BmorricalDjangoWorkflows 2.1.0__tar.gz → 2.1.2__tar.gz

{bmorricaldjangoworkflows-2.1.0 → bmorricaldjangoworkflows-2.1.2}/BmorricalDjangoWorkflows.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: BmorricalDjangoWorkflows
-Version: 2.1.0
+Version: 2.1.2
 Summary: Reusable Django Workflows
 Home-page: https://github.com/Bmorrical/django-workflows
 Author: Bradley Morrical

{bmorricaldjangoworkflows-2.1.0 → bmorricaldjangoworkflows-2.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: BmorricalDjangoWorkflows
-Version: 2.1.0
+Version: 2.1.2
 Summary: Reusable Django Workflows
 Home-page: https://github.com/Bmorrical/django-workflows
 Author: Bradley Morrical

bmorricaldjangoworkflows-2.1.2/VERSION

@@ -0,0 +1 @@
+2.1.2

{bmorricaldjangoworkflows-2.1.0 → bmorricaldjangoworkflows-2.1.2}/django_workflows/users/services/auth_flow.py

@@ -32,6 +32,10 @@ def generate_verification_code(*, length: int = 6) -> str:
     return "".join(secrets.choice(_ALLOWED_CODE_CHARS) for _ in range(length))
 
 
+def generate_strong_password(*, length: int = 32) -> str:
+    return secrets.token_urlsafe(length)
+
+
 def _redact_code(code: str) -> str:
     if not code:
         return ""
@@ -106,6 +110,26 @@ def _send_verification_email_or_compensate(*, user: Any, email: str, html: str,
     return False
 
 
+def _send_admin_registration_email(*, user: Any, html: str, enabled: bool) -> bool:
+    response = send_email(
+        to=[user.email],
+        subject="Your account has been created",
+        html=html,
+        enabled=enabled,
+    )
+
+    if _is_delivery_success(response):
+        logger.info("Admin registration email sent to %s", user.email)
+        return True
+
+    logger.warning(
+        "Admin registration email could not be delivered to %s (response_code=%s)",
+        user.email,
+        getattr(response, "status_code", None),
+    )
+    return False
+
+
 def _workflows_settings() -> dict[str, Any]:
     if not settings.configured:
         return {}
@@ -156,6 +180,14 @@ def _get_group_model() -> Type[Any]:
     return Group
 
 
+def _get_registration_username(*, email: str, username: Any = None) -> str:
+    if username is None:
+        return email
+
+    normalized_username = str(username).strip()
+    return normalized_username or email
+
+
 def _normalize_group_names(value: Any) -> list[str]:
     if value is None:
         return []
@@ -183,6 +215,33 @@ def _normalize_group_names(value: Any) -> list[str]:
     return normalized
 
 
+def _normalize_group_payload(groups: Any) -> list[dict[str, Any]]:
+    if groups is None:
+        return []
+
+    if not isinstance(groups, list):
+        raise ValueError("groups must be a list of objects with name and enabled.")
+
+    normalized_groups: dict[str, bool] = {}
+    for group in groups:
+        if not isinstance(group, dict):
+            raise ValueError("groups must be a list of objects with name and enabled.")
+
+        name = str(group.get("name") or "").strip()
+        if not name or "enabled" not in group:
+            raise ValueError("Each group must include name and enabled.")
+
+        try:
+            normalized_groups[name] = _coerce_bool(group["enabled"])
+        except ValueError as exc:
+            raise ValueError("Each group enabled value must be boolean.") from exc
+
+    return [
+        {"name": name, "enabled": enabled}
+        for name, enabled in normalized_groups.items()
+    ]
+
+
 def _get_existing_groups(group_names: Any) -> list[Any]:
     normalized_names = _normalize_group_names(group_names)
     if not normalized_names:
@@ -192,21 +251,49 @@ def _get_existing_groups(group_names: Any) -> list[Any]:
     return list(Group.objects.filter(name__in=normalized_names))
 
 
-def _add_existing_groups_to_user(*, user: Any, group_names: Any) -> list[str]:
-    groups = _get_existing_groups(group_names)
+def _sync_user_groups(*, user: Any, groups: Any) -> dict[str, list[str]]:
+    normalized_groups = _normalize_group_payload(groups)
     group_manager = getattr(user, "groups", None)
 
-    if not groups or group_manager is None or not hasattr(group_manager, "add"):
-        return []
+    if not normalized_groups or group_manager is None:
+        return {"added": [], "removed": []}
+
+    existing_groups = {
+        group.name: group
+        for group in _get_existing_groups([group["name"] for group in normalized_groups])
+    }
+    groups_to_add = []
+    groups_to_remove = []
 
-    group_manager.add(*groups)
-    return [group.name for group in groups]
+    for group in normalized_groups:
+        existing_group = existing_groups.get(group["name"])
+        if existing_group is None:
+            continue
+
+        if group["enabled"]:
+            groups_to_add.append(existing_group)
+        else:
+            groups_to_remove.append(existing_group)
+
+    if groups_to_add and hasattr(group_manager, "add"):
+        group_manager.add(*groups_to_add)
+    if groups_to_remove and hasattr(group_manager, "remove"):
+        group_manager.remove(*groups_to_remove)
+
+    return {
+        "added": [group.name for group in groups_to_add],
+        "removed": [group.name for group in groups_to_remove],
+    }
 
 
 def _coerce_bool(value: Any) -> bool:
     if isinstance(value, bool):
         return value
 
+    if isinstance(value, int):
+        if value in {0, 1}:
+            return bool(value)
+
     if isinstance(value, str):
         normalized = value.strip().lower()
         if normalized in {"1", "true", "yes", "on"}:
@@ -242,18 +329,23 @@ def get_user_details(user: Any) -> dict[str, Any]:
 
 def list_users(*, exclude_groups: Any = None) -> list[dict[str, Any]]:
     User = get_user_model()
-    excluded_group_names = set(_normalize_group_names(exclude_groups))
+    excluded_group_names = {"Superuser", *(_normalize_group_names(exclude_groups))}
     users = list(User.objects.all())
-    users.sort(key=lambda user: getattr(user, "id", 0))
 
-    if excluded_group_names:
-        filtered_users = []
-        for user in users:
-            user_group_names = {group.name for group in user.groups.all()}
-            if user_group_names.intersection(excluded_group_names):
-                continue
-            filtered_users.append(user)
-        users = filtered_users
+    filtered_users = []
+    for user in users:
+        user_group_names = {group.name for group in user.groups.all()}
+        if user_group_names.intersection(excluded_group_names):
+            continue
+        filtered_users.append(user)
+
+    users = sorted(
+        filtered_users,
+        key=lambda user: (
+            not bool(getattr(user, "is_active", False)),
+            str(getattr(user, "username", "") or "").lower(),
+        ),
+    )
 
     return [get_user_details(user) for user in users]
 
@@ -296,7 +388,7 @@ def register_user_and_send_verification_email(
     first_name: str,
     last_name: str,
     password: str,
-    group: Any = None,
+    username: Any = None,
     groups: Any = None,
 ) -> ServiceResult:
     """
@@ -310,6 +402,12 @@ def register_user_and_send_verification_email(
     enable_email_delivery = _is_enabled(
         _get_workflow_setting(_EMAIL_DELIVERY_ENABLED_SETTING, False)
     )
+    registration_username = _get_registration_username(email=email, username=username)
+
+    try:
+        validated_groups = _normalize_group_payload(groups)
+    except ValueError as exc:
+        return ServiceResult(success=False, message=str(exc))
 
     if User.objects.filter(email=email).exists():
         return ServiceResult(
@@ -325,7 +423,7 @@ def register_user_and_send_verification_email(
         with _registration_atomic_context():
             user = User.objects.create_user(
                 email=email,
-                username=email,
+                username=registration_username,
                 first_name=first_name,
                 last_name=last_name,
                 password=password,
@@ -340,12 +438,7 @@ def register_user_and_send_verification_email(
             meta.verify_time = timezone.now()
             meta.save()
 
-            requested_groups = _normalize_group_names(groups)
-            if group is not None:
-                requested_groups.extend(
-                    name for name in _normalize_group_names(group) if name not in requested_groups
-                )
-            _add_existing_groups_to_user(user=user, group_names=requested_groups)
+            _sync_user_groups(user=user, groups=validated_groups)
 
             message = (
                 f"Hello {first_name} {last_name},<br><br>"
@@ -402,10 +495,119 @@ def register_user_and_send_verification_email(
     )
 
 
+def admin_register_user_and_send_setup_email(
+    email: str,
+    first_name: str,
+    last_name: str,
+    username: Any = None,
+    groups: Any = None,
+) -> ServiceResult:
+    User = get_user_model()
+
+    company_name = _get_workflow_setting("COMPANY_NAME", "")
+    enable_email_delivery = _is_enabled(
+        _get_workflow_setting(_EMAIL_DELIVERY_ENABLED_SETTING, False)
+    )
+    registration_username = _get_registration_username(email=email, username=username)
+
+    try:
+        validated_groups = _normalize_group_payload(groups)
+    except ValueError as exc:
+        return ServiceResult(success=False, message=str(exc))
+
+    if User.objects.filter(email=email).exists():
+        return ServiceResult(
+            success=False,
+            message="A user with this email already exists.",
+        )
+
+    generated_password = generate_strong_password()
+    user = None
+    message = ""
+
+    try:
+        with _registration_atomic_context():
+            user = User.objects.create_user(
+                email=email,
+                username=registration_username,
+                first_name=first_name,
+                last_name=last_name,
+                password=generated_password,
+                is_active=True,
+            )
+            _sync_user_groups(user=user, groups=validated_groups)
+
+            message = (
+                f"Hello {first_name} {last_name},<br><br>"
+                'You have been added as a registered user by an administrator. '
+                'Use the "Forgot Password" flow to establish your password and login.<br><br>'
+                f"Thank you!<br><br>{company_name}"
+            )
+    except IntegrityError:
+        logger.exception("Admin registration failed due to IntegrityError for email=%s", email)
+        return ServiceResult(
+            success=False,
+            message="Email already exists, login or reset password.",
+        )
+    except Exception:
+        logger.exception("Unexpected error during admin registration for email=%s", email)
+        return ServiceResult(
+            success=False,
+            message="An unexpected error occurred during admin registration.",
+        )
+
+    if enable_email_delivery:
+        def _send_after_commit() -> None:
+            _send_admin_registration_email(
+                user=user,
+                html=message,
+                enabled=enable_email_delivery,
+            )
+
+        if _register_on_commit(_send_after_commit):
+            logger.info(
+                "Admin registration email send scheduled after transaction commit for %s",
+                user.email,
+            )
+        else:
+            _send_admin_registration_email(
+                user=user,
+                html=message,
+                enabled=enable_email_delivery,
+            )
+    else:
+        logger.info("Email delivery is disabled. Admin registration email not sent.")
+
+    return ServiceResult(
+        success=True,
+        message="User created successfully. The user can use the Forgot Password flow to establish a password and login.",
+    )
+
+
 def update_user(user: Any, data: dict[str, Any]) -> UserUpdateResult:
     processed_update = False
     user_fields_updated = False
 
+    validated_groups = None
+    if "groups" in data:
+        try:
+            validated_groups = _normalize_group_payload(data.get("groups"))
+        except ValueError as exc:
+            return UserUpdateResult(
+                success=False,
+                message=str(exc),
+            )
+
+    next_is_active = None
+    if "isActive" in data:
+        try:
+            next_is_active = _coerce_bool(data["isActive"])
+        except ValueError:
+            return UserUpdateResult(
+                success=False,
+                message="isActive must be a boolean value.",
+            )
+
     email_value = data.get("email")
     username_value = data.get("username")
     if email_value is not None or username_value is not None:
@@ -415,43 +617,36 @@ def update_user(user: Any, data: dict[str, Any]) -> UserUpdateResult:
         processed_update = True
         user_fields_updated = True
 
-    if "first_name" in data:
-        user.first_name = data["first_name"]
+    if "firstName" in data:
+        user.first_name = data["firstName"]
         processed_update = True
         user_fields_updated = True
-    if "last_name" in data:
-        user.last_name = data["last_name"]
+    if "lastName" in data:
+        user.last_name = data["lastName"]
         processed_update = True
         user_fields_updated = True
     if "password" in data:
         user.set_password(data["password"])
         processed_update = True
         user_fields_updated = True
-    if "is_active" in data:
-        try:
-            user.is_active = _coerce_bool(data["is_active"])
-        except ValueError:
-            return UserUpdateResult(
-                success=False,
-                message="is_active must be a boolean value.",
-            )
+    if "isActive" in data:
+        user.is_active = next_is_active
         processed_update = True
         user_fields_updated = True
 
-    requested_groups = []
     if "groups" in data:
-        requested_groups.extend(_normalize_group_names(data.get("groups")))
-        processed_update = True
-    if "group" in data:
-        requested_groups.extend(
-            name for name in _normalize_group_names(data.get("group")) if name not in requested_groups
-        )
         processed_update = True
-    if requested_groups:
-        _add_existing_groups_to_user(user=user, group_names=requested_groups)
+        _sync_user_groups(user=user, groups=validated_groups)
 
     if user_fields_updated:
-        user.save()
+        try:
+            user.save()
+        except IntegrityError:
+            logger.exception("User update failed due to IntegrityError for email=%s", user.email)
+            return UserUpdateResult(
+                success=False,
+                message="A user with this email already exists.",
+            )
 
     if not processed_update:
         return UserUpdateResult(

{bmorricaldjangoworkflows-2.1.0 → bmorricaldjangoworkflows-2.1.2}/django_workflows/users/urls.py

@@ -1,6 +1,7 @@
 from django.urls import path
 
 from django_workflows.users.views import (
+    AdminUserCreateView,
     ChangePasswordView,
     ForgotPasswordView,
     UserCreateView,
@@ -12,6 +13,7 @@ from django_workflows.users.views import (
 urlpatterns = [
     path("user/", UserDetailView.as_view(), name="user-detail"),
     path("users/", UserListView.as_view(), name="user-list"),
+    path("admin-register/", AdminUserCreateView.as_view(), name="admin-register"),
     path("forgot-password/", ForgotPasswordView.as_view(), name="forgot-password"),
     path("verify-code/", VerifyCodeView.as_view(), name="verify-code"),
     path("change-password/", ChangePasswordView.as_view(), name="change-password"),

{bmorricaldjangoworkflows-2.1.0 → bmorricaldjangoworkflows-2.1.2}/django_workflows/users/views.py

@@ -1,11 +1,14 @@
 import logging
 
+from django.contrib.auth import get_user_model
+
 from rest_framework import status
-from rest_framework.permissions import IsAuthenticated
+from rest_framework.permissions import BasePermission, IsAuthenticated
 from rest_framework.response import Response
 from rest_framework.views import APIView
 
 from django_workflows.users.services.auth_flow import (
+    admin_register_user_and_send_setup_email,
     change_password,
     get_user_details,
     list_users,
@@ -18,6 +21,64 @@ from django_workflows.users.services.auth_flow import (
 logger = logging.getLogger(__name__)
 
 
+def _user_has_group(user, group_name):
+    if not user or not getattr(user, "is_authenticated", False):
+        return False
+
+    group_manager = getattr(user, "groups", None)
+    if group_manager is None:
+        return False
+
+    if hasattr(group_manager, "filter"):
+        filtered_groups = group_manager.filter(name=group_name)
+        if hasattr(filtered_groups, "exists"):
+            return filtered_groups.exists()
+
+    if hasattr(group_manager, "all"):
+        return any(getattr(group, "name", None) == group_name for group in group_manager.all())
+
+    return False
+
+
+class HasUserManagerGroup(BasePermission):
+    message = "User Manager group membership is required."
+
+    def has_permission(self, request, view):
+        return _user_has_group(request.user, "User Manager")
+
+
+def _resolve_patch_target_user(request):
+    target_user_id = request.data.get("id")
+    if target_user_id is None:
+        return request.user, None
+
+    try:
+        target_user_id = int(target_user_id)
+    except (TypeError, ValueError):
+        return None, Response(
+            {"detail": "id must be an integer value."},
+            status=status.HTTP_400_BAD_REQUEST,
+        )
+
+    if target_user_id == getattr(request.user, "id", None):
+        return request.user, None
+
+    if not _user_has_group(request.user, "User Manager"):
+        return None, Response(
+            {"detail": HasUserManagerGroup.message},
+            status=status.HTTP_403_FORBIDDEN,
+        )
+
+    User = get_user_model()
+    try:
+        return User.objects.get(id=target_user_id), None
+    except User.DoesNotExist:
+        return None, Response(
+            {"detail": "User not found."},
+            status=status.HTTP_404_NOT_FOUND,
+        )
+
+
 class AnonymousWorkflowView(APIView):
     authentication_classes = []
     permission_classes = []
@@ -52,7 +113,8 @@ class ForgotPasswordView(AnonymousWorkflowView):
 
 
 # Route: POST /register/
-# Body params: firstName, lastName, email, password, optional group, optional groups, optional company honeypot field
+# Body params: firstName, lastName, email, password, optional username, optional company honeypot field, optional groups as [{name, enabled}]
+# Notes: anonymous self-registration flow; user chooses password and receives a verification code by email
 class UserCreateView(AnonymousWorkflowView):
     def post(self, request):
         data = request.data
@@ -81,7 +143,54 @@ class UserCreateView(AnonymousWorkflowView):
             last_name=data.get("lastName"),
             email=data.get("email"),
             password=data.get("password"),
-            group=data.get("group"),
+            username=data.get("username"),
+            groups=data.get("groups"),
+        )
+
+        if not result.success:
+            response_status = status.HTTP_409_CONFLICT
+            if result.message != "A user with this email already exists.":
+                response_status = status.HTTP_400_BAD_REQUEST
+
+            return Response({"detail": result.message}, status=response_status)
+
+        return Response({"detail": result.message}, status=status.HTTP_201_CREATED)
+
+
+# Route: POST /admin-register/
+# Access: authenticated users in the User Manager group
+# Body params: firstName, lastName, email, optional username, optional company honeypot field, optional groups as [{name, enabled}]
+# Notes: server generates a strong password, creates an active user, and sends an informational email without verification code logic
+class AdminUserCreateView(APIView):
+    permission_classes = [IsAuthenticated, HasUserManagerGroup]
+
+    def post(self, request):
+        data = request.data
+
+        if data.get("company") is not None and str(data.get("company")).strip():
+            logger.warning(
+                "Honeypot triggered for admin registration: company=%s",
+                data.get("company"),
+            )
+            return Response(
+                {"detail": "Bot detected. Registration blocked."},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        required_fields = ["firstName", "lastName", "email"]
+        missing_fields = [field for field in required_fields if field not in data]
+        if missing_fields:
+            logger.error("Admin registration missing fields: %s", missing_fields)
+            return Response(
+                {"detail": f"Missing required field(s): {', '.join(missing_fields)}"},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        result = admin_register_user_and_send_setup_email(
+            first_name=data.get("firstName"),
+            last_name=data.get("lastName"),
+            email=data.get("email"),
+            username=data.get("username"),
             groups=data.get("groups"),
         )
 
@@ -155,7 +264,7 @@ class ChangePasswordView(AnonymousWorkflowView):
 
 
 # Route: GET /users/
-# Query params: optional exclude_group as comma-separated group names
+# Query params: optional exclude_group as comma-separated group names; users in the Superuser group are always excluded
 class UserListView(APIView):
     permission_classes = [IsAuthenticated]
 
@@ -167,7 +276,8 @@ class UserListView(APIView):
 
 # Route: GET /user/
 # Route: PATCH /user/
-# PATCH body params: username, email, first_name, last_name, password, is_active, optional group, optional groups
+# PATCH body params: optional id, username, email, firstName, lastName, password, isActive, optional groups as [{name, enabled}]
+# Notes: when id is omitted the authenticated user is updated; updating another user by id requires the User Manager group
 class UserDetailView(APIView):
     permission_classes = [IsAuthenticated]
 
@@ -177,7 +287,11 @@ class UserDetailView(APIView):
         return Response(data, status=status.HTTP_200_OK)
 
     def patch(self, request):
-        result = update_user(request.user, request.data)
+        target_user, error_response = _resolve_patch_target_user(request)
+        if error_response is not None:
+            return error_response
+
+        result = update_user(target_user, request.data)
 
         if result.success:
             return Response(
@@ -185,5 +299,5 @@ class UserDetailView(APIView):
                 status=status.HTTP_200_OK,
             )
 
-        logger.error("UserDetailView: %s for user %s", result.message, request.user.email)
+        logger.error("UserDetailView: %s for user %s", result.message, target_user.email)
         return Response({"detail": result.message}, status=status.HTTP_400_BAD_REQUEST)