[US-11.10 / OBT-239] Expose the authenticated user's managed project IDs

app/api/auth.py

@@ -4,12 +4,13 @@
 from app.core.auth_cache import invalidate_user
 from app.core.auth_middleware import get_current_user
 from app.core.database import get_db
-from app.core.org_scope import get_managed_org_ids
+from app.core.org_scope import get_managed_org_ids, get_managed_project_ids
 from app.db.models.auth import User
 from app.models.auth import (
     AuthResponse,
     ForgotPasswordRequest,
     MyManagedOrgsResponse,
+    MyManagedProjectsResponse,
     MyProjectRolesResponse,
     PasswordResetResponse,
     ProfileUpdate,
@@ -135,6 +136,15 @@ async def my_managed_orgs(
     return MyManagedOrgsResponse(managed_org_ids=org_ids)
 
 
+@router.get("/my-managed-projects", response_model=MyManagedProjectsResponse)
+async def my_managed_projects(
+    user: User = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+) -> MyManagedProjectsResponse:
+    project_ids = await get_managed_project_ids(db, user.id)
+    return MyManagedProjectsResponse(managed_project_ids=project_ids)
+
+
 @router.post("/forgot-password", response_model=PasswordResetResponse)
 async def forgot_password(
     payload: ForgotPasswordRequest, db: AsyncSession = Depends(get_db)

app/api/languages.py

@@ -4,6 +4,7 @@
 from app.core.auth_middleware import get_current_user
 from app.core.database import get_db
 from app.core.exceptions import NotFoundError
+from app.core.org_scope import get_managed_project_ids
 from app.db.models.auth import User
 from app.models.language import LanguageCreate, LanguageResponse
 from app.services import language_service
@@ -14,9 +15,13 @@
 @router.get("", response_model=list[LanguageResponse])
 async def list_languages(
     db: AsyncSession = Depends(get_db),
-    _: User = Depends(get_current_user),
+    user: User = Depends(get_current_user),
 ) -> list[LanguageResponse]:
-    languages = await language_service.list_languages(db)
+    if user.is_platform_admin:
+        languages = await language_service.list_languages(db)
+    else:
+        managed_project_ids = await get_managed_project_ids(db, user.id)
+        languages = await language_service.list_languages_by_projects(db, managed_project_ids)
     return [LanguageResponse.model_validate(lang) for lang in languages]
 
 

app/api/organizations.py

@@ -4,7 +4,7 @@
 from app.core.auth_middleware import get_current_user, require_platform_admin
 from app.core.database import get_db
 from app.core.exceptions import AuthorizationError, NotFoundError
-from app.core.org_scope import get_managed_org_ids
+from app.core.org_scope import get_managed_org_ids, get_managed_project_ids
 from app.db.models.auth import User
 from app.models.org import (
     OrganizationCreate,
@@ -24,9 +24,13 @@
 @router.get("", response_model=list[OrganizationResponse])
 async def list_organizations(
     db: AsyncSession = Depends(get_db),
-    _: User = Depends(get_current_user),
+    user: User = Depends(get_current_user),
 ) -> list[OrganizationResponse]:
-    orgs = await organization_service.list_organizations(db)
+    if user.is_platform_admin:
+        orgs = await organization_service.list_organizations(db)
+    else:
+        managed_project_ids = await get_managed_project_ids(db, user.id)
+        orgs = await organization_service.list_organizations_by_projects(db, managed_project_ids)
     return [OrganizationResponse.model_validate(o) for o in orgs]
 
 

app/api/phases.py

@@ -3,6 +3,7 @@
 
 from app.core.auth_middleware import get_current_user
 from app.core.database import get_db
+from app.core.org_scope import get_managed_project_ids
 from app.db.models.auth import User
 from app.models.phase import (
     DependencyCreate,
@@ -33,20 +34,25 @@ async def list_phases(
     db: AsyncSession = Depends(get_db),
     user: User = Depends(get_current_user),
 ) -> list[PhaseResponse]:
-    phases = await phase_service.list_phases(db, project_id=project_id)
-    result = []
-    for phase in phases:
-        data = PhaseResponse.model_validate(phase)
-        result.append(data)
-    return result
+    if user.is_platform_admin:
+        phases = await phase_service.list_phases(db, project_id=project_id)
+    else:
+        managed_project_ids = await get_managed_project_ids(db, user.id)
+        phases = await phase_service.list_phases_by_projects(
+            db, managed_project_ids, project_id=project_id
+        )
+    return [PhaseResponse.model_validate(phase) for phase in phases]
 
 
 @router.get("/with-dependencies", response_model=PhasesWithDepsResponse)
 async def list_phases_with_dependencies(
     db: AsyncSession = Depends(get_db),
     user: User = Depends(get_current_user),
 ) -> PhasesWithDepsResponse:
-    return await phase_service.list_all_phases_with_deps(db)
+    if user.is_platform_admin:
+        return await phase_service.list_all_phases_with_deps(db)
+    managed_project_ids = await get_managed_project_ids(db, user.id)
+    return await phase_service.list_phases_with_deps_by_projects(db, managed_project_ids)
 
 
 @router.get("/{phase_id}", response_model=PhaseResponse)

app/api/projects/_deps.py

@@ -8,6 +8,6 @@
 async def assert_project_access(db: AsyncSession, user: User, project_id: str) -> None:
     if user.is_platform_admin:
         return
-    allowed = await project_service.can_access_project(db, user.id, project_id)
-    if not allowed:
+    is_manager = await project_service.is_project_manager(db, user.id, project_id)
+    if not is_manager:
         raise AuthorizationError("You do not have access to this project")

app/api/projects/access.py

@@ -2,7 +2,7 @@
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.api.projects._deps import assert_project_access
-from app.core.auth_middleware import get_current_user
+from app.core.auth_middleware import get_current_user, require_platform_admin
 from app.core.database import get_db
 from app.db.models.auth import User
 from app.models.project import (
@@ -115,10 +115,9 @@ async def update_user_access_role(
     project_id: str,
     user_id: str,
     payload: ProjectUserAccessRoleUpdate,
-    actor: User = Depends(get_current_user),
+    _: User = Depends(require_platform_admin),
     db: AsyncSession = Depends(get_db),
 ) -> ProjectUserAccessResponse:
-    await assert_project_access(db, actor, project_id)
     access = await project_service.update_user_access_role(db, project_id, user_id, payload.role)
     return ProjectUserAccessResponse.model_validate(access)
 

app/core/auth_middleware.py

@@ -23,3 +23,18 @@ async def require_platform_admin(
     if not user.is_platform_admin:
         raise AuthorizationError("Forbidden")
     return user
+
+
+async def require_admin_or_manager(
+    db: AsyncSession = Depends(get_db),
+    user: User = Depends(get_current_user),
+) -> User:
+    if user.is_platform_admin:
+        return user
+
+    from app.core.org_scope import get_managed_org_ids, get_managed_project_ids
+
+    if await get_managed_org_ids(db, user.id) or await get_managed_project_ids(db, user.id):
+        return user
+
+    raise AuthorizationError("Forbidden")

app/core/org_scope.py

@@ -1,28 +1,36 @@
-from fastapi import Depends
-from sqlalchemy import select, union
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from app.core.auth_middleware import get_current_user
-from app.core.database import get_db
-from app.db.models.auth import User
-from app.db.models.org import MemberRole, Organization, OrganizationMember
-
-
-async def get_managed_org_ids(db: AsyncSession, user_id: str) -> list[str]:
-    from_members = select(OrganizationMember.organization_id.label("org_id")).where(
-        OrganizationMember.user_id == user_id,
-        OrganizationMember.role == MemberRole.MANAGER,
-    )
-
-    from_orgs = select(Organization.id.label("org_id")).where(Organization.manager_id == user_id)
-
-    combined = union(from_members, from_orgs).subquery()
-    result = await db.execute(select(combined.c.org_id))
-    return sorted(result.scalars().all())
-
-
-async def get_current_user_managed_org_ids(
-    db: AsyncSession = Depends(get_db),
-    user: User = Depends(get_current_user),
-) -> list[str]:
-    return await get_managed_org_ids(db, user.id)
+from fastapi import Depends
+from sqlalchemy import select, union
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.auth_middleware import get_current_user
+from app.core.database import get_db
+from app.db.models.auth import User
+from app.db.models.org import MemberRole, Organization, OrganizationMember
+
+
+async def get_managed_project_ids(db: AsyncSession, user_id: str) -> list[str]:
+    from app.services.project.get_managed_project_ids import (
+        get_managed_project_ids as _get_managed_project_ids,
+    )
+
+    return await _get_managed_project_ids(db, user_id)
+
+
+async def get_managed_org_ids(db: AsyncSession, user_id: str) -> list[str]:
+    from_members = select(OrganizationMember.organization_id.label("org_id")).where(
+        OrganizationMember.user_id == user_id,
+        OrganizationMember.role == MemberRole.MANAGER,
+    )
+
+    from_orgs = select(Organization.id.label("org_id")).where(Organization.manager_id == user_id)
+
+    combined = union(from_members, from_orgs).subquery()
+    result = await db.execute(select(combined.c.org_id))
+    return sorted(result.scalars().all())
+
+
+async def get_current_user_managed_org_ids(
+    db: AsyncSession = Depends(get_db),
+    user: User = Depends(get_current_user),
+) -> list[str]:
+    return await get_managed_org_ids(db, user.id)

app/main.py

@@ -2,7 +2,7 @@
 from collections.abc import AsyncIterator
 from contextlib import asynccontextmanager
 
-from fastapi import FastAPI
+from fastapi import Depends, FastAPI, status
 from fastapi.middleware.cors import CORSMiddleware
 
 from app.api.access_requests import router as access_requests_router
@@ -41,6 +41,7 @@
 from app.api.translation_helper import router as translation_helper_router
 from app.api.uploads import router as uploads_router
 from app.api.users import router as users_router
+from app.core.auth_middleware import require_admin_or_manager
 from app.core.config import get_settings
 from app.core.database import AsyncSessionLocal, close_db, init_db
 from app.core.exceptions import register_exception_handlers
@@ -129,11 +130,32 @@ def create_app() -> FastAPI:
     app.include_router(platform_router, prefix="/api/platform", tags=["platform"])
     app.include_router(uploads_router, prefix="/api/uploads", tags=["uploads"])
     app.include_router(users_router, prefix="/api/users", tags=["users"])
-    app.include_router(languages_router, prefix="/api/languages", tags=["languages"])
-    app.include_router(organizations_router, prefix="/api/organizations", tags=["organizations"])
+    console_guard = [Depends(require_admin_or_manager)]
+    app.include_router(
+        languages_router,
+        prefix="/api/languages",
+        tags=["languages"],
+        dependencies=console_guard,
+    )
+    app.include_router(
+        organizations_router,
+        prefix="/api/organizations",
+        tags=["organizations"],
+        dependencies=console_guard,
+    )
     app.include_router(places_router, prefix="/api/places", tags=["places"])
-    app.include_router(projects_router, prefix="/api/projects", tags=["projects"])
-    app.include_router(phases_router, prefix="/api/phases", tags=["phases"])
+    app.include_router(
+        projects_router,
+        prefix="/api/projects",
+        tags=["projects"],
+        dependencies=console_guard,
+    )
+    app.include_router(
+        phases_router,
+        prefix="/api/phases",
+        tags=["phases"],
+        dependencies=console_guard,
+    )
     app.include_router(books_router, prefix="/api/books", tags=["books"])
     app.include_router(pericopes_router, prefix="/api/pericopes", tags=["pericopes"])
     app.include_router(meaning_maps_router, prefix="/api/meaning-maps", tags=["meaning-maps"])

app/models/auth.py

@@ -52,6 +52,10 @@ class MyManagedOrgsResponse(BaseModel):
     managed_org_ids: list[str]
 
 
+class MyManagedProjectsResponse(BaseModel):
+    managed_project_ids: list[str]
+
+
 class ForgotPasswordRequest(BaseModel):
     email: EmailStr
     app_key: str = Field(max_length=100)

app/services/language/__init__.py

@@ -3,11 +3,13 @@
 from app.services.language.get_language_by_id import get_language_by_id
 from app.services.language.get_language_or_404 import get_language_or_404
 from app.services.language.list_languages import list_languages
+from app.services.language.list_languages_by_projects import list_languages_by_projects
 
 __all__ = [
     "create_language",
     "get_language_by_code",
     "get_language_by_id",
     "get_language_or_404",
     "list_languages",
+    "list_languages_by_projects",
 ]

app/services/language/list_languages_by_projects.py

@@ -0,0 +1,14 @@
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.db.models.language import Language
+from app.db.models.project import Project
+
+
+async def list_languages_by_projects(db: AsyncSession, project_ids: list[str]) -> list[Language]:
+    if not project_ids:
+        return []
+    language_ids_subq = select(Project.language_id).where(Project.id.in_(project_ids)).distinct()
+    stmt = select(Language).where(Language.id.in_(language_ids_subq)).order_by(Language.code)
+    result = await db.execute(stmt)
+    return list(result.scalars().all())

app/services/org/__init__.py

@@ -7,6 +7,7 @@
 from app.services.org.is_member import is_member
 from app.services.org.list_members import list_members
 from app.services.org.list_organizations import list_organizations
+from app.services.org.list_organizations_by_projects import list_organizations_by_projects
 from app.services.org.remove_member import remove_member
 from app.services.org.update_member_role import update_member_role
 from app.services.org.update_organization import update_organization
@@ -21,6 +22,7 @@
     "is_member",
     "list_members",
     "list_organizations",
+    "list_organizations_by_projects",
     "remove_member",
     "update_member_role",
     "update_organization",

app/services/org/list_organizations_by_projects.py

@@ -0,0 +1,20 @@
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.db.models.org import Organization
+from app.db.models.project import ProjectOrganizationAccess
+
+
+async def list_organizations_by_projects(
+    db: AsyncSession, project_ids: list[str]
+) -> list[Organization]:
+    if not project_ids:
+        return []
+    org_ids_subq = (
+        select(ProjectOrganizationAccess.organization_id)
+        .where(ProjectOrganizationAccess.project_id.in_(project_ids))
+        .distinct()
+    )
+    stmt = select(Organization).where(Organization.id.in_(org_ids_subq)).order_by(Organization.name)
+    result = await db.execute(stmt)
+    return list(result.scalars().unique().all())

app/services/phase/__init__.py

@@ -8,6 +8,10 @@
 from app.services.phase.list_all_phases_with_deps import list_all_phases_with_deps
 from app.services.phase.list_dependencies import list_dependencies
 from app.services.phase.list_phases import list_phases
+from app.services.phase.list_phases_by_projects import (
+    list_phases_by_projects,
+    list_phases_with_deps_by_projects,
+)
 from app.services.phase.list_project_phases_with_deps import list_project_phases_with_deps
 from app.services.phase.list_project_phases_with_details import list_project_phases_with_details
 from app.services.phase.list_projects_for_phase import list_projects_for_phase
@@ -26,6 +30,8 @@
     "list_all_phases_with_deps",
     "list_dependencies",
     "list_phases",
+    "list_phases_by_projects",
+    "list_phases_with_deps_by_projects",
     "list_project_phases_with_deps",
     "list_project_phases_with_details",
     "list_projects_for_phase",