micro-users 1.2.3__py3-none-any.whl → 1.3.0__py3-none-any.whl

{micro_users-1.2.3.dist-info → micro_users-1.3.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: micro-users
-Version: 1.2.3
+Version: 1.3.0
 Summary: Arabic Django user management app with abstract user, permissions, and activity logging
 Home-page: https://github.com/debeski/micro-users
 Author: DeBeski
@@ -99,12 +99,19 @@ python manage.py migrate users
 ## Structure
 ```
 users/
-├── models.py      # User model, permissions, activity logs
-├── views.py       # CRUD operations
-├── urls.py        # URL routing
-├── admin.py       # Admin integration
-├── templates/     # HTML templates
-└── migrations/    # Database migrations
+├── views.py        # CRUD operations
+├── urls.py         # URL routing
+├── tables.py       # User and Activity Log tables
+├── signals.py      # Logging signals
+├── models.py       # User model, permissions, activity logs
+├── forms.py        # Creation, edit,. etc.
+├── filter.py       # Search filters
+├── apps.py         # Permissions Localization
+├── admin.py        # Admin UI integration
+├── __init__.py     # Python init
+├── templates/      # HTML templates
+├── static/         # CSS classes
+└── migrations/     # Database migrations
 ```
 
 ## Version History
@@ -121,3 +128,5 @@ users/
 | v1.2.0   | • Added User Details view with specific user activity log |
 | v1.2.1   | • Fixed a minor import bug |
 | v1.2.3   | • Separated user detail view from table for consistency<br> • Optimized the new detail + log view for optimal compatibiliyy with users |
+| v1.2.4   | • Fixed a couple of visual inconsistencies |
+| v1.3.0   | • Patched a critical security permission issue<br> • Disabled ADMIN from being viewed/edited from other staff members<br> • Fixed an issue when sorting with full_name<br> • Enabled Logging for all actions |

{micro_users-1.2.3.dist-info → micro_users-1.3.0.dist-info}/RECORD

@@ -1,27 +1,28 @@
 users/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 users/admin.py,sha256=VF0V6hQ9Obcdinnjb8nBHaknas2p3O5w-6yAJ-DeARQ,636
 users/apps.py,sha256=Xb1nGvCl08KaUVqcUG82-jYdG6-KTVjaw_lgr5GIuYY,1133
-users/filters.py,sha256=9-yrWBF-CdWb1nrAhmifWb1AHI0z4LQma1uR_9jLr2U,4797
+users/filters.py,sha256=neOdbyOSYVQXAQ2vKAW-0bcj7KIh9xc8UboHTlaZU4Q,4785
 users/forms.py,sha256=GHC8pFm2i9PD3MVaakrgMXEszsBrXieHq7DYiAfo8Fw,14977
-users/models.py,sha256=KX_6LoiNJN6PCTFOuuGp5so4CNn5pAh1Vpaigv4fKk4,2060
+users/models.py,sha256=V_SIyGGq2w_bww7YufMjqXMSKN1u9CkSMPuOLiwPjtc,2100
 users/signals.py,sha256=5Kd3KyfPT6740rvwZj4vy1yXsmjVhmaQ__RB8p5R5aE,1336
-users/tables.py,sha256=ZW8_TR6Y3DwchS7Q8DGVdJX01fjIDZfaqoZo0XpZnyU,1920
+users/tables.py,sha256=WwC7BMpzNrcfEatJj6gHMP8k_FGqer-Zfn9vZRB7kZo,2196
 users/urls.py,sha256=FwQ9GVOBRQ4iXQ9UyLFI0aEAga0d5qL_miPNpmFPA-Q,1022
-users/views.py,sha256=FdMY49IKgU0clowCJ3_XRqqLLja7N7fs9GhavmJE0mw,7979
+users/views.py,sha256=_O6xRoej-JW4u-9vTK55Jr4SVRpgL2qG1BSx1o6xYRs,8741
 users/migrations/0001_initial.py,sha256=lx9sSKS-lxHhI6gelVH52NOkwqEMJ32TvOJUn9zaOXM,4709
+users/migrations/0002_alter_useractivitylog_action.py,sha256=I7NLxgcPTslCMuADcr1srXS_C_0y_LcZiAFFHBG5NsE,715
 users/migrations/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 users/static/css/login.css,sha256=SiJ6jBbWQAP2Nxt7DOTZbTcFYP9JEp557AuQZ9Eirb0,2120
 users/static/img/default_profile.webp,sha256=BKUoQHo4z_fZnmc6z6I-KFvLEHahDr98U9LnDQKHLAM,3018
 users/templates/user_activity_log.html,sha256=S_FDN6vVLz_mB826yjeU9vtVGtzk7E_LKBmQIeYtdkQ,611
 users/templates/registration/login.html,sha256=owbzO_XjqMeSncwWxkTzsvbkhjEZd7LdbblC3HBnld0,4091
-users/templates/users/manage_users.html,sha256=ZusUTrJcp-xeORBnOcBObi9q1zlQE9yVRurMEvQVeWQ,2940
-users/templates/users/profile.html,sha256=9ahVF6YZUR-6-c8SKc0rN2pVdis2lI9gbcOQZeMaFnY,2909
-users/templates/users/profile_edit.html,sha256=sgO3h9ffVK1vnDNl4E6l5x3xfam3FTQl6Lqkrw5gmlw,4215
-users/templates/users/user_actions.html,sha256=TfA1DUvPyuSTPvVn7JgAL1cbqQyT9d8vnVB6j6308LU,1625
+users/templates/users/manage_users.html,sha256=71SIAF6xyyKa863yLmqCHaqbGwATmpVmXRVtpy_330M,2942
+users/templates/users/profile.html,sha256=Ir8zvYUgDm89BlwVuuCsPJIVvTPa_2wH3HAaitPc4s8,2911
+users/templates/users/profile_edit.html,sha256=L9DUHlQHG-PmxwxBbSjgPk1dEmy0spPi6wXzT4hQe-U,4218
+users/templates/users/user_actions.html,sha256=J44-sn0fMbLUWjdtlcf5YhgT5OYRykr1mFkeVXoI1ew,1543
 users/templates/users/user_detail.html,sha256=QkJ-6jdtUdi8mM-V_MzqYcdoEkzXEsIeFMliNjgIOsc,2053
 users/templates/users/user_form.html,sha256=jcyI7OQZOY4ue4DajPtfjAt2SmAYO5ZgHNOqTp2-FO0,1352
-micro_users-1.2.3.dist-info/LICENSE,sha256=Fco89ULLSSxKkC2KKnx57SaT0R7WOkZfuk8IYcGiN50,1063
-micro_users-1.2.3.dist-info/METADATA,sha256=dApOQwELdXHFYZaiDIPqzK6uuz24dN9R3RjriOEqRtQ,3653
-micro_users-1.2.3.dist-info/WHEEL,sha256=pkctZYzUS4AYVn6dJ-7367OJZivF2e8RA9b_ZBjif18,92
-micro_users-1.2.3.dist-info/top_level.txt,sha256=tWT24ZcWau2wrlbpU_h3mP2jRukyLaVYiyHBuOezpLQ,6
-micro_users-1.2.3.dist-info/RECORD,,
+micro_users-1.3.0.dist-info/LICENSE,sha256=Fco89ULLSSxKkC2KKnx57SaT0R7WOkZfuk8IYcGiN50,1063
+micro_users-1.3.0.dist-info/METADATA,sha256=tI_SdrsRx0JA1ppDV95GZUzYeOVvoUYzt7cPvEDUelQ,4277
+micro_users-1.3.0.dist-info/WHEEL,sha256=pkctZYzUS4AYVn6dJ-7367OJZivF2e8RA9b_ZBjif18,92
+micro_users-1.3.0.dist-info/top_level.txt,sha256=tWT24ZcWau2wrlbpU_h3mP2jRukyLaVYiyHBuOezpLQ,6
+micro_users-1.3.0.dist-info/RECORD,,

users/filters.py

@@ -14,11 +14,9 @@ class UserFilter(django_filters.FilterSet):
         method='filter_keyword',
         label='',
     )
-
     class Meta:
         model = User
         fields = []
-
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         self.form.helper = FormHelper()
@@ -33,7 +31,6 @@ class UserFilter(django_filters.FilterSet):
                 css_class='form-row'
             ),
         )
-
     def filter_keyword(self, queryset, name, value):
         """
         Filter the queryset by matching the keyword in username, email, phone, and occupation.
@@ -48,37 +45,31 @@ class UserFilter(django_filters.FilterSet):
         )
 
 
-
 class UserActivityLogFilter(django_filters.FilterSet):
     keyword = django_filters.CharFilter(
         method='filter_keyword',
         label='',
     )
-
     year = django_filters.ChoiceFilter(
         field_name="timestamp__year",
         lookup_expr="exact",
         choices=[],
         empty_label="السنة",
     )
-
     class Meta:
         model = UserActivityLog
         fields = {
             'timestamp': ['gte', 'lte'],
         }
-
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         
         # Fetch distinct years dynamically
         years = UserActivityLog.objects.dates('timestamp', 'year').distinct()
         self.filters['year'].extra['choices'] = [(year.year, year.year) for year in years]
-
         self.filters['year'].field.widget.attrs.update({
             'onchange': 'this.form.submit();'
         })
-
         self.form.helper = FormHelper()
         self.form.helper.form_method = 'GET'
         self.form.helper.form_class = 'form-inline'
@@ -100,7 +91,6 @@ class UserActivityLogFilter(django_filters.FilterSet):
                 css_class='form-row'
             ),
         )
-
     def filter_keyword(self, queryset, name, value):
         """
         Filter the queryset by matching the keyword in username, email, phone, and occupation.
@@ -116,5 +106,3 @@ class UserActivityLogFilter(django_filters.FilterSet):
             Q(ip_address__icontains=value)
         )
 
-
-

users/migrations/0002_alter_useractivitylog_action.py

@@ -0,0 +1,18 @@
+# Generated by Django 5.2.8 on 2025-12-08 14:58
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('users', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='useractivitylog',
+            name='action',
+            field=models.CharField(choices=[('LOGIN', 'تسجيل دخـول'), ('LOGOUT', 'تسجيل خـروج'), ('CREATE', 'انشـاء'), ('UPDATE', 'تعديـل'), ('DELETE', 'حــذف'), ('VIEW', 'عـرض'), ('DOWNLOAD', 'تحميل'), ('CONFIRM', 'تأكيـد'), ('REJECT', 'رفــض'), ('RESET', 'اعادة ضبط')], max_length=10, verbose_name='العملية'),
+        ),
+    ]

users/models.py

@@ -25,6 +25,7 @@ class UserActivityLog(models.Model):
         ('DOWNLOAD', 'تحميل'),
         ('CONFIRM', 'تأكيـد'),
         ('REJECT', 'رفــض'),
+        ('RESET', 'اعادة ضبط'),
     ]
 
     user = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.SET_NULL, verbose_name="اسم المستخدم", null=True, blank=True)

users/tables.py

@@ -10,6 +10,8 @@ class UserTable(tables.Table):
     username = tables.Column(verbose_name="اسم المستخدم")
     email = tables.Column(verbose_name="البريد الالكتروني")
     full_name = tables.Column(verbose_name="الاسم بالكامل", orderable=False,)
+    is_staff = tables.BooleanColumn(verbose_name="مسؤول")
+    is_active = tables.BooleanColumn(verbose_name="نشط")
     last_login = tables.DateColumn(
         format="H:i Y-m-d ",  # This is the format you want for the timestamp
         verbose_name="اخر دخول"
@@ -33,10 +35,15 @@ class UserActivityLogTable(tables.Table):
         format="H:i Y-m-d ",  # This is the format you want for the timestamp
         verbose_name="وقت العملية"
     )
+    full_name = tables.Column(
+        verbose_name="الاسم بالكامل",
+        accessor='user.full_name',
+        order_by='user__first_name'
+    )
     class Meta:
         model = UserActivityLog
         template_name = "django_tables2/bootstrap5.html"
-        fields = ("timestamp", "user", "user.full_name", "action", "model_name", "object_id", "number")
+        fields = ("timestamp", "user", "full_name", "action", "model_name", "object_id", "number")
         attrs = {'class': 'table table-hover align-middle'}
 
 class UserActivityLogTableNoUser(UserActivityLogTable):

users/templates/users/manage_users.html

@@ -21,7 +21,7 @@
     </div>
 
     <div class="mt-3">
-        <a href="{% url 'create_user' %}" class="btn btn-success" title="إضافة مستخدم جديد">
+        <a href="{% url 'create_user' %}" class="btn btn-secondary" title="إضافة مستخدم جديد">
             <i class="bi bi-person-plus-fill text-light me-1 h4"></i> إضافة مستخدم جديد
         </a>
     </div>

users/templates/users/profile.html

@@ -27,7 +27,7 @@
     <div class="row mt-4">
         <form method="post">
             {% csrf_token %}
-            <a class="btn btn-success" href="{% url 'edit_profile' %}" role="button" title="تحديث البيانات">
+            <a class="btn btn-secondary" href="{% url 'edit_profile' %}" role="button" title="تحديث البيانات">
                 <i class="bi bi-pencil-square text-light me-1 h4"></i> تحديث البيانات
             </a>
             

users/templates/users/profile_edit.html

@@ -49,7 +49,7 @@
             <button type="submit" class="btn btn-success" title="حفظ التغييرات">
                 <i class="bi bi-check2-square text-light me-1 h4"></i> حفظ التغييرات
             </button>
-            <a href="{% url 'user_profile' %}" class="btn btn-danger" title="إلغـــاء">
+            <a href="{% url 'user_profile' %}" class="btn btn-secondary" title="إلغـــاء">
                 <i class="bi bi-x-circle text-light me-1 h4"></i> إلغـــاء
             </a>
         </div>

users/templates/users/user_actions.html

@@ -1,23 +1,21 @@
 <div class="d-flex gap-2 align-items-center justify-content-end no-print">
+    {% if user.is_superuser or user.is_staff and not record.is_superuser %}
     <div class="dropdown-center">
         <a href="#" class="action-icon" id="actionDropdown{{ record.id }}" data-bs-toggle="dropdown" aria-expanded="false">
             <i class="bi bi-three-dots-vertical text-dark"></i>
         </a>
         <ul class="dropdown-menu" aria-labelledby="actionDropdown{{ record.id }}">
-            {% comment %} <li>
-                <a class="dropdown-item" href="#" title="عرض">
-                    <i class="bi bi-person-lines-fill text-dark me-1 h5"> </i> عرض
-                </a>
-            </li> {% endcomment %}
+            
             <li>
                 <a class="dropdown-item" href="{% url 'user_detail' record.pk %}" title="عرض">
-                    <i class="bi bi-person-dash-fill text-dark me-1 h5"> </i> عرض
+                    <i class="bi bi-person-lines-fill text-dark me-1 h5"> </i> عرض
                 </a>
             </li>
-            {% if not record.is_superuser %}
+            
+            {% if user.is_superuser or user.is_staff and not record.is_superuser %}
             <li>
                 <a class="dropdown-item" href="{% url 'edit_user' record.pk %}" title="تعديل">
-                    <i class="bi bi-person-dash-fill text-dark me-1 h5"> </i> تعديل
+                    <i class="bi bi-person-dash-fill text-dark me-1 h5"></i> تعديل
                 </a>
             </li>
             {% endif %}
@@ -31,4 +29,5 @@
             {% endif %}
         </ul>
     </div>
+    {% endif %}
 </div>

users/views.py

@@ -10,6 +10,7 @@ from django.shortcuts import render, redirect, get_object_or_404
 from django_tables2 import RequestConfig, SingleTableView
 from django_filters.views import FilterView
 from django.views.generic.detail import DetailView
+from django.apps import apps
 
 # Project imports
 #################
@@ -22,6 +23,19 @@ from .models import UserActivityLog
 
 User = get_user_model() # Use custom user model
 
+# Helper Function to log actions
+def log_user_action(request, instance, action, model_name):
+    UserActivityLog.objects.create(
+        user=request.user,
+        action=action,
+        model_name=model_name,
+        object_id=instance.pk,
+        number=instance.number if hasattr(instance, 'number') else '',
+        timestamp=timezone.now(),
+        ip_address=get_client_ip(request),
+        user_agent=request.META.get("HTTP_USER_AGENT", ""),
+    )
+
 #####################################################################
 
 # Function to recognize staff
@@ -48,7 +62,9 @@ class UserListView(LoginRequiredMixin, UserPassesTestMixin, FilterView, SingleTa
     def get_queryset(self):
         # Apply the filter and order by any logic you need
         qs = super().get_queryset().order_by('date_joined')
-        # Apply ordering here if needed, for example:
+        # Hide superuser entries from non-superusers
+        if not self.request.user.is_superuser:
+            qs = qs.exclude(is_superuser=True)
         return qs
 
     def get_context_data(self, **kwargs):
@@ -66,11 +82,11 @@ class UserListView(LoginRequiredMixin, UserPassesTestMixin, FilterView, SingleTa
 # Function for creating a new User
 @user_passes_test(is_staff)
 def create_user(request):
-    
     if request.method == "POST":
         form = CustomUserCreationForm(request.POST or None)
         if form.is_valid():
-            form.save()
+            user = form.save()
+            log_user_action(request, user, "CREATE", "مستخدم")
             return redirect("manage_users")
         else:
             return render(request, "users/user_form.html", {"form": form})
@@ -89,7 +105,8 @@ def edit_user(request, pk):
     if request.method == "POST":
         form = CustomUserChangeForm(request.POST, instance=user)
         if form.is_valid():
-            form.save()
+            user = form.save()
+            log_user_action(request, user, "UPDATE", "مستخدم")
             return redirect("manage_users")
         else:
             # Validation errors will be automatically handled by the form object
@@ -106,17 +123,8 @@ def edit_user(request, pk):
 def delete_user(request, pk):
     user = get_object_or_404(User, pk=pk)
     if request.method == "POST":
+        log_user_action(request, user, "DELETE", "مستخدم")
         user.delete()
-        UserActivityLog.objects.create(
-            user=request.user,
-            action="DELETE",
-            model_name='مستخدم',
-            object_id=user.pk,
-            number=user.username,  # Save the relevant number
-            timestamp=timezone.now(),
-            ip_address=get_client_ip(request),  # Assuming you have this function
-            user_agent=request.META.get("HTTP_USER_AGENT", ""),
-        )
         return redirect("manage_users")
     return redirect("manage_users")  # Redirect instead of rendering a separate page
 
@@ -172,10 +180,11 @@ def reset_password(request, pk):
         form = ResetPasswordForm(user=user, data=request.POST)  # ✅ Correct usage with SetPasswordForm
         if form.is_valid():
             form.save()
-            return redirect("manage_users")  # Redirect after successful reset
+            log_user_action(request, user, "RESET", "رمز سري")
+            return redirect("manage_users")
         else:
-            print("Form errors:", form.errors)  # Debugging
-            return redirect("edit_user", pk=pk)  # Redirect to edit user on failure
+            print("Form errors:", form.errors)
+            return redirect("edit_user", pk=pk)
     
     return redirect("manage_users")  # Fallback redirect
 
@@ -189,6 +198,7 @@ def user_profile(request):
         password_form = ArabicPasswordChangeForm(user, request.POST)
         if password_form.is_valid():
             password_form.save()
+            log_user_action(request, user, "UPDATE", "رمز سري")
             update_session_auth_hash(request, password_form.user)  # Prevent user from being logged out
             messages.success(request, 'تم تغيير كلمة المرور بنجاح!')
             return redirect('user_profile')
@@ -206,10 +216,17 @@ def user_profile(request):
 # Function for editing the user profile
 @login_required
 def edit_profile(request):
+
+    # 🚫 Block staff users from editing superuser accounts
+    if request.user.is_superuser and not request.user.is_superuser:
+        messages.error(request, "لا يمكنك تعديل حساب المدير!")
+        return redirect('user_profile')
+
     if request.method == 'POST':
         form = UserProfileEditForm(request.POST, request.FILES, instance=request.user)
         if form.is_valid():
-            form.save()
+            user = form.save()
+            log_user_action(request, user, "UPDATE", "بيانات شخصية")
             messages.success(request, 'تم حفظ التغييرات بنجاح')
             return redirect('user_profile')
         else: