462,7 @@ async def get_intent_distribution(
 async def change_password(
     author_slug: str,
     body: dict,
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """Self-service password change."""
@@ -493,7 +493,7 @@ async def change_password(
 @router.get("/{author_slug}/widget-config")
 async def get_widget_config(
     author_slug: str,
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
 ):
     """Return current widget configuration."""
     return {
@@ -510,7 +510,7 @@ async def get_widget_config(
 async def update_widget_config(
     author_slug: str,
     body: dict,
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """Update widget configuration."""
@@ -539,7 +539,7 @@ async def update_widget_config(
 @router.get("/{author_slug}/profile")
 async def get_profile(
     author_slug: str,
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
 ):
     """Return current author profile."""
     return {
@@ -555,7 +555,7 @@ async def get_profile(
 async def update_profile(
     author_slug: str,
     body: dict,
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """Update author profile."""
@@ -577,7 +577,7 @@ async def update_profile(
 @router.get("/{author_slug}/personality")
 async def get_personality(
     author_slug: str,
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
 ):
     """Return bot personality settings."""
     return {
@@ -592,7 +592,7 @@ async def get_personality(
 async def update_personality(
     author_slug: str,
     body: dict,
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """Update bot personality settings."""
@@ -617,7 +617,7 @@ async def update_personality(
 @router.get("/{author_slug}/notifications")
 async def get_notifications(
     author_slug: str,
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
 ):
     """Return notification preferences."""
     return {
@@ -632,7 +632,7 @@ async def get_notifications(
 async def update_notifications(
     author_slug: str,
     body: dict,
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """Update notification preferences."""
@@ -655,7 +655,7 @@ async def update_notifications(
 @router.get("/{author_slug}/embed-token")
 async def get_embed_token(
     author_slug: str,
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """Return the active subscription token for embedding the widget.
@@ -718,7 +718,7 @@ async def update_smart_link(
     author_slug: str,
     book_id: str,
     body: dict,
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """Update buy/preview URLs for a book."""
@@ -753,7 +753,7 @@ async def update_smart_link(
 @router.get("/{author_slug}/token-usage")
 async def get_token_usage(
     author_slug: str,
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """Return token budget and consumption for the active subscription only."""
@@ -776,7 +776,7 @@ async def get_transcript(
     session_id: str,
     page: int = Query(1, ge=1),
     per_page: int = Query(50, ge=1, le=200),
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """Return paginated message transcript for a session."""
@@ -861,7 +861,7 @@ async def annotate_message(
     session_id: str,
     message_id: str,
     body: dict,
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """Add admin annotation to a chat message (append-only)."""
@@ -899,7 +899,7 @@ async def flag_message(
     session_id: str,
     message_id: str,
     body: dict,
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """Flag a message as spam, quality issue, or escalation."""
@@ -940,7 +940,7 @@ async def flag_message(
 async def list_qa(
     author_slug: str,
     book_id: str | None = None,
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """List all custom Q&A pairs for the author."""
@@ -981,7 +981,7 @@ async def list_qa(
 async def create_qa(
     author_slug: str,
     body: dict,
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """Create a new custom Q&A pair."""
@@ -1022,7 +1022,7 @@ async def create_qa(
 @router.post("/{author_slug}/qa/import")
 async def import_qa_csv(
     author_slug: str,
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
     file: UploadFile = File(...),
 ):
@@ -1085,7 +1085,7 @@ async def import_qa_csv(
 @router.get("/{author_slug}/qa/export")
 async def export_qa_csv(
     author_slug: str,
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """Export all Q&A pairs as CSV."""
@@ -1121,7 +1121,7 @@ async def update_qa(
     author_slug: str,
     qa_id: str,
     body: dict,
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """Update an existing Q&A pair."""
@@ -1168,7 +1168,7 @@ async def update_qa(
 async def delete_qa(
     author_slug: str,
     qa_id: str,
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """Delete a Q&A pair."""
@@ -1200,7 +1200,7 @@ async def delete_qa(
 async def export_sessions(
     author_slug: str,
     days: int = Query(30, ge=1, le=365),
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """Export chat sessions as CSV."""
@@ -1248,7 +1248,7 @@ async def export_sessions(
 async def export_analytics(
     author_slug: str,
     days: int = Query(30, ge=1, le=365),
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """Export daily analytics as CSV."""
@@ -1293,7 +1293,7 @@ async def export_conversations(
     author_slug: str,
     session_id: str | None = None,
     days: int = Query(7, ge=1, le=30),
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
 ):
     """Export full conversation transcripts as CSV."""

app/admin/templates/admin.html

@@ -854,11 +854,29 @@ function closeModal() { document.getElementById('modal-overlay').classList.remov
 document.getElementById('modal-overlay').addEventListener('click', e => { if (e.target === e.currentTarget) closeModal(); });
 
 /* ── AUTH ── */
-auth.restoreSession().then(function (ok) {
+function clearSuperAdminSessionKeys() {
+  localStorage.removeItem('sa_token');
+  localStorage.removeItem('sa_refresh_token');
+}
+
+function clearAuthorSessionKeys() {
+  localStorage.removeItem('access_token');
+  localStorage.removeItem('refresh_token');
+  localStorage.removeItem('author_slug');
+}
+
+auth.restoreSession(function (user) {
+  return user && user.role === 'author';
+}).then(function (ok) {
   if (ok) {
+    clearSuperAdminSessionKeys();
     token = auth.getAccessToken();
     authorSlug = auth.getAuthorSlug();
     showDashboard();
+  } else if (auth.getAccessToken()) {
+    auth.clearSession();
+    token = null;
+    authorSlug = null;
   }
 });
 
@@ -872,6 +890,13 @@ document.getElementById('login-btn').onclick = async () => {
       document.getElementById('email').value,
       document.getElementById('password').value
     );
+    if (data.is_superadmin || data.role === 'superadmin') {
+      auth.clearSession();
+      clearSuperAdminSessionKeys();
+      window.location.href = '/superadmin';
+      return;
+    }
+    clearSuperAdminSessionKeys();
     token = auth.getAccessToken();
     authorSlug = data.author_slug || auth.getAuthorSlug() || 'me';
     if (authorSlug) localStorage.setItem('author_slug', authorSlug);

app/api/ingest.py

@@ -18,7 +18,7 @@ from fastapi import APIRouter, Depends, File, UploadFile, HTTPException
 from fastapi.responses import StreamingResponse
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.dependencies import get_db, get_current_user, get_redis
+from app.dependencies import get_db, get_current_author_scoped, get_redis
 from app.repositories.book_repo import BookRepository
 from app.repositories.document_repo import DocumentRepository
 from app.config import get_settings
@@ -35,7 +35,7 @@ async def upload_book(
     genre: str = "",
     price: float = 0.0,
     buy_url: str = "",
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     db: AsyncSession = Depends(get_db),
     redis=Depends(get_redis),
 ):
@@ -91,7 +91,7 @@ async def upload_book(
 async def ingestion_progress(
     author_slug: str,
     book_id: str,
-    current_user=Depends(get_current_user),
+    current_user=Depends(get_current_author_scoped),
     redis=Depends(get_redis),
 ):
     """SSE stream for real-time ingestion progress."""

app/dependencies.py

@@ -106,9 +106,9 @@ async def get_redis() -> aioredis.Redis:
 
 # ─── Authentication ───────────────────────────────────────────────────────────
 
-async def get_current_user(
-    authorization: str = Header(default=""),
-    db: AsyncSession = Depends(get_db),
+async def _get_authenticated_user(
+    authorization: str,
+    db: AsyncSession,
 ):
     """Validate JWT and return the authenticated user model."""
     from app.core.access.token_crypto import decode_jwt
@@ -143,6 +143,38 @@ async def get_current_user(
     return user
 
 
+async def get_current_user(
+    authorization: str = Header(default=""),
+    db: AsyncSession = Depends(get_db),
+):
+    """Validate JWT and return any authenticated user (author or superadmin)."""
+    return await _get_authenticated_user(authorization, db)
+
+
+async def get_current_author(
+    authorization: str = Header(default=""),
+    db: AsyncSession = Depends(get_db),
+):
+    """Ensure the authenticated user is an Author (not SuperAdmin)."""
+    user = await _get_authenticated_user(authorization, db)
+    if user.role != "author":
+        raise HTTPException(
+            status_code=403,
+            detail="Author access required. SuperAdmins must use /superadmin.",
+        )
+    return user
+
+
+async def get_current_author_scoped(
+    author_slug: str,
+    current_user=Depends(get_current_author),
+):
+    """Ensure the author can only access their own tenant data."""
+    if author_slug != current_user.id:
+        raise HTTPException(status_code=403, detail="Access denied to this author account")
+    return current_user
+
+
 async def get_current_superadmin(current_user=Depends(get_current_user)):
     """Ensure the authenticated user is a SuperAdmin."""
     if current_user.role != "superadmin":

app/schemas/auth.py

@@ -44,6 +44,7 @@ class TokenResponse(BaseModel):
     token_type: str = "bearer"
     author_slug: str | None = None
     is_superadmin: bool = False
+    role: str | None = None
 
 
 class UserResponse(BaseModel):

app/services/auth_service.py

@@ -75,6 +75,7 @@ class AuthService:
         return {
             **tokens,
             "is_superadmin": False,
+            "role": "author",
             "author_slug": user.id,
         }
 
@@ -128,6 +129,7 @@ class AuthService:
         return {
             **tokens,
             "is_superadmin": user.role == "superadmin",
+            "role": user.role,
             "author_slug": getattr(user, "slug", None) or user.id,
         }
 
@@ -158,6 +160,7 @@ class AuthService:
         return {
             **tokens,
             "is_superadmin": user.role == "superadmin",
+            "role": user.role,
             "author_slug": user.id,
         }
 

app/superadmin/templates/superadmin.html

@@ -451,8 +451,15 @@ function closeModal() { document.getElementById('modal-overlay').classList.remov
 document.getElementById('modal-overlay').addEventListener('click', e => { if (e.target === e.currentTarget) closeModal(); });
 
 /* AUTH */
+function clearAuthorSessionKeys() {
+  localStorage.removeItem('access_token');
+  localStorage.removeItem('refresh_token');
+  localStorage.removeItem('author_slug');
+}
+
 auth.restoreSession(function (user) { return user.role === 'superadmin'; }).then(function (ok) {
   if (ok) {
+    clearAuthorSessionKeys();
     token = auth.getAccessToken();
     showDashboard();
   } else if (auth.getAccessToken()) {
@@ -472,7 +479,12 @@ document.getElementById('sa-login-btn').onclick = async () => {
       document.getElementById('sa-user').value,
       document.getElementById('sa-pass').value
     );
-    if (!data.is_superadmin) { auth.clearSession(); throw new Error('Not a SuperAdmin account'); }
+    if (!data.is_superadmin) {
+      auth.clearSession();
+      clearAuthorSessionKeys();
+      throw new Error('Not a SuperAdmin account — use /admin for author login');
+    }
+    clearAuthorSessionKeys();
     token = auth.getAccessToken();
     toast('Welcome, SuperAdmin', 'success');
     showDashboard();

tests/unit/test_suite_e_role_access.py

@@ -0,0 +1,72 @@
+"""Suite E — Role separation (SuperAdmin vs Author)."""
+
+import pytest
+from fastapi import HTTPException
+
+from app.dependencies import (
+    get_current_author,
+    get_current_author_scoped,
+    get_current_superadmin,
+)
+from app.models.user import User
+
+
+def _make_user(role: str, user_id: str = "author-1") -> User:
+    return User(
+        id=user_id,
+        email="test@example.com",
+        password_hash="x",
+        role=role,
+        is_active=True,
+    )
+
+
+@pytest.mark.asyncio
+async def test_get_current_author_rejects_superadmin(monkeypatch):
+    user = _make_user("superadmin")
+
+    async def fake_auth(authorization, db):
+        return user
+
+    monkeypatch.setattr("app.dependencies._get_authenticated_user", fake_auth)
+
+    with pytest.raises(HTTPException) as exc:
+        await get_current_author(authorization="Bearer x", db=None)  # type: ignore[arg-type]
+    assert exc.value.status_code == 403
+    assert "superadmin" in exc.value.detail.lower()
+
+
+@pytest.mark.asyncio
+async def test_get_current_author_accepts_author(monkeypatch):
+    user = _make_user("author")
+
+    async def fake_auth(authorization, db):
+        return user
+
+    monkeypatch.setattr("app.dependencies._get_authenticated_user", fake_auth)
+
+    result = await get_current_author(authorization="Bearer x", db=None)  # type: ignore[arg-type]
+    assert result.role == "author"
+
+
+@pytest.mark.asyncio
+async def test_author_slug_must_match_user_id():
+    user = _make_user("author", "author-abc")
+    with pytest.raises(HTTPException) as exc:
+        await get_current_author_scoped(author_slug="other-author", current_user=user)
+    assert exc.value.status_code == 403
+
+
+@pytest.mark.asyncio
+async def test_superadmin_dependency_rejects_author():
+    user = _make_user("author")
+    with pytest.raises(HTTPException) as exc:
+        await get_current_superadmin(current_user=user)
+    assert exc.value.status_code == 403
+
+
+@pytest.mark.asyncio
+async def test_superadmin_dependency_accepts_superadmin():
+    user = _make_user("superadmin")
+    result = await get_current_superadmin(current_user=user)
+    assert result.role == "superadmin"