97 lines
3.5 KiB
Python
97 lines
3.5 KiB
Python
from datetime import datetime
|
||
from app.extensions import db
|
||
|
||
|
||
class User(db.Model):
|
||
"""
|
||
Tracked employees / users of IT assets.
|
||
|
||
Privacy / GDPR masking:
|
||
When a user leaves the company, an admin can mask the record.
|
||
All PII fields are cleared and replaced with a reference to the
|
||
permanent windows_id so asset history is preserved without
|
||
exposing personal data during audits.
|
||
"""
|
||
__tablename__ = 'users'
|
||
|
||
id = db.Column(db.Integer, primary_key=True)
|
||
|
||
# Permanent, non-PII identifier — used as the anchor for history after masking
|
||
windows_id = db.Column(db.String(50), unique=True, nullable=False, index=True)
|
||
|
||
# PII fields — nulled out when masked
|
||
first_name = db.Column(db.String(100), nullable=True)
|
||
last_name = db.Column(db.String(100), nullable=True)
|
||
email = db.Column(db.String(200), nullable=True)
|
||
phone = db.Column(db.String(50), nullable=True)
|
||
|
||
# Non-PII organisational data — retained after masking
|
||
department = db.Column(db.String(100), nullable=True)
|
||
job_title = db.Column(db.String(100), nullable=True)
|
||
location = db.Column(db.String(100), nullable=True)
|
||
manager_windows_id = db.Column(db.String(50), nullable=True)
|
||
|
||
# Status
|
||
is_active = db.Column(db.Boolean, default=True) # employed / active in company
|
||
is_masked = db.Column(db.Boolean, default=False) # PII erased
|
||
|
||
masked_at = db.Column(db.DateTime, nullable=True)
|
||
masked_by_id = db.Column(db.Integer, db.ForeignKey('admin_users.id'), nullable=True)
|
||
|
||
# Import metadata
|
||
import_source = db.Column(db.String(20), default='manual') # manual | ldap | csv
|
||
ldap_dn = db.Column(db.String(500), nullable=True) # AD Distinguished Name
|
||
|
||
created_at = db.Column(db.DateTime, default=datetime.utcnow)
|
||
updated_at = db.Column(db.DateTime, default=datetime.utcnow, onupdate=datetime.utcnow)
|
||
|
||
# Relationships
|
||
assignments = db.relationship(
|
||
'Assignment', foreign_keys='Assignment.user_id',
|
||
backref='user', lazy='dynamic', cascade='all, delete-orphan'
|
||
)
|
||
paperwork_docs = db.relationship(
|
||
'Paperwork', foreign_keys='Paperwork.user_id',
|
||
backref='user', lazy='dynamic', cascade='all, delete-orphan'
|
||
)
|
||
masked_by = db.relationship('AdminUser', foreign_keys=[masked_by_id])
|
||
|
||
# ------------------------------------------------------------------
|
||
# Display helpers
|
||
# ------------------------------------------------------------------
|
||
|
||
@property
|
||
def display_name(self):
|
||
if self.is_masked:
|
||
return f'[MASKED – WID: {self.windows_id}]'
|
||
parts = [self.first_name, self.last_name]
|
||
full = ' '.join(p for p in parts if p)
|
||
return full or self.windows_id
|
||
|
||
@property
|
||
def display_email(self):
|
||
return '[MASKED]' if self.is_masked else (self.email or '—')
|
||
|
||
@property
|
||
def display_phone(self):
|
||
return '[MASKED]' if self.is_masked else (self.phone or '—')
|
||
|
||
@property
|
||
def current_assets(self):
|
||
"""Returns active assignments."""
|
||
return self.assignments.filter_by(is_active=True).all()
|
||
|
||
def mask(self, admin_user_id):
|
||
"""Erase PII while preserving the record for asset-history purposes."""
|
||
self.first_name = None
|
||
self.last_name = None
|
||
self.email = None
|
||
self.phone = None
|
||
self.is_active = False
|
||
self.is_masked = True
|
||
self.masked_at = datetime.utcnow()
|
||
self.masked_by_id = admin_user_id
|
||
|
||
def __repr__(self):
|
||
return f'<User wid={self.windows_id} masked={self.is_masked}>'
|