05/06 Modify Director's can NOT change user role, Inspector can view own reports

app/routes/auth.py

@@ -131,12 +131,17 @@ def list_users():
 def create_user():
     form = UserForm()
 
+    # Directors may not assign roles — new users created by a director default
+    # to inspector.  Only admins may set an arbitrary role at creation time.
+    director_editing = current_user.role == 'director'
+
     if form.validate_on_submit():
+        role = 'inspector' if director_editing else form.role.data
         user = User(
             username=form.username.data,
             full_name=form.full_name.data.strip() or None,
             email=form.email.data,
-            role=form.role.data
+            role=role
         )
         user.set_password(form.password.data)
         db.session.add(user)
@@ -148,7 +153,8 @@ def create_user():
         flash(f'User {user.username} created successfully.', 'success')
         return redirect(url_for('auth.list_users'))
 
-    return render_template('auth/user_form.html', form=form, title='Create User')
+    return render_template('auth/user_form.html', form=form, title='Create User',
+                           director_editing=director_editing)
 
 
 @bp.route('/users/<int:user_id>/edit', methods=['GET', 'POST'])
@@ -160,11 +166,18 @@ def edit_user(user_id):
         abort(404)
     form = UserForm(user=user, obj=user)
 
+    # Directors may not change another user's role — that privilege is admin-only.
+    # The role field is removed from the form for directors so it cannot be
+    # submitted at all, and the existing role value is preserved on save.
+    director_editing = current_user.role == 'director'
+
     if form.validate_on_submit():
         user.username  = form.username.data
         user.full_name = form.full_name.data.strip() or None
         user.email     = form.email.data
-        user.role      = form.role.data
+
+        if not director_editing:
+            user.role = form.role.data
 
         if form.password.data:
             user.set_password(form.password.data)
@@ -177,7 +190,8 @@ def edit_user(user_id):
         flash(f'User {user.username} updated successfully.', 'success')
         return redirect(url_for('auth.list_users'))
 
-    return render_template('auth/user_form.html', form=form, user=user, title='Edit User')
+    return render_template('auth/user_form.html', form=form, user=user,
+                           title='Edit User', director_editing=director_editing)
 
 
 @bp.route('/users/<int:user_id>/delete', methods=['POST'])
@@ -317,4 +331,4 @@ def notification_matrix():
         matrix_roles  = MATRIX_ROLES,
         defaults      = MATRIX_DEFAULTS,
         state         = state,
-    )
+    )