Stage

backend/app/models/schemas.py

@@ -7,7 +7,7 @@ class SignupIn(BaseModel):
     name: str
     email: EmailStr
     password: str
-    role: Literal["user", "admin"] = "user"   # keep role
+    role: Literal["user", "cms_admin"] = "user"   # keep role
 
 
 class LoginIn(BaseModel):
@@ -19,7 +19,7 @@ class UserOut(BaseModel):
     id: str
     name: str
     email: EmailStr
-    role: Literal["user", "admin"]
+    role: Literal["user", "cms_admin"]
 
 
 class AdminBlogMiniOut(BaseModel):
@@ -41,7 +41,7 @@ class AdminUserWithBlogsOut(BaseModel):
     id: str
     name: str
     email: EmailStr
-    role: Literal["user", "admin"]
+    role: Literal["user", "cms_admin"]
     created_at: Optional[datetime] = None
     last_login_at: Optional[datetime] = None
     blog_counts: AdminBlogCountsOut = AdminBlogCountsOut()

backend/app/routers/admin.py

@@ -48,19 +48,22 @@ async def list_pending_blogs(
     admin: dict = Depends(require_admin),
     page: int = Query(1, ge=1),
     limit: int = Query(10, ge=1, le=50),
+    search: str = Query("", description="Filter by author name"),
     db: Session = Depends(get_db)
 ):
     skip = (page - 1) * limit
     tenant_id = admin.get("tenant_id")
-    
+
     query = db.query(BlogPost).filter(
         BlogPost.tenant_id == tenant_id,
         or_(
             BlogPost.status == None,
             ~BlogPost.status.in_(["approved", "published", "rejected", "Approved", "Published"])
         )
     )
-
+    if search.strip():
+        query = query.filter(BlogPost.author_name.ilike(f"%{search.strip()}%"))
+
     total = query.count()
     blogs = query.order_by(desc(BlogPost.created_at)).offset(skip).limit(limit).all()
 
@@ -88,16 +91,19 @@ async def list_published_blogs(
     admin: dict = Depends(require_admin),
     page: int = Query(1, ge=1),
     limit: int = Query(10, ge=1, le=50),
+    search: str = Query("", description="Filter by author name"),
     db: Session = Depends(get_db)
 ):
     skip = (page - 1) * limit
     tenant_id = admin.get("tenant_id")
-    
+
     query = db.query(BlogPost).filter(
         BlogPost.tenant_id == tenant_id,
         BlogPost.status.in_(["approved", "published"])
     )
-
+    if search.strip():
+        query = query.filter(BlogPost.author_name.ilike(f"%{search.strip()}%"))
+
     total = query.count()
     blogs = query.order_by(desc(BlogPost.created_at)).offset(skip).limit(limit).all()
 

backend/app/routers/blogs.py

@@ -205,7 +205,7 @@ async def get_blog(blog_id: str, user: dict = Depends(get_current_user), db: Ses
         raise HTTPException(status_code=404, detail="Blog not found")
 
     if b.author_id != user["id"]:
-        if user.get("role") != "admin" or b.tenant_id != user.get("tenant_id"):
+        if user.get("role") != "cms_admin" or b.tenant_id != user.get("tenant_id"):
             raise HTTPException(status_code=403, detail="Not allowed")
 
     return _map_blog_detail(b)
@@ -219,7 +219,7 @@ async def delete_blog_route(blog_id: str, user: dict = Depends(get_current_user)
         raise HTTPException(status_code=404, detail="Blog not found")
 
     if b.author_id != user["id"]:
-        if user.get("role") != "admin" or b.tenant_id != user.get("tenant_id"):
+        if user.get("role") != "cms_admin" or b.tenant_id != user.get("tenant_id"):
             raise HTTPException(status_code=403, detail="Not allowed")
 
     db.delete(b)
@@ -235,7 +235,7 @@ async def update_blog_route(blog_id: str, payload: BlogCreateIn, user: dict = De
         raise HTTPException(status_code=404, detail="Blog not found")
 
     if b.author_id != user["id"]:
-        if user.get("role") != "admin" or b.tenant_id != user.get("tenant_id"):
+        if user.get("role") != "cms_admin" or b.tenant_id != user.get("tenant_id"):
             raise HTTPException(status_code=403, detail="Not allowed")
 
     content = b.content_blocks or {}
@@ -292,7 +292,7 @@ async def change_to_draft(blog_id: str, user: dict = Depends(get_current_user),
         raise HTTPException(status_code=404, detail="Blog not found")
 
     if b.author_id != user["id"]:
-        if user.get("role") != "admin" or b.tenant_id != user.get("tenant_id"):
+        if user.get("role") != "cms_admin" or b.tenant_id != user.get("tenant_id"):
             raise HTTPException(status_code=403, detail="Not allowed")
 
     if b.status != "published":

backend/core/deps.py

@@ -103,10 +103,10 @@ async def require_admin(user: dict = Depends(get_current_user)):
     """
     Middleware dependency to ensure the authenticated user has administrative privileges.
     """
-    if user.get("role") != "admin":
+    if user.get("role") != "cms_admin":
         logger.warning(f"Access denied: User {user.get('email')} attempted to access an admin-only route.")
         raise HTTPException(
-            status_code=403, 
+            status_code=403,
             detail="Admin privileges required to perform this action."
         )
     return user