105 lines
3.5 KiB
Python
105 lines
3.5 KiB
Python
from typing import List, Optional
|
|
from sqlalchemy.orm import Session
|
|
from app.models.ppr import User
|
|
from app.schemas.ppr import UserCreate, UserUpdate
|
|
from app.core.security import get_password_hash, verify_password
|
|
from app.models.journal import EntityType
|
|
from app.crud.crud_journal import journal
|
|
|
|
|
|
class CRUDUser:
|
|
def get(self, db: Session, user_id: int) -> Optional[User]:
|
|
return db.query(User).filter(User.id == user_id).first()
|
|
|
|
def get_by_username(self, db: Session, username: str) -> Optional[User]:
|
|
return db.query(User).filter(User.username == username).first()
|
|
|
|
def get_multi(self, db: Session, skip: int = 0, limit: int = 100) -> List[User]:
|
|
return db.query(User).offset(skip).limit(limit).all()
|
|
|
|
def create(self, db: Session, obj_in: UserCreate, admin_user: str = "system") -> User:
|
|
hashed_password = get_password_hash(obj_in.password)
|
|
db_obj = User(
|
|
username=obj_in.username,
|
|
password=hashed_password,
|
|
role=obj_in.role
|
|
)
|
|
db.add(db_obj)
|
|
db.commit()
|
|
db.refresh(db_obj)
|
|
|
|
# Log user creation in journal
|
|
journal.log_change(
|
|
db,
|
|
EntityType.USER,
|
|
db_obj.id,
|
|
f"User created: {obj_in.username} with role {obj_in.role}",
|
|
admin_user,
|
|
None
|
|
)
|
|
|
|
return db_obj
|
|
|
|
def update(self, db: Session, db_obj: User, obj_in: UserUpdate, admin_user: str = "system") -> User:
|
|
update_data = obj_in.dict(exclude_unset=True)
|
|
changes = []
|
|
if "password" in update_data:
|
|
update_data["password"] = get_password_hash(update_data["password"])
|
|
changes.append("password changed")
|
|
for field, value in update_data.items():
|
|
old_value = getattr(db_obj, field)
|
|
if field == "password" or old_value != value:
|
|
if field != "password": # Don't log actual password values
|
|
changes.append(f"{field} changed from '{old_value}' to '{value}'")
|
|
setattr(db_obj, field, value)
|
|
db.add(db_obj)
|
|
db.commit()
|
|
db.refresh(db_obj)
|
|
|
|
# Log user update in journal
|
|
if changes:
|
|
journal.log_change(
|
|
db,
|
|
EntityType.USER,
|
|
db_obj.id,
|
|
"; ".join(changes),
|
|
admin_user,
|
|
None
|
|
)
|
|
|
|
return db_obj
|
|
|
|
def authenticate(self, db: Session, username: str, password: str) -> Optional[User]:
|
|
user = self.get_by_username(db, username=username)
|
|
if not user:
|
|
return None
|
|
if not verify_password(password, user.password):
|
|
return None
|
|
return user
|
|
|
|
def is_active(self, user: User) -> bool:
|
|
# For future use if we add user status
|
|
return True
|
|
|
|
def change_password(self, db: Session, db_obj: User, new_password: str, admin_user: str = "system") -> User:
|
|
"""Change a user's password (typically used by admins to reset another user's password)"""
|
|
hashed_password = get_password_hash(new_password)
|
|
db_obj.password = hashed_password
|
|
db.add(db_obj)
|
|
db.commit()
|
|
db.refresh(db_obj)
|
|
|
|
# Log password change in journal (security audit)
|
|
journal.log_change(
|
|
db,
|
|
EntityType.USER,
|
|
db_obj.id,
|
|
f"Password changed by {admin_user}",
|
|
admin_user,
|
|
None
|
|
)
|
|
|
|
return db_obj
|
|
|
|
|
|
user = CRUDUser() |