feat: Dashboard should check admin based on value from session

Author: KShivendu

supertokens_python/recipe/dashboard/recipe_implementation.py

@@ -69,19 +69,24 @@ async def should_allow_access(
 
                 admins = config.admins
 
-                # If the user has provided no admins, allow
-                if len(admins) == 0:
+                if admins is None:
                     return True
 
-                email_in_headers = request.get_header("email")
+                if len(admins) == 0:
+                    log_debug_message(
+                        "User Dashboard: Throwing OPERATION_NOT_ALLOWED because user is not an admin"
+                    )
+                    raise DashboardOperationNotAllowedError()
+
+                user_email = session_verification_response.get("email")
 
-                if email_in_headers is None:
+                if user_email is None or not isinstance(user_email, str):
                     log_debug_message(
                         "User Dashboard: Returning UNAUTHORISED_ERROR because no email was provided in headers"
                     )
                     return False
 
-                if email_in_headers not in admins:
+                if user_email not in admins:
                     log_debug_message(
                         "User Dashboard: Throwing OPERATION_NOT_ALLOWED because user is not an admin"
                     )

supertokens_python/recipe/dashboard/utils.py

@@ -183,7 +183,7 @@ class DashboardConfig:
     def __init__(
         self,
         api_key: Optional[str],
-        admins: List[str],
+        admins: Optional[List[str]],
         override: OverrideConfig,
         auth_mode: str,
     ):
@@ -208,7 +208,7 @@ def validate_and_normalise_user_input(
             "User Dashboard: Providing 'admins' has no effect when using an api key."
         )
 
-    admins = [normalise_email(a) for a in admins] if admins is not None else []
+    admins = [normalise_email(a) for a in admins] if admins is not None else None
 
     return DashboardConfig(
         api_key,