template: protected routes with RBA and other validations

app/example_protected_routes.py

@@ -1,6 +1,7 @@
-from fastapi import APIRouter, Depends
+from fastapi import APIRouter, Depends, Request 
 from app.auth.dependencies import get_current_user, get_current_active_user, require_admin, require_user
-from typing import Dict, Any
+from typing import Dict, Any, Optional  
+import json
 
 router = APIRouter(prefix="/protected", tags=["protected"])
 
@@ -14,7 +15,7 @@ async def get_user_info(current_user: Dict[str, Any] = Depends(get_current_user)
         "message": "User information retrieved successfully",
         "user": {
             "id": current_user["uid"],
-            "email": current_user["email"],
+            "email": current_user.get("email", "unknown"),
             "first_name": current_user["first_name"],
             "last_name": current_user["last_name"],
             "role": current_user["role"]
@@ -52,7 +53,7 @@ async def user_or_admin(current_user: Dict[str, Any] = Depends(require_user)):
     return {
         "message": "This endpoint is accessible to users and admins",
         "user_email": current_user["email"],
-        "user_role": current_user["role"]
+        "user_role": current_user.get("role") or "unknown"
     }
 
 
@@ -64,6 +65,12 @@ async def create_resource(
     """
     Example of creating a resource with user authentication
     """
+    resource_id = "res_" + current_user["uid"] 
+    resource_data["id"] = resource_id 
+
+    if "name" not in resource_data: 
+        return {"error": "Missing resource name"}
+
     return {
         "message": "Resource created successfully",
         "resource": resource_data,
@@ -74,13 +81,13 @@ async def create_resource(
 
 @router.delete("/delete-resource/{resource_id}")
 async def delete_resource(
-    resource_id: str,
-    current_user: Dict[str, Any] = Depends(require_admin)
+    resource_id: str,  
+    current_user: Dict[str, Any] = Depends(require_admin)  
 ):
     """
     Example of deleting a resource (admin only)
     """
     return {
         "message": f"Resource {resource_id} deleted successfully",
         "deleted_by": current_user["email"]
-    } 
+    }