Description Currently, the ISA Tool allows only the campaign creator (campaign manager) to edit and update a campaign. This creates a single point of failure: if the campaign manager becomes inactive or unavailable, tool maintainers and owners cannot update campaign details. To address this, we need to introduce a Superuser mechanism using a soft allowlist, without making any database schema changes. Superusers are trusted maintainers whose usernames are defined in a configuration-based allowlist. These users should have the same campaign-editing permissions as a campaign manager and be able to update any campaign, regardless of ownership.

Domain Coding (Backend / Authorization)

Difficulty Difficult

Implementation Requirements

1. Superuser Allowlist (No DB Changes) Introduce a soft allowlist of usernames, defined via: Application config, or Environment variable (preferred) Example: ISA_SUPERUSERS = ["Username1", "Username2"] No database migrations or schema changes are allowed.

2. Centralized Permission Logic
   • Implement a helper function such as:

def can_manage_campaign(user, campaign):
    return (user and (user.id == campaign.manager_id or user.username in SUPERUSER_ALLOWLIST))

• Avoid duplicating permission checks across routes

3. Update Campaign Edit / Update Routes Replace existing checks that only allow campaign managers. Ensure:
   • Campaign managers retain existing permissions.
   • Superusers can edit and update any campaign.
   • Unauthorized users are blocked.

4. Security Constraints
   • No UI or API should allow users to modify the superuser list.
   • Superuser list should be editable only by maintainers via config or environment variables.
   • Prevent privilege escalation.

Expected Outcome

• Superusers can edit and update any campaign.
• Campaign managers can still edit their own campaigns.
• Regular users cannot edit campaigns they do not manage.
• No database schema changes are introduced.
• Permission logic is explicit, readable, and maintainable.

Acceptance Criteria

• A user listed in the superuser allowlist can update any campaign.
• A campaign manager can update their own campaign.
• A regular user cannot update campaigns they do not manage.
• No database migration is required.
• Existing campaign functionality remains unaffected.

Setup Notes
Superuser usernames may be defined via environment variables or app configuration.
Testing should cover:

• Campaign manager access
• Superuser access
• Unauthorized access