second commit

app/catalog/routes.py

@@ -0,0 +1,67 @@
+"""Sicht fuer normale Nutzer: nur die Hosts/Aktionen, fuer die RBAC eine
+Rolle in der jeweiligen Hostgruppe vergeben hat (Konzept 4.6)."""
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends
+
+from app.auth.deps import CurrentUser, get_current_user
+from app.db import get_db
+
+router = APIRouter(prefix="/catalog", tags=["catalog"])
+
+
+@router.get("/hosts")
+async def my_hosts(user: CurrentUser = Depends(get_current_user)):
+    conn = get_db()
+    if user.is_admin:
+        cursor = await conn.execute(
+            "SELECT h.id, h.hostname, h.address, h.protocol, h.os_type, h.host_group_id, "
+            "g.name, h.clipboard_enabled, h.file_transfer_enabled "
+            "FROM hosts h JOIN host_groups g ON g.id = h.host_group_id "
+            "WHERE h.is_active = 1 ORDER BY g.name, h.hostname"
+        )
+        rows = await cursor.fetchall()
+        hosts = [dict(zip(
+            ("id", "hostname", "address", "protocol", "os_type", "host_group_id", "host_group_name",
+             "clipboard_enabled", "file_transfer_enabled"), r
+        )) for r in rows]
+        for h in hosts:
+            h["can_connect"] = True
+            h["can_file_transfer"] = True
+        return hosts
+
+    cursor = await conn.execute(
+        """
+        SELECT DISTINCT h.id, h.hostname, h.address, h.protocol, h.os_type, h.host_group_id,
+               g.name, h.clipboard_enabled, h.file_transfer_enabled
+        FROM hosts h
+        JOIN host_groups g ON g.id = h.host_group_id
+        JOIN user_hostgroup_roles uhr ON uhr.host_group_id = h.host_group_id
+        JOIN roles r ON r.id = uhr.role_id
+        WHERE h.is_active = 1 AND uhr.user_id = ?
+          AND r.name IN ('ssh_connect', 'rdp_connect')
+          AND (uhr.expires_at IS NULL OR uhr.expires_at > strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+        ORDER BY g.name, h.hostname
+        """,
+        (user.id,),
+    )
+    rows = await cursor.fetchall()
+    hosts = [dict(zip(
+        ("id", "hostname", "address", "protocol", "os_type", "host_group_id", "host_group_name",
+         "clipboard_enabled", "file_transfer_enabled"), r
+    )) for r in rows]
+
+    ft_cursor = await conn.execute(
+        """
+        SELECT DISTINCT uhr.host_group_id FROM user_hostgroup_roles uhr
+        JOIN roles r ON r.id = uhr.role_id
+        WHERE uhr.user_id = ? AND r.name = 'file_transfer'
+          AND (uhr.expires_at IS NULL OR uhr.expires_at > strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+        """,
+        (user.id,),
+    )
+    ft_groups = {row[0] for row in await ft_cursor.fetchall()}
+    for h in hosts:
+        h["can_connect"] = True
+        h["can_file_transfer"] = h["host_group_id"] in ft_groups and bool(h["file_transfer_enabled"])
+    return hosts