SW Resource Manager – Project Overview

Python 3.6+ Flask 3.1.1 SQLite PyJWT 2.10.1 Pytest 8.3.5 python-dateutil 2.9 requests 2.32

Purpose

Track SW resources (employees, NN/TBH/reqIDs) per org node
Hierarchical write-access model for org leaders
Time-bounded delegations for contributor access
CSV import pipeline from existing SW resource exports
Full audit trail on every mutating action
Azure-ready, SSO-capable (Microsoft Entra ID)

Architecture

Entrypoint — src/app/main.py — create_app() factory
API layer — src/app/api/routes.py (REST blueprint)
UI layer — src/app/api/ui.py (SPA shell at /)
Auth — src/app/services/auth.py
RBAC — src/app/services/rbac.py
Import — src/app/services/csv_import.py
DB / Migrations — src/app/db/

Authentication

Dev mode — APP_SSO_STRICT=false
Pass x-dev-user: id|Name|role1,role2 header

Strict mode — APP_SSO_STRICT=true
Bearer JWT, JWKS validation, issuer/audience checks, Entra group→role mapping

Roles: global_admin, line_manager_editor, leadership_readonly
Group→role map via APP_SSO_GROUP_ROLE_MAP

RBAC & Access Rules

global_admin can write any org node
Leader can write own node and all descendants
Contributor leader writes delegated scope (optionally incl. descendants)
Delegations are time-bounded and auditable
Org node delete blocked if still referenced

Data Model (SQLite)

users org_nodes user_org_leadership delegations resource_records role_assignments audit_log import_runs field_value_options

CSV Import Pipeline

Semicolon-delimited CSV ingestion
Field normalization and upsert logic
Auto-creation of users and org nodes
Hierarchy derivation by org-code prefix
Manager → leadership seeding
Import run history + audit logging

API Endpoints