diff --git a/src/vk_parser_app/admin.py b/src/vk_parser_app/admin.py
index 2796872..16d521e 100644
--- a/src/vk_parser_app/admin.py
+++ b/src/vk_parser_app/admin.py
@@ -16,7 +16,7 @@ from zoneinfo import ZoneInfo
import aiohttp
from fastapi import FastAPI, File, Form, Request, UploadFile, status
-from fastapi.responses import FileResponse, HTMLResponse, RedirectResponse
+from fastapi.responses import FileResponse, HTMLResponse, JSONResponse, RedirectResponse
from fastapi.staticfiles import StaticFiles
from fastapi.templating import Jinja2Templates
from loguru import logger
@@ -449,6 +449,34 @@ def base_context(request: Request, user: dict | None, **extra: Any) -> dict[str,
return ctx
+EDITOR_ALLOWED_PATHS = (
+ "/",
+ "/raw",
+ "/editor",
+ "/sources",
+ "/uploads",
+ "/logout",
+ "/login",
+ "/favi.png",
+ "/favicon.ico",
+ "/health",
+)
+
+
+def is_editor_allowed_path(path: str) -> bool:
+ return any(path == allowed or path.startswith(f"{allowed}/") for allowed in EDITOR_ALLOWED_PATHS if allowed != "/") or path == "/"
+
+
+@app.middleware("http")
+async def restrict_editor_access(request: Request, call_next):
+ user = await get_current_user(request)
+ if user and user.get("role") == "editor" and not is_editor_allowed_path(request.url.path):
+ if request.method == "GET" and not request.headers.get("hx-request"):
+ return redirect("/raw")
+ return JSONResponse({"detail": "Forbidden"}, status_code=status.HTTP_403_FORBIDDEN)
+ return await call_next(request)
+
+
def client_ip(request: Request) -> str:
forwarded = request.headers.get("x-forwarded-for", "")
if forwarded:
diff --git a/src/vk_parser_app/templates/base.html b/src/vk_parser_app/templates/base.html
index 21b7725..5a7c16c 100644
--- a/src/vk_parser_app/templates/base.html
+++ b/src/vk_parser_app/templates/base.html
@@ -178,6 +178,7 @@
Источники
+ {% if user.role != "editor" %}
Воркеры
@@ -190,6 +191,7 @@
Логи
+ {% endif %}