WIP checkpoint: Address review feedback: Address review feedback: Scaffold FastAPI backend project structure

backend/app/routers/users.py

@@ -30,7 +30,7 @@ class UserUpdate(BaseModel):
     is_active: bool | None = None
 
 
-# ─── Endpoints ────────────────────────────────────────────────────────────────
+# ─── Endpoints ───────────────────────────────────────────────────────────────
 
 @router.get("/me", response_model=UserResponse)
 async def get_current_user_profile(
@@ -46,15 +46,14 @@ async def get_user(
     current_user: CurrentUser,
     db: Annotated[AsyncSession, Depends(get_db)],
 ):
-    """Get a user by ID.  Owners and admins can see any user; others see
-    only their own profile."""
+    """Get a user by ID.  Only the owner can view their own profile."""
     result = await db.execute(select(User).where(User.id == user_id))
     user = result.scalar_one_or_none()
     if not user:
         raise HTTPException(status_code=404, detail="User not found")
 
-    # Allow viewing own profile or if user is active (admins always allowed)
-    if user.id != current_user.id and not current_user.is_active:
+    # Only the owner may view their own profile.
+    if user.id != current_user.id:
         raise HTTPException(status_code=403, detail="Not authorized to view this user")
 
     return user
@@ -67,13 +66,14 @@ async def update_user(
     current_user: CurrentUser,
     db: Annotated[AsyncSession, Depends(get_db)],
 ):
-    """Update a user.  Only the owner (or an active admin) can update."""
+    """Update a user.  Only the owner can update their own account."""
     result = await db.execute(select(User).where(User.id == user_id))
     user = result.scalar_one_or_none()
     if not user:
         raise HTTPException(status_code=404, detail="User not found")
 
-    if user.id != current_user.id and not current_user.is_active:
+    # Only the owner may update their own account.
+    if user.id != current_user.id:
         raise HTTPException(status_code=403, detail="Not authorized to update this user")
 
     if user_update.email is not None:
@@ -92,13 +92,14 @@ async def delete_user(
     current_user: CurrentUser,
     db: Annotated[AsyncSession, Depends(get_db)],
 ):
-    """Delete a user.  Only the owner (or an active admin) can delete."""
+    """Delete a user.  Only the owner can delete their own account."""
     result = await db.execute(select(User).where(User.id == user_id))
     user = result.scalar_one_or_none()
     if not user:
         raise HTTPException(status_code=404, detail="User not found")
 
-    if user.id != current_user.id and not current_user.is_active:
+    # Only the owner may delete their own account.
+    if user.id != current_user.id:
         raise HTTPException(status_code=403, detail="Not authorized to delete this user")
 
     await db.delete(user)