151 lines
4.0 KiB
Markdown
151 lines
4.0 KiB
Markdown
# PX Source User - Strict Access Control
|
|
|
|
## Overview
|
|
|
|
PX Source Users have **STRICT LIMITED ACCESS** to the system. They can ONLY access:
|
|
1. `/px-sources/*` pages (their dedicated portal)
|
|
2. Password change page
|
|
3. Basic settings page
|
|
4. Logout
|
|
|
|
**ALL other URLs are blocked and redirected to `/px-sources/dashboard/`**
|
|
|
|
---
|
|
|
|
## Implementation
|
|
|
|
### 1. Middleware (`apps/px_sources/middleware.py`)
|
|
|
|
```python
|
|
class SourceUserRestrictionMiddleware:
|
|
"""
|
|
STRICT middleware that restricts source users to ONLY:
|
|
1. /px-sources/* pages
|
|
2. Password change
|
|
3. Settings
|
|
4. Logout
|
|
"""
|
|
|
|
ALLOWED_PATH_PREFIXES = ['/px-sources/']
|
|
ALLOWED_URL_NAMES = {
|
|
'accounts:password_change',
|
|
'accounts:settings',
|
|
'accounts:logout',
|
|
'accounts:login',
|
|
}
|
|
```
|
|
|
|
### 2. Settings Configuration
|
|
|
|
Added to `config/settings/base.py`:
|
|
```python
|
|
MIDDLEWARE = [
|
|
...
|
|
'apps.px_sources.middleware.SourceUserRestrictionMiddleware',
|
|
...
|
|
]
|
|
```
|
|
|
|
### 3. View-Level Enforcement
|
|
|
|
Updated views to redirect source users:
|
|
- `CommandCenterView.dispatch()` - redirects to `/px-sources/dashboard/`
|
|
- `my_dashboard()` - redirects to `/px-sources/dashboard/`
|
|
- `@block_source_user` decorator - redirects to `/px-sources/dashboard/`
|
|
|
|
---
|
|
|
|
## Allowed URLs for Source Users
|
|
|
|
| URL | Access | Description |
|
|
|-----|--------|-------------|
|
|
| `/px-sources/dashboard/` | ✅ | Source User Dashboard |
|
|
| `/px-sources/complaints/` | ✅ | List their complaints |
|
|
| `/px-sources/complaints/new/` | ✅ | Create new complaint |
|
|
| `/px-sources/inquiries/` | ✅ | List their inquiries |
|
|
| `/px-sources/inquiries/new/` | ✅ | Create new inquiry |
|
|
| `/accounts/password/change/` | ✅ | Change password |
|
|
| `/accounts/settings/` | ✅ | Basic settings |
|
|
| `/accounts/logout/` | ✅ | Logout |
|
|
| `/static/*` | ✅ | Static files (CSS/JS) |
|
|
| `/media/*` | ✅ | Media files |
|
|
| `/i18n/*` | ✅ | Language switching |
|
|
|
|
---
|
|
|
|
## Blocked URLs (Redirected to `/px-sources/dashboard/`)
|
|
|
|
| URL | Blocked | Behavior |
|
|
|-----|---------|----------|
|
|
| `/` | ✅ | Redirected |
|
|
| `/dashboard/my/` | ✅ | Redirected |
|
|
| `/dashboard/admin-evaluation/` | ✅ | Redirected |
|
|
| `/analytics/*` | ✅ | Redirected |
|
|
| `/surveys/*` | ✅ | Redirected |
|
|
| `/complaints/` | ✅ | Redirected |
|
|
| `/complaints/inquiries/` | ✅ | Redirected |
|
|
| `/organizations/*` | ✅ | Redirected |
|
|
| `/config/*` | ✅ | Redirected |
|
|
| `/actions/*` | ✅ | Redirected |
|
|
| `/physicians/*` | ✅ | Redirected |
|
|
| `/px-sources/` (admin pages) | ✅ | Redirected |
|
|
| `/px-sources/new/` | ✅ | Redirected |
|
|
| `/px-sources/<id>/edit/` | ✅ | Redirected |
|
|
|
|
---
|
|
|
|
## Testing
|
|
|
|
### Test Cases
|
|
|
|
1. **Login as Source User**
|
|
- Visit: `/`
|
|
- Expected: Redirected to `/px-sources/dashboard/`
|
|
|
|
2. **Try to access Command Center**
|
|
- Visit: `/dashboard/my/`
|
|
- Expected: Redirected to `/px-sources/dashboard/`
|
|
|
|
3. **Try to access Surveys**
|
|
- Visit: `/surveys/`
|
|
- Expected: Redirected to `/px-sources/dashboard/`
|
|
|
|
4. **Try to access Staff**
|
|
- Visit: `/organizations/staff/`
|
|
- Expected: Redirected to `/px-sources/dashboard/`
|
|
|
|
5. **Access Source User Portal**
|
|
- Visit: `/px-sources/dashboard/`
|
|
- Expected: ✅ Works!
|
|
|
|
6. **Access Password Change**
|
|
- Visit: `/accounts/password/change/`
|
|
- Expected: ✅ Works!
|
|
|
|
7. **Create Complaint**
|
|
- Visit: `/px-sources/complaints/new/`
|
|
- Expected: ✅ Works!
|
|
|
|
---
|
|
|
|
## Security Notes
|
|
|
|
1. **Middleware runs on EVERY request** - Cannot be bypassed
|
|
2. **No error messages** - Silent redirect for better UX
|
|
3. **Whitelist approach** - Only explicitly allowed URLs work
|
|
4. **Superusers excluded** - Superusers bypass all restrictions
|
|
5. **Static files allowed** - Required for CSS/JS to work
|
|
|
|
---
|
|
|
|
## Files Modified
|
|
|
|
1. `apps/px_sources/middleware.py` - Updated `SourceUserRestrictionMiddleware`
|
|
2. `config/settings/base.py` - Added middleware to MIDDLEWARE list
|
|
3. `apps/dashboard/views.py` - Added redirects in views
|
|
4. `apps/core/decorators.py` - Updated `@block_source_user` decorator
|
|
|
|
---
|
|
|
|
**Last Updated**: 2026-02-25
|