97 lines
3.9 KiB
Python
97 lines
3.9 KiB
Python
"""
|
|
Modèle User - GMAO Collège
|
|
Gestion des utilisateurs et authentification
|
|
Compatible avec la base de données existante
|
|
"""
|
|
from flask_login import UserMixin
|
|
from werkzeug.security import generate_password_hash, check_password_hash
|
|
from datetime import datetime, timezone
|
|
from ...extensions import db
|
|
|
|
|
|
class User(UserMixin, db.Model):
|
|
"""Utilisateur de l'application GMAO."""
|
|
__tablename__ = "users"
|
|
|
|
id = db.Column(db.Integer, primary_key=True)
|
|
username = db.Column(db.String(80), unique=True, nullable=False)
|
|
email = db.Column(db.String(120), unique=True, nullable=True)
|
|
password_hash = db.Column(db.String(256), nullable=False)
|
|
full_name = db.Column(db.String(150), nullable=False, default="")
|
|
role = db.Column(db.String(32), default="demandeur", nullable=False)
|
|
is_active = db.Column(db.Boolean, default=True)
|
|
created_at = db.Column(db.DateTime, default=lambda: datetime.now(timezone.utc))
|
|
last_login = db.Column(db.DateTime, nullable=True)
|
|
role_links = db.relationship("UserRole", foreign_keys="UserRole.user_id", back_populates="user", cascade="all, delete-orphan")
|
|
permission_links = db.relationship("UserPermission", foreign_keys="UserPermission.user_id", back_populates="user", cascade="all, delete-orphan")
|
|
|
|
def set_password(self, password):
|
|
"""Hash et stocke le mot de passe."""
|
|
self.password_hash = generate_password_hash(password)
|
|
|
|
def check_password(self, password):
|
|
"""Vérifie le mot de passe."""
|
|
return check_password_hash(self.password_hash, password)
|
|
|
|
def is_admin(self):
|
|
"""Vérifie l'administration via le RBAC réel, jamais ``User.role``."""
|
|
try:
|
|
for link in self.role_links:
|
|
if link.role and link.role.is_active and link.role.slug == "admin":
|
|
return True
|
|
if link.role and link.role.is_active:
|
|
if any(
|
|
permission.effect == "allow"
|
|
and permission.permission
|
|
and permission.permission.is_active
|
|
and permission.permission.code == "*"
|
|
for permission in link.role.permission_links
|
|
):
|
|
return True
|
|
except Exception:
|
|
from flask import current_app
|
|
current_app.logger.exception("Erreur RBAC lors de la vérification admin")
|
|
return False
|
|
|
|
@property
|
|
def canonical_role(self):
|
|
from ..authorization import canonical_role
|
|
return canonical_role(self.role)
|
|
|
|
@property
|
|
def role_label(self):
|
|
from ..authorization import ROLE_LABELS
|
|
roles = [link.role for link in self.role_links if link.role and link.role.is_active]
|
|
if roles:
|
|
return ", ".join(role.name for role in sorted(roles, key=lambda item: item.name.lower()))
|
|
return "Aucun rôle RBAC"
|
|
|
|
def has_permission(self, permission):
|
|
from ..authorization import has_permission
|
|
return has_permission(permission, self)
|
|
|
|
def __repr__(self):
|
|
return f"<User {self.username}>"
|
|
|
|
|
|
class Staff(db.Model):
|
|
"""Personnel du collège."""
|
|
__tablename__ = "staff"
|
|
|
|
id = db.Column(db.Integer, primary_key=True)
|
|
first_name = db.Column(db.String(100), nullable=False)
|
|
last_name = db.Column(db.String(100), nullable=False)
|
|
function = db.Column(db.String(200), nullable=True) # Fonction/Poste
|
|
department = db.Column(db.String(200), nullable=True)
|
|
email = db.Column(db.String(200), nullable=True)
|
|
phone = db.Column(db.String(20), nullable=True)
|
|
is_active = db.Column(db.Boolean, default=True)
|
|
created_at = db.Column(db.DateTime, default=lambda: datetime.now(timezone.utc))
|
|
|
|
@property
|
|
def full_name(self):
|
|
"""Retourne le nom complet."""
|
|
return f"{self.first_name} {self.last_name}"
|
|
|
|
def __repr__(self):
|
|
return f"<Staff {self.full_name}>"
|