Dispatcharr/core
None db318e4981 Fix #954: Superuser detection; Feature #1004: User account disable/enable
Bug #954: The initialize_superuser endpoint only checked is_superuser=True, missing admin accounts created via the API (user_level=10). This caused users to intermittently see the "Create Super User" page instead of login.

Feature #1004: Admins can now disable/enable user accounts. Disabled users are blocked from JWT login, token refresh, XC API access, and all
authenticated endpoints. The last active admin cannot be disabled.

Files changed:

Backend:
- apps/accounts/api_views.py — Superuser check uses user_level>=10; token refresh blocks disabled users
- apps/accounts/models.py — CustomUserManager ensures create_superuser() always sets user_level=10
- apps/accounts/serializers.py — Last-admin protection guard; respect is_active on user creation
- apps/accounts/tests.py — new tests covering superuser detection, token
 refresh blocking, last-admin protection, disabled user login/access
- apps/backups/api_views.py — Switched from DRF's IsAdminUser (checks is_staff) to app's IsAdmin (checks user_level) on all 8 endpoints
- apps/backups/tests.py — new tests verifying user_level-based admin permission on backup endpoints
- apps/output/views.py — is_active check on xc_get_user(), xc_movie_stream(), xc_series_stream()
- apps/proxy/ts_proxy/views.py — is_active check on stream_xc()
- core/api_views.py — Admin notification filter uses user_level>=10
- core/developer_notifications.py — Admin checks use user_level>=10

Frontend:
- frontend/src/App.jsx — Null-safe superuser existence check
- frontend/src/components/forms/User.jsx — Account Enabled switch with
  self-disable prevention and tooltip
- frontend/src/components/tables/UsersTable.jsx — Status column (Active/Disabled badge)
2026-02-22 18:05:02 -06:00
..
fixtures feat: add system notifications and update checks 2026-02-03 09:24:02 -06:00
management/commands Refactor CoreSettings to use JSONField for value storage and update related logic for proper type handling. Adjusted serializers and forms to accommodate new data structure, ensuring seamless integration across the application. 2026-01-13 12:18:34 -06:00
migrations feat: add system notifications and update checks 2026-02-03 09:24:02 -06:00
__init__.py Alpha v3 2025-02-21 15:31:59 -06:00
admin.py modified database fields for consistency, removed custom_url from streams (no longer needed) 2025-03-16 09:07:10 -04:00
api_urls.py feat: add system notifications and update checks 2026-02-03 09:24:02 -06:00
api_views.py Fix #954: Superuser detection; Feature #1004: User account disable/enable 2026-02-22 18:05:02 -06:00
apps.py Enhancement: Refactored app initialization to prevent redundant execution across multiple worker processes. Created dispatcharr.app_initialization utility module with should_skip_initialization() function that prevents custom initialization tasks (backup scheduler sync, developer notifications sync) from running during management commands, in worker processes, or in development servers. This significantly reduces startup overhead in multi-worker deployments (e.g., uWSGI with 10 workers now syncs the scheduler once instead of 10 times). Applied to both CoreConfig and BackupsConfig apps. 2026-02-05 13:48:01 -06:00
command_utils.py Bypass redis for management commands. 2025-03-22 12:23:54 -05:00
developer_notifications.py Fix #954: Superuser detection; Feature #1004: User account disable/enable 2026-02-22 18:05:02 -06:00
models.py Merge pull request #894 from CodeBormen/Feature/771-Auto-Matching-Improvments 2026-02-03 10:20:45 -06:00
redis_pubsub.py Bypass redis for management commands. 2025-03-22 12:23:54 -05:00
scheduling.py feat(scheduling): add cron builder and refactor scheduling components (Closes #165) 2026-02-12 18:08:13 -06:00
serializers.py feat: add system notifications and update checks 2026-02-03 09:24:02 -06:00
signals.py feat: add system notifications and update checks 2026-02-03 09:24:02 -06:00
tasks.py feat: add system notifications and update checks 2026-02-03 09:24:02 -06:00
tests.py Alpha v3 2025-02-21 15:31:59 -06:00
urls.py Pre-Alpha v4 2025-02-24 15:04:03 -06:00
utils.py merged in dev 2026-02-11 19:51:21 -05:00
views.py feat: Add Redis authentication support for modular deployment 2026-02-03 21:42:06 -06:00
xtream_codes.py Convert refresh time to local time. 2025-09-09 16:43:57 -05:00