ui enhancement company

backend/app/services/org_members.py

@@ -141,3 +141,41 @@ async def create_org_member(
     session.add(member)
     await session.flush()
     return await member_read(session, member)
+
+
+async def update_org_member_role(
+    session: AsyncSession,
+    *,
+    manager: Account,
+    member_id,
+    org_role: str,
+) -> OrgMemberRead:
+    company_domain = manager.company_domain
+    if company_domain is None:
+        raise ValueError("Company domain is required.")
+
+    if not await account_is_domain_owner(
+        session,
+        manager.id,
+        company_domain,
+    ):
+        raise ValueError("Only the domain owner can assign roles.")
+
+    member = await session.scalar(
+        select(Account).where(
+            Account.id == member_id,
+            Account.company_domain == company_domain,
+        )
+    )
+    if member is None:
+        raise ValueError("User not found in your organization.")
+
+    if await account_is_domain_owner(session, member.id, company_domain):
+        raise ValueError("The domain owner role cannot be changed.")
+
+    if member.id == manager.id:
+        raise ValueError("You cannot change your own role.")
+
+    member.org_role = org_role
+    await session.flush()
+    return await member_read(session, member)

backend/app/services/org_security.py

@@ -0,0 +1,55 @@
+"""Organization security settings."""
+
+from __future__ import annotations
+
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.models import OrgSecuritySettings
+from app.schemas import OrgSecuritySettingsRead, OrgSecuritySettingsUpdate
+
+ALLOWED_SESSION_TIMEOUTS = {15, 30, 60, 120, 480, 1440}
+
+
+async def get_or_create_security_settings(
+    session: AsyncSession,
+    company_domain: str,
+) -> OrgSecuritySettings:
+    settings = await session.scalar(
+        select(OrgSecuritySettings).where(
+            OrgSecuritySettings.company_domain == company_domain
+        )
+    )
+    if settings is None:
+        settings = OrgSecuritySettings(company_domain=company_domain)
+        session.add(settings)
+        await session.flush()
+    return settings
+
+
+async def read_security_settings(
+    session: AsyncSession,
+    company_domain: str,
+) -> OrgSecuritySettingsRead:
+    settings = await get_or_create_security_settings(session, company_domain)
+    return OrgSecuritySettingsRead.model_validate(settings)
+
+
+async def update_security_settings(
+    session: AsyncSession,
+    company_domain: str,
+    payload: OrgSecuritySettingsUpdate,
+) -> OrgSecuritySettingsRead:
+    settings = await get_or_create_security_settings(session, company_domain)
+    updates = payload.model_dump(exclude_unset=True)
+    if "session_timeout_minutes" in updates:
+        timeout = updates["session_timeout_minutes"]
+        if timeout not in ALLOWED_SESSION_TIMEOUTS:
+            raise ValueError(
+                "Session timeout must be one of: "
+                + ", ".join(str(value) for value in sorted(ALLOWED_SESSION_TIMEOUTS))
+            )
+    for field, value in updates.items():
+        setattr(settings, field, value)
+    await session.flush()
+    return OrgSecuritySettingsRead.model_validate(settings)