Authentication & Member Management
Authentication & Member Management
AutoDoc ships with a minimal but complete member system inherited from the IndiaPRIDE Framework template it was generated from: JWT-based auth, three roles, and an admin panel for managing members.
Roles
Three roles are supported out of the box: admin, manager, user. A user's roles are stored as a JSON list on the User model (roles: list[str]), though in practice every account currently holds exactly one role at a time.
admin— full access to member management (/auth/members*)manager,user— no special backend permissions yet beyond ordinary member access to their own documents;require_role("manager")is available if a future feature needs it.
Endpoints
| Method | Path | Access | Description |
|---|---|---|---|
POST |
/auth/register |
Public | Self-registration. Body: name, email, password. Always creates role user. |
POST |
/auth/login |
Public | Body: email, password. Returns {access_token, token_type, user}. |
GET |
/auth/me |
Authenticated | Returns the JWT claims (sub, roles, exp) — not a full user record. |
POST |
/auth/bootstrap |
Public, one-time | Creates the first admin account. Fails with 409 once any user already exists. Returns a token immediately (no login needed). |
POST |
/auth/members |
Admin only | Create a member with a chosen role. Body: name, email, password, role. |
GET |
/auth/members |
Admin only | List every member account. |
PATCH |
/auth/members/{id} |
Admin only | Edit a member's name/email. Rejects if the new email is already taken. |
PATCH |
/auth/members/{id}/role |
Admin only | Change a member's role. Guard: an admin cannot remove their own admin role. |
PATCH |
/auth/members/{id}/status |
Admin only | Body: is_active (bool). Guard: an admin cannot deactivate their own account. |
DELETE |
/auth/members/{id} |
Admin only | Permanently delete a member. Guard: an admin cannot delete their own account. |
All admin-only endpoints are protected via the require_role("admin") FastAPI dependency (autodoc.security.authorization). The self-action guards exist specifically to prevent an admin from locking themselves out.
Built-in UI
src/autodoc/static/index.html (served at GET /) provides three pages behind a sidebar: Dashboard (account info), Documents (upload/fill/preview/download — see Document Processing), and an admin-only Members page:
- Login and Register pages (public)
- Logout
- The Members sidebar link and page content are hidden client-side unless
/auth/mereports theadminrole in the logged-in user's JWT claims (and every underlying admin action is also enforced server-side regardless of what the UI shows). It supports: - Add member — form with name/email/password/role dropdown
- Edit — inline name/email editing per row
- Role change — dropdown per row, calls
PATCH /auth/members/{id}/roleon change - Activate/Deactivate — toggle button per row
- Delete — with a confirmation prompt
- Search — client-side filter by name or email
- Sortable columns — click Name/Email/Role/Status headers to sort (ascending/descending, with an arrow indicator)
- Pagination — 10 members per page, with Prev/Next controls
- Set File Size Limit — the max upload size (MB) applied to every member's document uploads
All of this is plain HTML/CSS/JS in one file — no build step, no frontend framework dependency beyond fetch().
Getting your first admin account
This project was seeded with its first admin at generation time (via the Playground web UI's project-creation form, which inserts exactly one admin account directly into a fresh database). If that account is ever lost and the members table is genuinely empty, POST /auth/bootstrap creates a new first admin — it only works once, failing with 409 as soon as any user exists.