From 83a8f79c361d06a7527328c8f31f7290d233acd3 Mon Sep 17 00:00:00 2001
From: ske087 <ske087@gitea.moto-adv.com>
Date: Thu, 9 Jul 2026 01:04:00 +0300
Subject: [PATCH] IT Assets: make GDPR Mask function discoverable from users
 list

- Users list: add eye-slash icon button per unmasked row (editor+ only)
  clicking opens a compact confirmation modal inline in the list
- User detail: gate Edit / Assign / Mask buttons behind is_editor check
  (button was shown to all but route already blocked readonly users)
---
 .../app/templates/users/detail.html           |  2 +-
 .../app/templates/users/index.html            | 31 +++++++++++++++++++
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/IT_asset_management/app/templates/users/detail.html b/IT_asset_management/app/templates/users/detail.html
index 757c8c3..fe59b93 100644
--- a/IT_asset_management/app/templates/users/detail.html
+++ b/IT_asset_management/app/templates/users/detail.html
@@ -14,7 +14,7 @@
     {% if user.is_masked %}<span class="badge badge-masked fs-6 align-middle ms-2">MASKED</span>{% endif %}
   </h1>
   <div class="d-flex gap-2">
-    {% if not user.is_masked %}
+    {% if not user.is_masked and current_user.is_editor %}
     <a href="{{ url_for('users.edit', user_id=user.id) }}" class="btn btn-sm btn-outline-primary">
       <i class="bi bi-pencil me-1"></i>Edit
     </a>
diff --git a/IT_asset_management/app/templates/users/index.html b/IT_asset_management/app/templates/users/index.html
index c4095fc..dfc9026 100644
--- a/IT_asset_management/app/templates/users/index.html
+++ b/IT_asset_management/app/templates/users/index.html
@@ -83,6 +83,37 @@
             <a href="{{ url_for('users.detail', user_id=u.id) }}" class="btn btn-sm btn-outline-secondary py-0 px-2">
               <i class="bi bi-eye"></i>
             </a>
+            {% if not u.is_masked and current_user.is_editor %}
+            <button class="btn btn-sm btn-outline-danger py-0 px-2 ms-1"
+                    title="GDPR Mask — permanently erase PII"
+                    data-bs-toggle="modal"
+                    data-bs-target="#maskModal{{ u.id }}">
+              <i class="bi bi-eye-slash"></i>
+            </button>
+            <!-- Mask modal for list row -->
+            <div class="modal fade" id="maskModal{{ u.id }}" tabindex="-1">
+              <div class="modal-dialog modal-sm">
+                <div class="modal-content">
+                  <div class="modal-header border-0 pb-0">
+                    <h6 class="modal-title text-danger"><i class="bi bi-eye-slash me-1"></i>Mask User</h6>
+                    <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
+                  </div>
+                  <div class="modal-body">
+                    <p class="mb-1">Permanently erase all PII for <strong>{{ u.display_name }}</strong>?</p>
+                    <p class="small text-muted mb-0">Name, email and phone will be replaced with <em>[MASKED]</em>. Windows ID and asset history are kept. <strong>Cannot be undone.</strong></p>
+                  </div>
+                  <div class="modal-footer border-0 pt-0">
+                    <button type="button" class="btn btn-sm btn-secondary" data-bs-dismiss="modal">Cancel</button>
+                    <form method="POST" action="{{ url_for('users.mask', user_id=u.id) }}" class="d-inline">
+                      <button type="submit" class="btn btn-sm btn-danger">
+                        <i class="bi bi-eye-slash me-1"></i>Confirm
+                      </button>
+                    </form>
+                  </div>
+                </div>
+              </div>
+            </div>
+            {% endif %}
           </td>
         </tr>
         {% else %}