U
    hn/                     @   s   d Z ddlmZ ddlmZ ddlmZ ddlmZ ddl	m
Z
 ddlmZ ddlmZ dd	lmZ dd
lmZ G dd deZd!ddZdd Zdd Zdd ZG dd dZdd Zdd Zdd Zdd  ZdS )"z
Django Permission System for Accounts App

This module provides a comprehensive permission system for the accounts app
with decorators, mixins, and utility functions for checking user permissions.
    )wraps)messages)reverse_lazy)JsonResponse)redirect)PermissionDenied)method_decorator)login_required)LoginRequiredMixinc                       s0   e Zd ZdZdZdZ fddZdd Z  ZS )PermissionRequiredMixinze
    Mixin that checks if user has required permissions.
    Can be used with class-based views.
    Nz.You don't have permission to access this page.c                    sV   |   sB|jddkr,td| jdddS t|| j tdS t j	|f||S )NX-Requested-WithXMLHttpRequestFsuccessmessage  statuscore:dashboard)
has_permissionheadersgetr   permission_denied_messager   errorr   superdispatch)selfrequestargskwargs	__class__ 4/var/www/html/Focus/src/apps/accounts/permissions.pyr      s    z PermissionRequiredMixin.dispatchc                 C   s4   | j s
dS t| j tr | j g}n| j }| jj|S )z'Check if user has required permissions.T)permission_required
isinstancestrr   user	has_perms)r   permissionsr"   r"   r#   r   (   s    
z&PermissionRequiredMixin.has_permission)	__name__
__module____qualname____doc__r$   r   r   r   __classcell__r"   r"   r    r#   r      s
   r   NFc                    s    fdd}|S )a?  
    Decorator for views that checks whether a user has permission to access the view.
    
    Args:
        permission_codename: String or list of permission codenames to check
        login_url: URL to redirect to if user is not authenticated
        raise_exception: Whether to raise PermissionDenied exception
    c                    s&   t  td fdd}|S )N)	login_urlc                    sp   t  tr g}n }| j|s`r*t| jddkrLtdddddS t	| d t
dS | f||S )	Nr   r   F1You don't have permission to perform this action.r   r   r   r   )r%   r&   r'   r(   r   r   r   r   r   r   r   r   r   r   r)   )permission_codenameraise_exception	view_funcr"   r#   _wrapped_view?   s     
z=permission_required.<locals>.decorator.<locals>._wrapped_viewr   r	   r4   r5   r/   r2   r3   r4   r#   	decorator>   s    z&permission_required.<locals>.decoratorr"   )r2   r/   r3   r:   r"   r8   r#   r$   5   s    	r$   c                    s    fdd}|S )zH
    Decorator specifically for AJAX views that checks permissions.
    c                    s   t  t fdd}|S )Nc                    sD   t  tr g}n }| j|s4tdddddS | f||S )NFr0   r   r   r   )r%   r&   r'   r(   r   r1   )r2   r4   r"   r#   r5   ^   s    
zBajax_permission_required.<locals>.decorator.<locals>._wrapped_viewr6   r7   r2   r9   r#   r:   ]   s    z+ajax_permission_required.<locals>.decoratorr"   )r2   r:   r"   r;   r#   ajax_permission_requiredY   s    r<   c                 C   s    t |tr|g}n|}| |S )z
    Utility function to check if a user has specific permission.
    
    Args:
        user: User instance
        permission_codename: String or list of permission codenames
    
    Returns:
        Boolean indicating if user has permission
    )r%   r&   r(   )r'   r2   r)   r"   r"   r#   user_has_permissionq   s    
r=   c                 C   sD   ddl m} ddlm} | j }|jj| dd }|	|}|S )z
    Get all permissions for a user including role-based permissions.
    
    Args:
        user: User instance
    
    Returns:
        QuerySet of permissions
    r   
Permission)UserRoleT)Zrole__userrole__userZrole__userrole__is_active)
django.contrib.auth.modelsr?   apps.accounts.modelsr@   user_permissionsallobjectsfilterdistinctunion)r'   r?   r@   rC   Zrole_permissionsall_permissionsr"   r"   r#   get_user_permissions   s    



rJ   c                   @   s\   e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZdZdZdZdZdZdZdZdZdZdS )UserManagementPermissionsz)Permission constants for user management.accounts.view_useraccounts.add_useraccounts.change_useraccounts.delete_useraccounts.view_roleaccounts.add_roleaccounts.change_roleaccounts.delete_rolezauth.view_permissionzauth.add_permissionzauth.change_permissionzauth.delete_permissionaccounts.add_userroleaccounts.delete_userroleaccounts.view_profileaccounts.change_profilezactivities.view_activityaccounts.view_usersessionaccounts.delete_usersessionN)r*   r+   r,   r-   CAN_VIEW_USERSCAN_ADD_USERSCAN_CHANGE_USERSZCAN_DELETE_USERSCAN_VIEW_ROLESCAN_ADD_ROLESCAN_CHANGE_ROLESZCAN_DELETE_ROLESCAN_VIEW_PERMISSIONSZCAN_ADD_PERMISSIONSZCAN_CHANGE_PERMISSIONSZCAN_DELETE_PERMISSIONSZCAN_ASSIGN_ROLESZCAN_REVOKE_ROLESZCAN_VIEW_PROFILESZCAN_CHANGE_PROFILESCAN_VIEW_ACTIVITIESCAN_VIEW_SESSIONSZCAN_TERMINATE_SESSIONSr"   r"   r"   r#   rK      s(   rK   c               
   C   s   ddl m}  ddlm} ddlm}m}m}m}m	} ddddd	d
ddddg
}|D ]<\}}	|j
|}
| j
j||	|
d\}}|rPtd|  qPdS )zo
    Create default permissions for the accounts app.
    This should be called during app initialization.
    r   r>   )ContentType)UserRoler@   ProfileUserSession)can_manage_userszCan manage all users)Zcan_view_user_detailszCan view user details)Zcan_export_userszCan export user data)Zcan_assign_roleszCan assign roles to users)Zcan_manage_permissionszCan manage permissions)Zcan_view_all_profileszCan view all user profiles)Zcan_manage_profileszCan manage user profiles)Zcan_view_all_sessionszCan view all user sessions)Zcan_terminate_sessionszCan terminate user sessions)Zcan_view_all_activitieszCan view all user activities)codenamenamecontent_typezCreated permission: N)rA   r?   "django.contrib.contenttypes.modelsrc   rB   rd   re   r@   rf   rg   rE   get_for_modelget_or_createprint)r?   rc   rd   re   r@   rf   rg   Zcustom_permissionsri   rj   rk   
permissioncreatedr"   r"   r#   create_default_permissions   s.    
rr   c                  C   sV  ddl m}  ddlm} dddddd	d
ddddddddddddddddddddgdd d!ddd	dddddddddgdd"d#d	ddd$gdd%d&ddgdd'}| D ]\}}|jj||d( |d) d*|d+krd,n|d-krd.n|d/krd0nd1d2|d3kd4d5\}}|rtd6|  | jjd7d8 |d9 D d:}|j	
| td;|  d<|  qd=S )>z<
    Set up default roles with appropriate permissions.
    r   r>   )re   zSuper Administratorz&Has full access to all system featuresrM   rN   rO   rL   rQ   rR   rS   rP   rT   rU   zaccounts.view_userrolezaccounts.add_profilerW   rV   zaccounts.add_usersessionzaccounts.change_usersessionrY   rX   zaccounts.can_manage_userszaccounts.can_assign_roleszaccounts.can_manage_permissionszaccounts.can_view_all_profileszaccounts.can_view_all_sessionszaccounts.can_terminate_sessionsz accounts.can_view_all_activities)rj   descriptionr)   Administratorz&Has access to user and role managementManagerzHas access to user managementzaccounts.can_view_user_detailszRegular UserzBasic user permissions)super_adminadminmanagerr'   rj   rs   systemrv      rw      rx         Tr'   )rj   rs   	role_typelevel	is_active
is_default)codedefaultszCreated role: c                 S   s   g | ]}| d d qS ).)split).0permr"   r"   r#   
<listcomp>6  s    z'setup_default_roles.<locals>.<listcomp>r)   )Zcodename__inzAdded z permissions to N)rA   r?   rB   re   itemsrE   rn   ro   rF   r)   setcount)r?   re   default_roles	role_code	role_datarolerq   r)   r"   r"   r#   setup_default_roles   s                              	 +&

r   c                 C   s   |  tjtjtjgS )z2Check if user has any user management permissions.)r(   rK   rZ   r[   r\   r'   r"   r"   r#   has_user_management_permission=  s
    r   c                 C   s   |  tjtjtjgS )z2Check if user has any role management permissions.)r(   rK   r]   r^   r_   r   r"   r"   r#   has_role_management_permissionF  s
    r   )NF)r-   	functoolsr   django.contribr   django.urlsr   django.httpr   django.shortcutsr   django.core.exceptionsr   django.utils.decoratorsr   django.contrib.auth.decoratorsr	   django.contrib.auth.mixinsr
   r   r$   r<   r=   rJ   rK   rr   r   r   r   r"   r"   r"   r#   <module>   s&   !
$%-K	