more admin stuff

app/models/schemas.py

@@ -15,6 +15,11 @@ from pydantic import BaseModel, Field, field_validator
 USERNAME_RE = re.compile(r"^[a-zA-Z0-9._-]{3,64}$")
 HOSTNAME_LABEL_RE = re.compile(r"^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$")
 
+ROLE_NAME = Literal[
+    "ssh_connect", "rdp_connect", "file_transfer", "clipboard",
+    "session_recording_view", "admin_hostgroup",
+]
+
 
 class LoginRequest(BaseModel):
     username: str = Field(min_length=3, max_length=64)
@@ -46,6 +51,11 @@ class UserCreateRequest(BaseModel):
     username: str = Field(min_length=3, max_length=64)
     initial_password: str = Field(min_length=12, max_length=256)
     is_admin: bool = False
+    # Nur relevant, wenn der anlegende Principal Mandanten-Admin ist: wird
+    # serverseitig ohnehin auf den/die erlaubten Mandanten erzwungen (siehe
+    # create_user() in admin/routes.py) -- ein Mandanten-Admin kann hierueber
+    # KEINEN User einem fremden Mandanten zuordnen. Fuer Super-Admins optional.
+    home_tenant_id: int | None = None
 
     @field_validator("username")
     @classmethod
@@ -55,9 +65,38 @@ class UserCreateRequest(BaseModel):
         return v
 
 
+class UserUpdateRequest(BaseModel):
+    is_admin: bool | None = None
+    is_active: bool | None = None
+    new_password: str | None = Field(default=None, min_length=12, max_length=256)
+
+
+class TenantCreateRequest(BaseModel):
+    name: str = Field(min_length=1, max_length=128)
+    description: str | None = Field(default=None, max_length=1024)
+
+
+class TenantUpdateRequest(BaseModel):
+    name: str | None = Field(default=None, min_length=1, max_length=128)
+    description: str | None = Field(default=None, max_length=1024)
+    is_active: bool | None = None
+
+
+class TenantAdminAssignRequest(BaseModel):
+    user_id: int
+
+
 class HostGroupCreateRequest(BaseModel):
     name: str = Field(min_length=1, max_length=128)
     description: str | None = Field(default=None, max_length=1024)
+    # Nur fuer Super-Admins relevant (Mandanten-Admins werden serverseitig
+    # ohnehin auf ihren eigenen Mandanten festgelegt, siehe admin/routes.py).
+    tenant_id: int | None = None
+
+
+class HostGroupUpdateRequest(BaseModel):
+    name: str | None = Field(default=None, min_length=1, max_length=128)
+    description: str | None = Field(default=None, max_length=1024)
 
 
 class HostCreateRequest(BaseModel):
@@ -83,19 +122,49 @@ class HostCreateRequest(BaseModel):
         return v
 
 
+class HostUpdateRequest(BaseModel):
+    host_group_id: int | None = None
+    hostname: str | None = Field(default=None, min_length=1, max_length=128)
+    address: str | None = Field(default=None, min_length=1, max_length=255)
+    port: int | None = Field(default=None, gt=0, le=65535)
+    ssh_username: str | None = None
+    rdp_username: str | None = None
+    rdp_domain: str | None = None
+    rdp_require_nla: bool | None = None
+    clipboard_enabled: bool | None = None
+    file_transfer_enabled: bool | None = None
+    is_active: bool | None = None
+
+    @field_validator("hostname")
+    @classmethod
+    def check_hostname(cls, v: str | None) -> str | None:
+        if v is not None and not HOSTNAME_LABEL_RE.match(v):
+            raise ValueError("Ungueltiger Hostname")
+        return v
+
+
 class RoleGrantRequest(BaseModel):
     user_id: int
     host_group_id: int
-    role_name: Literal[
-        "ssh_connect", "rdp_connect", "file_transfer", "clipboard",
-        "session_recording_view", "admin_hostgroup",
-    ]
+    role_names: list[ROLE_NAME] = Field(min_length=1, max_length=6)
     expires_at: str | None = None
 
 
+class RoleRevokeRequest(BaseModel):
+    user_id: int
+    host_group_id: int
+    role_name: ROLE_NAME
+
+
 class UserGroupCreateRequest(BaseModel):
     name: str = Field(min_length=1, max_length=128)
     description: str | None = Field(default=None, max_length=1024)
+    tenant_id: int | None = None
+
+
+class UserGroupUpdateRequest(BaseModel):
+    name: str | None = Field(default=None, min_length=1, max_length=128)
+    description: str | None = Field(default=None, max_length=1024)
 
 
 class GroupMemberRequest(BaseModel):
@@ -105,18 +174,24 @@ class GroupMemberRequest(BaseModel):
 class GroupRoleGrantRequest(BaseModel):
     user_group_id: int
     host_group_id: int
-    role_name: Literal[
-        "ssh_connect", "rdp_connect", "file_transfer", "clipboard",
-        "session_recording_view", "admin_hostgroup",
-    ]
+    role_names: list[ROLE_NAME] = Field(min_length=1, max_length=6)
     expires_at: str | None = None
 
 
+class GroupRoleRevokeRequest(BaseModel):
+    user_group_id: int
+    host_group_id: int
+    role_name: ROLE_NAME
+
+
 class ApiTokenCreateRequest(BaseModel):
     label: str = Field(min_length=1, max_length=128)
     user_id: int
     scopes: list[str] = Field(min_length=1, max_length=32)
     expires_at: str | None = None
+    # Nur fuer Super-Admins relevant -- ein Mandanten-Admin wird serverseitig
+    # ohnehin auf seinen eigenen Mandanten festgelegt.
+    tenant_id: int | None = None
 
 
 class SshKeyCreateRequest(BaseModel):
@@ -125,6 +200,18 @@ class SshKeyCreateRequest(BaseModel):
     private_key_pem: str = Field(min_length=1, max_length=32_768)
     public_key: str = Field(min_length=1, max_length=8192)
     key_type: Literal["ed25519", "rsa-3072", "rsa-4096", "ca-cert"]
+    tenant_id: int | None = None
+
+
+class SshKeyUpdateRequest(BaseModel):
+    label: str | None = Field(default=None, min_length=1, max_length=128)
+    owner_user_id: int | None = None
+    # Wenn gesetzt, wird der Schluessel rotiert (neues Schluesselmaterial,
+    # rotated_at wird aktualisiert). Alle drei Felder muessen dann zusammen
+    # angegeben werden (siehe rotate_ssh_key() in admin/routes.py).
+    private_key_pem: str | None = Field(default=None, min_length=1, max_length=32_768)
+    public_key: str | None = Field(default=None, min_length=1, max_length=8192)
+    key_type: Literal["ed25519", "rsa-3072", "rsa-4096", "ca-cert"] | None = None
 
 
 class ConnectRequest(BaseModel):