398 lines
13 KiB
Python
398 lines
13 KiB
Python
"""
|
|
Services for Staff management
|
|
"""
|
|
import secrets
|
|
import string
|
|
from django.contrib.auth import get_user_model
|
|
from django.template.loader import render_to_string
|
|
from django.conf import settings
|
|
from django.urls import reverse
|
|
from django.utils import timezone
|
|
|
|
from apps.core.services import AuditService
|
|
from apps.notifications.services import NotificationService
|
|
|
|
User = get_user_model()
|
|
|
|
|
|
class StaffService:
|
|
"""Service for managing staff user accounts"""
|
|
|
|
@staticmethod
|
|
def generate_username(staff):
|
|
"""
|
|
Generate a unique username from staff name.
|
|
Format: first.last (lowercase)
|
|
If duplicate exists, append number.
|
|
"""
|
|
base_username = f"{staff.first_name.lower()}.{staff.last_name.lower()}"
|
|
username = base_username
|
|
counter = 1
|
|
|
|
# Ensure uniqueness
|
|
while User.objects.filter(username=username).exists():
|
|
username = f"{base_username}{counter}"
|
|
counter += 1
|
|
|
|
return username
|
|
|
|
@staticmethod
|
|
def generate_password(length=12):
|
|
"""
|
|
Generate a secure random password.
|
|
"""
|
|
alphabet = string.ascii_letters + string.digits + string.punctuation
|
|
password = ''.join(secrets.choice(alphabet) for _ in range(length))
|
|
return password
|
|
|
|
@staticmethod
|
|
def create_user_for_staff(staff, role='staff', request=None):
|
|
"""
|
|
Create a User account for a Staff member.
|
|
If a user with the same email already exists, link it to the staff member instead.
|
|
|
|
Args:
|
|
staff: Staff instance
|
|
role: Role name to assign (default: 'staff')
|
|
request: HTTP request for audit logging
|
|
|
|
Returns:
|
|
tuple: (User instance, was_created: bool, password: str or None)
|
|
- was_created is True if a new user was created
|
|
- was_created is False if an existing user was linked
|
|
- password is the generated password for new users, None for linked users
|
|
|
|
Raises:
|
|
ValueError: If staff already has a user account or has no email
|
|
"""
|
|
if staff.user:
|
|
raise ValueError("Staff member already has a user account")
|
|
|
|
# Generate email (required for authentication)
|
|
if not staff.email:
|
|
raise ValueError("Staff member must have an email address")
|
|
|
|
# Check if user with this email already exists
|
|
existing_user = User.objects.filter(email=staff.email).first()
|
|
|
|
if existing_user:
|
|
# Link existing user to staff
|
|
staff.user = existing_user
|
|
staff.save(update_fields=['user'])
|
|
|
|
# Update user's organization data if not set
|
|
if not existing_user.hospital:
|
|
existing_user.hospital = staff.hospital
|
|
if not existing_user.department:
|
|
existing_user.department = staff.department
|
|
if not existing_user.employee_id:
|
|
existing_user.employee_id = staff.employee_id
|
|
existing_user.save(update_fields=['hospital', 'department', 'employee_id'])
|
|
|
|
# Assign role if not already assigned
|
|
from apps.accounts.models import Role as RoleModel
|
|
try:
|
|
role_obj = RoleModel.objects.get(name=role)
|
|
if not existing_user.groups.filter(id=role_obj.group.id).exists():
|
|
existing_user.groups.add(role_obj.group)
|
|
except RoleModel.DoesNotExist:
|
|
pass
|
|
|
|
# Log the action
|
|
if request:
|
|
AuditService.log_from_request(
|
|
event_type='other',
|
|
description=f"Existing user account linked to staff member {staff.get_full_name()}",
|
|
request=request,
|
|
content_object=existing_user,
|
|
metadata={
|
|
'staff_id': str(staff.id),
|
|
'staff_name': staff.get_full_name(),
|
|
'user_id': str(existing_user.id),
|
|
'action': 'linked_existing_user'
|
|
}
|
|
)
|
|
|
|
return existing_user, False, None # Existing user was linked, no password
|
|
|
|
# Create new user account
|
|
# Generate username (optional, for backward compatibility)
|
|
username = StaffService.generate_username(staff)
|
|
password = StaffService.generate_password()
|
|
|
|
# Create user - email is now the username field
|
|
# Note: create_user() already hashes the password, so no need to call set_password() separately
|
|
user = User.objects.create_user(
|
|
email=staff.email,
|
|
password=password,
|
|
first_name=staff.first_name,
|
|
last_name=staff.last_name,
|
|
username=username, # Optional field
|
|
employee_id=staff.employee_id,
|
|
hospital=staff.hospital,
|
|
department=staff.department,
|
|
is_active=True,
|
|
is_provisional=False
|
|
)
|
|
|
|
# Assign role
|
|
from apps.accounts.models import Role as RoleModel
|
|
try:
|
|
role_obj = RoleModel.objects.get(name=role)
|
|
user.groups.add(role_obj.group)
|
|
except RoleModel.DoesNotExist:
|
|
pass
|
|
|
|
# Link to staff
|
|
staff.user = user
|
|
staff.save(update_fields=['user'])
|
|
|
|
# Log the action
|
|
if request:
|
|
AuditService.log_from_request(
|
|
event_type='user_creation',
|
|
description=f"User account created for staff member {staff.get_full_name()}",
|
|
request=request,
|
|
content_object=user,
|
|
metadata={
|
|
'staff_id': str(staff.id),
|
|
'staff_name': staff.get_full_name(),
|
|
'role': role,
|
|
'action': 'created_new_user'
|
|
}
|
|
)
|
|
|
|
return user, True, password # New user was created with password
|
|
|
|
@staticmethod
|
|
def link_user_to_staff(staff, user_id, request=None):
|
|
"""
|
|
Link an existing User account to a Staff member.
|
|
|
|
Args:
|
|
staff: Staff instance
|
|
user_id: UUID of the user to link
|
|
request: HTTP request for audit logging
|
|
|
|
Returns:
|
|
Staff: Updated staff instance
|
|
|
|
Raises:
|
|
ValueError: If staff already has a user account or user not found
|
|
"""
|
|
if staff.user:
|
|
raise ValueError("Staff member already has a user account")
|
|
|
|
try:
|
|
user = User.objects.get(id=user_id)
|
|
except User.DoesNotExist:
|
|
raise ValueError("User not found")
|
|
|
|
# Link to staff
|
|
staff.user = user
|
|
staff.save(update_fields=['user'])
|
|
|
|
# Update user's organization data
|
|
if not user.hospital:
|
|
user.hospital = staff.hospital
|
|
if not user.department:
|
|
user.department = staff.department
|
|
if not user.employee_id:
|
|
user.employee_id = staff.employee_id
|
|
user.save(update_fields=['hospital', 'department', 'employee_id'])
|
|
|
|
# Log the action
|
|
if request:
|
|
AuditService.log_from_request(
|
|
event_type='other',
|
|
description=f"User {user.email} linked to staff member {staff.get_full_name()}",
|
|
request=request,
|
|
content_object=staff,
|
|
metadata={'user_id': str(user.id)}
|
|
)
|
|
|
|
return staff
|
|
|
|
@staticmethod
|
|
def unlink_user_from_staff(staff, request=None):
|
|
"""
|
|
Remove User account association from a Staff member.
|
|
|
|
Args:
|
|
staff: Staff instance
|
|
request: HTTP request for audit logging
|
|
|
|
Returns:
|
|
Staff: Updated staff instance
|
|
|
|
Raises:
|
|
ValueError: If staff has no user account
|
|
"""
|
|
if not staff.user:
|
|
raise ValueError("Staff member has no user account")
|
|
|
|
user = staff.user
|
|
staff.user = None
|
|
staff.save(update_fields=['user'])
|
|
|
|
# Log the action
|
|
if request:
|
|
AuditService.log_from_request(
|
|
event_type='other',
|
|
description=f"User {user.email} unlinked from staff member {staff.get_full_name()}",
|
|
request=request,
|
|
content_object=staff,
|
|
metadata={'user_id': str(user.id)}
|
|
)
|
|
|
|
return staff
|
|
|
|
@staticmethod
|
|
def send_credentials_email(staff, password, request=None):
|
|
"""
|
|
Send login credentials email to staff member using NotificationService.
|
|
|
|
Args:
|
|
staff: Staff instance
|
|
password: Generated password
|
|
request: HTTP request for building absolute URLs (optional)
|
|
"""
|
|
if not staff.email:
|
|
raise ValueError("Staff member has no email address")
|
|
|
|
user = staff.user
|
|
if not user:
|
|
raise ValueError("Staff member has no user account")
|
|
|
|
# Build login URL
|
|
if request:
|
|
login_url = request.build_absolute_uri(reverse('accounts:login'))
|
|
else:
|
|
from django.contrib.sites.models import Site
|
|
try:
|
|
site = Site.objects.get_current()
|
|
login_url = f"https://{site.domain}{reverse('accounts:login')}"
|
|
except:
|
|
login_url = settings.LOGIN_URL or '/accounts/login/'
|
|
|
|
# Render email content
|
|
context = {
|
|
'staff': staff,
|
|
'user': user,
|
|
'password': password,
|
|
'login_url': login_url,
|
|
}
|
|
|
|
subject = "Your PX360 Account Credentials"
|
|
html_message = render_to_string('organizations/emails/staff_credentials.html', context)
|
|
|
|
# Create plain text version
|
|
plain_message = f"""Welcome to PX360!
|
|
|
|
Dear {staff.get_full_name()},
|
|
|
|
Your PX360 account has been created successfully. Below are your login credentials:
|
|
|
|
Username: {user.username}
|
|
Password: {password}
|
|
Email: {staff.email}
|
|
|
|
Login URL: {login_url}
|
|
|
|
Security Notice: Please change your password after your first login for security purposes.
|
|
|
|
If you have any questions or need assistance, please contact your system administrator.
|
|
|
|
Best regards,
|
|
The PX360 Team
|
|
"""
|
|
|
|
# Send email using NotificationService
|
|
notification_log = NotificationService.send_email(
|
|
email=staff.email,
|
|
subject=subject,
|
|
message=plain_message,
|
|
html_message=html_message,
|
|
related_object=staff,
|
|
metadata={
|
|
'notification_type': 'staff_credentials',
|
|
'staff_id': str(staff.id),
|
|
'user_id': str(user.id),
|
|
'username': user.username
|
|
}
|
|
)
|
|
|
|
# Log the action
|
|
if request:
|
|
AuditService.log_from_request(
|
|
event_type='other',
|
|
description=f"Credentials email sent to {staff.email} for staff member {staff.get_full_name()}",
|
|
request=request,
|
|
content_object=staff,
|
|
metadata={
|
|
'notification_log_id': str(notification_log.id) if notification_log else None
|
|
}
|
|
)
|
|
|
|
return notification_log
|
|
|
|
@staticmethod
|
|
def reset_password_and_resend_credentials(staff, request=None):
|
|
"""
|
|
Reset user password and resend credentials email.
|
|
|
|
Args:
|
|
staff: Staff instance
|
|
request: HTTP request for building absolute URLs and audit logging
|
|
|
|
Returns:
|
|
tuple: (new_password: str, notification_log: NotificationLog)
|
|
|
|
Raises:
|
|
ValueError: If staff has no user account or no email
|
|
"""
|
|
if not staff.user:
|
|
raise ValueError("Staff member has no user account")
|
|
|
|
if not staff.email:
|
|
raise ValueError("Staff member has no email address")
|
|
|
|
# Generate new password
|
|
new_password = StaffService.generate_password()
|
|
|
|
# Reset password
|
|
staff.user.set_password(new_password)
|
|
staff.user.save(update_fields=['password'])
|
|
|
|
# Send credentials email
|
|
notification_log = StaffService.send_credentials_email(staff, new_password, request)
|
|
|
|
# Log the action
|
|
if request:
|
|
AuditService.log_from_request(
|
|
event_type='password_reset',
|
|
description=f"Password reset and credentials resent to {staff.email} for staff member {staff.get_full_name()}",
|
|
request=request,
|
|
content_object=staff,
|
|
metadata={
|
|
'user_id': str(staff.user.id),
|
|
'notification_log_id': str(notification_log.id) if notification_log else None
|
|
}
|
|
)
|
|
|
|
return new_password, notification_log
|
|
|
|
@staticmethod
|
|
def get_staff_type_role(staff_type):
|
|
"""
|
|
Map staff_type to role name.
|
|
Currently all staff get the 'staff' role.
|
|
"""
|
|
role_mapping = {
|
|
'physician': 'staff',
|
|
'nurse': 'staff',
|
|
'admin': 'staff',
|
|
'other': 'staff'
|
|
}
|
|
return role_mapping.get(staff_type, 'staff')
|