bump project

app/admin/routes.py

@@ -0,0 +1,52 @@
+from __future__ import annotations
+
+from flask import Blueprint, abort, flash, redirect, render_template, url_for
+from flask_login import current_user
+
+from app.admin.forms import AccountCreateForm
+from app.extensions import db
+from app.models import Account, Role
+from app.services.security import roles_required
+
+bp = Blueprint("admin", __name__, url_prefix="/admin")
+
+
+@bp.get("/accounts")
+@roles_required(Role.ADMIN)
+def accounts():
+    items = Account.query.order_by(Account.created_at.desc()).all()
+    return render_template("admin/accounts.html", accounts=items)
+
+
+@bp.route("/accounts/new", methods=["GET", "POST"])
+@roles_required(Role.ADMIN)
+def new_account():
+    form = AccountCreateForm()
+    if form.validate_on_submit():
+        account = Account(
+            full_name=form.full_name.data.strip(),
+            username=form.username.data.strip().lower(),
+            email=form.email.data.strip().lower(),
+            role=form.role.data,
+        )
+        account.set_password(form.password.data)
+        db.session.add(account)
+        db.session.commit()
+        flash(f"Account created for {account.full_name}.", "success")
+        return redirect(url_for("admin.accounts"))
+    return render_template("admin/account_form.html", form=form)
+
+
+@bp.post("/accounts/<int:account_id>/toggle")
+@roles_required(Role.ADMIN)
+def toggle_account(account_id: int):
+    account = db.session.get(Account, account_id)
+    if not account:
+        abort(404)
+    if account.id == current_user.id:
+        flash("You cannot deactivate your own account.", "warning")
+        return redirect(url_for("admin.accounts"))
+    account.active = not account.active
+    db.session.commit()
+    flash(f"{account.full_name} is now {'active' if account.active else 'inactive'}.", "success")
+    return redirect(url_for("admin.accounts"))