auth ist im kasten

services/user_admin_service.py

@@ -1,5 +1,5 @@
 from typing import Optional, List
-from models import db, User, UserRole
+from models import db, User, UserRole, Tenant
 from models import AuditLog
 import logging
 
@@ -39,3 +39,52 @@ class UserAdminService:
             resource_id=target_user.id,
             details={'email': target_user.email}
         )
+    
+    @staticmethod
+    def assign_tenant_to_user(user, tenant, admin_user):
+        """Assign a tenant to a user."""
+        if tenant not in user.tenants:
+            user.tenants.append(tenant)
+            db.session.commit()
+            
+            AuditLog.log_action(
+                action='assign_tenant',
+                resource_type='user',
+                user=admin_user,
+                resource_id=user.id,
+                details={'tenant_id': tenant.id, 'tenant_name': tenant.name}
+            )
+            logger.info(f'Assigned user {user.id} to tenant {tenant.id}')
+    
+    @staticmethod
+    def remove_tenant_from_user(user, tenant, admin_user):
+        """Remove a tenant from a user."""
+        if tenant in user.tenants:
+            user.tenants.remove(tenant)
+            db.session.commit()
+            
+            AuditLog.log_action(
+                action='remove_tenant',
+                resource_type='user',
+                user=admin_user,
+                resource_id=user.id,
+                details={'tenant_id': tenant.id, 'tenant_name': tenant.name}
+            )
+            logger.info(f'Removed user {user.id} from tenant {tenant.id}')
+    
+    @staticmethod
+    def update_user_role(user, role, admin_user):
+        """Update a user's role."""
+        if role in [r.value for r in UserRole]:
+            old_role = user.role.value
+            user.role = UserRole(role)
+            db.session.commit()
+            
+            AuditLog.log_action(
+                action='update_role',
+                resource_type='user',
+                user=admin_user,
+                resource_id=user.id,
+                details={'old_role': old_role, 'new_role': role}
+            )
+            logger.info(f'Updated user {user.id} role from {old_role} to {role}')