auth ist im kasten

routes/admin.py

@@ -524,20 +524,21 @@ def update_submission_status(submission_id):
 @admin_required
 def list_users():
     """List all users (admin only)."""
-    user = get_current_user()
+    admin_user = get_current_user()
     users = UserAdminService.get_users()
     
     return render_template('admin/users/list.html',
-                         user=user,
+                         admin_user=admin_user,
                          users=users,
-                         dev_mode=current_app.config.get('DEV_MODE', False))
+                         dev_mode=current_app.config.get('DEV_MODE', False),
+                         is_admin=admin_user.is_admin())
 
 
 @admin_bp.route('/users/<user_id>', methods=['GET', 'POST'])
 @admin_required
 def view_user(user_id):
     """View and edit a user (admin only)."""
-    user = get_current_user()
+    admin_user = get_current_user()
     target_user = User.query.get(user_id)
     
     if not target_user:
@@ -546,7 +547,7 @@ def view_user(user_id):
     if request.method == 'POST':
         UserAdminService.update_user(
             target_user, request.form.get('email'), request.form.get('name'),
-            request.form.get('role'), user
+            request.form.get('role'), admin_user
         )
         
         flash('User updated successfully!', 'success')
@@ -556,7 +557,7 @@ def view_user(user_id):
     tenants = target_user.tenants
     
     return render_template('admin/users/view.html',
-                         user=user,
+                         admin_user=admin_user,
                          target_user=target_user,
                          tenants=tenants,
                          dev_mode=current_app.config.get('DEV_MODE', False),
@@ -584,6 +585,100 @@ def delete_user(user_id):
     return redirect(url_for('admin.list_users'))
 
 
+@admin_bp.route('/users/<user_id>/tenants', methods=['GET', 'POST'])
+@admin_required
+def manage_user_tenants(user_id):
+    """Manage tenant assignments for a user (admin only)."""
+    admin_user = get_current_user()
+    target_user = User.query.get(user_id)
+    
+    if not target_user:
+        abort(404, description='User not found')
+    
+    if request.method == 'POST':
+        # Add or remove tenant assignments
+        action = request.form.get('action')
+        tenant_id = request.form.get('tenant_id')
+        
+        if action == 'add' and tenant_id:
+            tenant = Tenant.query.get(tenant_id)
+            if tenant and tenant not in target_user.tenants:
+                target_user.tenants.append(tenant)
+                db.session.commit()
+                
+                AuditLog.log_action(
+                    action='assign_tenant',
+                    resource_type='user',
+                    user=admin_user,
+                    resource_id=target_user.id,
+                    details={'tenant_id': tenant_id, 'tenant_name': tenant.name}
+                )
+                flash(f'User assigned to tenant {tenant.name}!', 'success')
+        
+        elif action == 'remove' and tenant_id:
+            tenant = Tenant.query.get(tenant_id)
+            if tenant and tenant in target_user.tenants:
+                target_user.tenants.remove(tenant)
+                db.session.commit()
+                
+                AuditLog.log_action(
+                    action='remove_tenant',
+                    resource_type='user',
+                    user=admin_user,
+                    resource_id=target_user.id,
+                    details={'tenant_id': tenant_id, 'tenant_name': tenant.name}
+                )
+                flash(f'User removed from tenant {tenant.name}!', 'success')
+        
+        return redirect(url_for('admin.manage_user_tenants', user_id=target_user.id))
+    
+    # Get all tenants and user's current tenants
+    all_tenants = Tenant.query.order_by(Tenant.name).all()
+    user_tenants = list(target_user.tenants)
+    
+    return render_template('admin/users/tenants.html',
+                         admin_user=admin_user,
+                         target_user=target_user,
+                         all_tenants=all_tenants,
+                         user_tenants=user_tenants,
+                         dev_mode=current_app.config.get('DEV_MODE', False))
+
+
+@admin_bp.route('/users/<user_id>/role', methods=['POST'])
+@admin_required
+def update_user_role(user_id):
+    """Update user role (admin only)."""
+    admin_user = get_current_user()
+    target_user = User.query.get(user_id)
+    
+    if not target_user:
+        abort(404, description='User not found')
+    
+    # Don't allow changing own role
+    if target_user.id == admin_user.id:
+        flash('Cannot change your own role!', 'error')
+        return redirect(url_for('admin.view_user', user_id=target_user.id))
+    
+    new_role = request.form.get('role')
+    if new_role and new_role in [r.value for r in UserRole]:
+        old_role = target_user.role.value
+        target_user.role = UserRole(new_role)
+        db.session.commit()
+        
+        AuditLog.log_action(
+            action='update_role',
+            resource_type='user',
+            user=admin_user,
+            resource_id=target_user.id,
+            details={'old_role': old_role, 'new_role': new_role}
+        )
+        flash(f'User role updated to {new_role}!', 'success')
+    else:
+        flash('Invalid role!', 'error')
+    
+    return redirect(url_for('admin.view_user', user_id=target_user.id))
+
+
 @admin_bp.route('/profile')
 @login_required
 def profile():