from django.core.mail import send_mail, EmailMultiAlternatives from django.template import context from django.template.loader import render_to_string from django.utils.html import strip_tags from rest_framework.exceptions import ValidationError from rest_framework.permissions import IsAuthenticated from django.contrib.auth import get_user_model from rest_framework import viewsets, status from rest_framework.decorators import action from rest_framework.response import Response from rest_framework.views import APIView from rest_framework_simplejwt.tokens import RefreshToken from django.shortcuts import get_object_or_404 from accounts.models import Membership, Role, DocumentTemplate, AdminTenantMessage from accounts.permissions import IsPlatformSuperAdmin, IsTenantAdminOrSuperAdmin from accounts.serializers import ( UserSerializer, UserCreateSerializer, MembershipSerializer, RoleSerializer, MembershipWriteSerializer, DocumentTemplateSerializer, AdminTenantMessageSerializer, ) from tenancy.models import Tenant from accounts.models import AuditLog, Membership, Role from accounts.serializers import AuditLogSerializer from rest_framework_simplejwt.token_blacklist.models import OutstandingToken, BlacklistedToken from .security_serializers import SessionSerializer User = get_user_model() class SuperAdminOnly(IsAuthenticated): def has_permission(self, request, view): ok = super().has_permission(request, view) return ok and bool(request.user and request.user.is_superuser) class UserViewSet(viewsets.ModelViewSet): """ Gestion des utilisateurs plateforme (super admin only). """ queryset = User.objects.prefetch_related("memberships__tenant").all().order_by("-id") permission_classes = [IsPlatformSuperAdmin] def get_serializer_class(self): if self.action == "create": return UserCreateSerializer return UserSerializer @action(detail=True, methods=["post"], url_path="reset-password") def reset_password(self, request, pk=None): """ POST /api/users/{id}/reset-password/ Body: { "password": "Good123" } Mot de passe souple (min 6 cars, pas de validateur Django). Positionne must_change_password=True. """ user = self.get_object() password = (request.data.get("password") or "").strip() if len(password) < 6: return Response( {"detail": "Le mot de passe doit contenir au moins 6 caractères."}, status=status.HTTP_400_BAD_REQUEST, ) user.set_password(password) user.is_active = True # réactive le compte si suspendu user.save(update_fields=["password", "is_active"]) # Applique must_change_password si la migration est en place try: user.must_change_password = True user.save(update_fields=["must_change_password"]) except Exception: pass # migration pas encore appliquée — ignoré AuditLog.objects.create( action="USER_PASSWORD_RESET", actor=request.user, entity_type="User", entity_id=user.id, entity_label=str(user), ) return Response({"detail": "Mot de passe réinitialisé. L'utilisateur devra le changer à la prochaine connexion."}) @action(detail=False, methods=["post"], url_path="change-password", permission_classes=[IsAuthenticated]) def change_password(self, request): """ POST /api/users/change-password/ Body: { "new_password": "...", "confirm_password": "..." } Accessible par n'importe quel utilisateur authentifié. Efface must_change_password après succès. """ user = request.user new_pwd = (request.data.get("new_password") or "").strip() confirm_pwd = (request.data.get("confirm_password") or "").strip() if len(new_pwd) < 8: return Response( {"detail": "Le nouveau mot de passe doit contenir au moins 8 caractères."}, status=status.HTTP_400_BAD_REQUEST, ) if new_pwd != confirm_pwd: return Response( {"detail": "Les mots de passe ne correspondent pas."}, status=status.HTTP_400_BAD_REQUEST, ) user.set_password(new_pwd) user.must_change_password = False user.save(update_fields=["password", "must_change_password"]) AuditLog.objects.create( action="USER_PASSWORD_CHANGED", actor=user, entity_type="User", entity_id=user.id, entity_label=str(user), ) return Response({"detail": "Mot de passe mis à jour avec succès."}) class RoleViewSet(viewsets.ReadOnlyModelViewSet): queryset = Role.objects.all().order_by("id") serializer_class = RoleSerializer permission_classes = [IsPlatformSuperAdmin] class TenantMembershipViewSet(viewsets.ViewSet): """ Endpoints: GET /api/tenants/{pk}/memberships/ POST /api/tenants/{pk}/memberships/ """ permission_classes = [IsTenantAdminOrSuperAdmin] def get_tenant(self, pk): return Tenant.objects.get(pk=pk) def list(self, request, pk=None): tenant = self.get_tenant(pk) qs = Membership.objects.filter(tenant=tenant).select_related("user").prefetch_related("roles") data = MembershipSerializer(qs, many=True).data return Response(data) def create(self, request, pk=None): tenant = self.get_tenant(pk) serializer = MembershipSerializer(data=request.data, context={"tenant": tenant}) serializer.is_valid(raise_exception=True) membership = serializer.save() return Response(MembershipSerializer(membership).data, status=status.HTTP_201_CREATED) @action(detail=False, methods=["patch"], url_path=r"(?P\d+)") def update_one(self, request, pk=None, membership_id=None): tenant = self.get_tenant(pk) m = Membership.objects.get(id=membership_id, tenant=tenant) roles = request.data.get("roles", None) # patch fields for field in ["status", "is_owner"]: if field in request.data: setattr(m, field, request.data[field]) m.save() if roles is not None: m.roles.set(Role.objects.filter(id__in=roles)) return Response(MembershipSerializer(m).data) @action(detail=False, methods=["delete"], url_path=r"(?P\d+)") def delete_one(self, request, pk=None, membership_id=None): tenant = self.get_tenant(pk) Membership.objects.filter(id=membership_id, tenant=tenant).delete() return Response(status=status.HTTP_204_NO_CONTENT) class SuperAdminOnly(IsAuthenticated): def has_permission(self, request, view): ok = super().has_permission(request, view) return ok and bool(request.user and request.user.is_superuser) class MembershipViewSet(viewsets.ModelViewSet): queryset = Membership.objects.select_related("tenant", "user").prefetch_related("roles").all() permission_classes = [IsAuthenticated] filterset_fields = ["tenant", "user", "status"] def get_serializer_class(self): if self.request.method in ("POST", "PUT", "PATCH"): return MembershipWriteSerializer return MembershipSerializer def create(self, request, *args, **kwargs): data = request.data.copy() # Tolérance: accepter tenant_id / user_id si front envoie ça if "tenant" not in data and "tenant_id" in data: data["tenant"] = data["tenant_id"] if "user" not in data and "user_id" in data: data["user"] = data["user_id"] if not data.get("tenant"): raise ValidationError({"tenant": "Champ requis. Envoyez tenant (id) ou utilisez tenant_id."}) if not data.get("user"): raise ValidationError({"user": "Champ requis. Envoyez user (id) ou utilisez user_id."}) serializer = MembershipWriteSerializer(data=data) serializer.is_valid(raise_exception=True) membership = serializer.save() return Response(MembershipSerializer(membership).data, status=201) class AuditLogViewSet(viewsets.ReadOnlyModelViewSet): queryset = AuditLog.objects.select_related("actor", "tenant") serializer_class = AuditLogSerializer permission_classes = [SuperAdminOnly] class SessionViewSet(viewsets.ViewSet): """ Endpoints: GET /api/sessions/ DELETE /api/sessions/{jti}/ POST /api/sessions/revoke-all/ """ permission_classes = [SuperAdminOnly] def list(self, request): # Outstanding refresh tokens non blacklisted blacklisted_ids = BlacklistedToken.objects.values_list("token_id", flat=True) qs = OutstandingToken.objects.exclude(id__in=blacklisted_ids).order_by("-created_at") # On expose une forme simple pour le front data = [] for tok in qs: data.append( { "id": tok.jti, "ip": None, "user_agent": None, "last_seen": tok.created_at, } ) return Response(SessionSerializer(data, many=True).data) def destroy(self, request, pk=None): # pk = jti try: tok = OutstandingToken.objects.get(jti=pk) except OutstandingToken.DoesNotExist: return Response({"detail": "Session not found."}, status=status.HTTP_404_NOT_FOUND) BlacklistedToken.objects.get_or_create(token=tok) # Audit AuditLog.objects.create( action="SESSION_REVOKE", actor=request.user, tenant=None, entity_type="OutstandingToken", entity_id=tok.id, entity_label=tok.jti, metadata={"user_id": tok.user_id}, ) return Response(status=status.HTTP_204_NO_CONTENT) @action(detail=False, methods=["post"], url_path="revoke-all") def revoke_all(self, request): blacklisted_ids = set(BlacklistedToken.objects.values_list("token_id", flat=True)) qs = OutstandingToken.objects.exclude(id__in=blacklisted_ids) count = 0 for tok in qs: BlacklistedToken.objects.get_or_create(token=tok) count += 1 AuditLog.objects.create( action="SESSION_REVOKE_ALL", actor=request.user, tenant=None, entity_type="OutstandingToken", entity_id=None, entity_label=None, metadata={"count": count}, ) return Response({"revoked": count}) class LogoutView(APIView): permission_classes = [IsAuthenticated] def post(self, request): try: refresh_token = request.data.get("refresh") token = RefreshToken(refresh_token) token.blacklist() except Exception: pass return Response(status=status.HTTP_204_NO_CONTENT) from django.conf import settings from django.conf import settings from django.core.mail import EmailMultiAlternatives from django.template.loader import render_to_string from django.utils.html import strip_tags from django.utils.timezone import now def testmail( subject="Test email ACX", template_name="emails/account_created.html", context=None, recipient_list=None, ): if not isinstance(subject, str): subject = str(subject) # évite que request casse le subject if context is None: context = { "full_name": "Issa PEROU", "login_url": "http://localhost:3000/login", "year": now().year, } if recipient_list is None: recipient_list = ["ngssalapel@gmail.com"] html_content = render_to_string(template_name, context) text_content = strip_tags(html_content) email = EmailMultiAlternatives( subject=subject, body=text_content, from_email=settings.DEFAULT_FROM_EMAIL, to=recipient_list, ) email.attach_alternative(html_content, "text/html") email.send(fail_silently=False) class PlatformInboxView(APIView): """GET /api/platform-messages/inbox/ — super admin : liste tous les threads tenants""" permission_classes = [SuperAdminOnly] def get(self, request): tenants = Tenant.objects.all().order_by("name") result = [] for tenant in tenants: qs = AdminTenantMessage.objects.filter(tenant=tenant) last = qs.last() unread = qs.filter(sender_side="tenant", is_read=False).count() result.append({ "tenant_id": tenant.id, "tenant_name": tenant.name, "tenant_slug": tenant.slug, "last_message": last.content[:120] if last else None, "last_message_at": last.created_at if last else None, "last_sender_side": last.sender_side if last else None, "unread": unread, }) result.sort(key=lambda x: ( 0 if x["unread"] > 0 else 1, -(x["last_message_at"].timestamp() if x["last_message_at"] else 0), )) return Response(result) class PlatformThreadView(APIView): """ GET /api/platform-messages/{tenant_id}/ — messages du thread POST /api/platform-messages/{tenant_id}/ — envoyer un message """ permission_classes = [IsAuthenticated] def _get_tenant_and_side(self, request, tenant_id): from rest_framework.exceptions import PermissionDenied tenant = get_object_or_404(Tenant, pk=tenant_id) if request.user.is_superuser: return tenant, "admin" if Membership.objects.filter(tenant=tenant, user=request.user).exists(): return tenant, "tenant" raise PermissionDenied() def get(self, request, tenant_id): tenant, side = self._get_tenant_and_side(request, tenant_id) opposite = "tenant" if side == "admin" else "admin" AdminTenantMessage.objects.filter( tenant=tenant, sender_side=opposite, is_read=False ).update(is_read=True) msgs = AdminTenantMessage.objects.filter(tenant=tenant).select_related("sender") return Response({ "tenant": {"id": tenant.id, "name": tenant.name, "slug": tenant.slug}, "messages": AdminTenantMessageSerializer(msgs, many=True).data, }) def post(self, request, tenant_id): tenant, side = self._get_tenant_and_side(request, tenant_id) content = (request.data.get("content") or "").strip() file = request.FILES.get("file") if not content and not file: return Response({"detail": "Le message ne peut pas être vide."}, status=400) msg = AdminTenantMessage.objects.create( tenant=tenant, sender=request.user, sender_side=side, content=content, file=file or None, ) return Response( AdminTenantMessageSerializer(msg, context={"request": request}).data, status=201, ) class PlatformMessageDeleteView(APIView): """DELETE /api/platform-messages/message/{msg_id}/ — supprime son propre message""" permission_classes = [IsAuthenticated] def delete(self, request, msg_id): from rest_framework.exceptions import PermissionDenied msg = get_object_or_404(AdminTenantMessage, pk=msg_id) if msg.sender != request.user: raise PermissionDenied() msg.delete() return Response(status=status.HTTP_204_NO_CONTENT) class PlatformUnreadView(APIView): """GET /api/platform-messages/unread/ — tenant : nb de messages non lus venant de l'admin""" permission_classes = [IsAuthenticated] def get(self, request): membership = Membership.objects.filter(user=request.user).select_related("tenant").first() if not membership: return Response({"unread": 0}) count = AdminTenantMessage.objects.filter( tenant=membership.tenant, sender_side="admin", is_read=False ).count() return Response({"unread": count}) class DocumentTemplateViewSet(viewsets.ModelViewSet): queryset = DocumentTemplate.objects.select_related("created_by").all() serializer_class = DocumentTemplateSerializer def get_permissions(self): if self.request.method in ("POST", "PUT", "PATCH", "DELETE"): return [SuperAdminOnly()] return [IsAuthenticated()] def get_serializer_context(self): ctx = super().get_serializer_context() ctx["request"] = self.request return ctx def perform_create(self, serializer): serializer.save(created_by=self.request.user) class AdminDocumentsStatsView(APIView): """ GET /api/admin-documents/ Statistiques globales des documents (super admin uniquement). """ permission_classes = [SuperAdminOnly] def get(self, request): from cases.models import CaseDocument from django.db.models import Count total = CaseDocument.objects.count() by_type = list( CaseDocument.objects .values("doc_type") .annotate(count=Count("id")) .order_by("-count") ) by_tenant_qs = ( CaseDocument.objects .values("case__tenant__id", "case__tenant__name") .annotate(count=Count("id")) .order_by("-count") ) by_tenant = [ { "tenant_id": r["case__tenant__id"], "tenant_name": r["case__tenant__name"] or "—", "count": r["count"], } for r in by_tenant_qs ] recent_qs = ( CaseDocument.objects .select_related("case", "case__tenant", "uploaded_by") .order_by("-created_at")[:20] ) recent = [ { "id": d.id, "title": d.title, "doc_type": d.doc_type, "case_reference": d.case.reference if d.case else "—", "tenant_name": d.case.tenant.name if d.case and d.case.tenant else "—", "uploaded_by": d.uploaded_by.username if d.uploaded_by else "—", "created_at": d.created_at, "file_url": request.build_absolute_uri(d.file.url) if d.file else None, } for d in recent_qs ] return Response({"total": total, "by_type": by_type, "by_tenant": by_tenant, "recent": recent}) # ------------------------------------------------------------------- # Platform Stats (super admin) # ------------------------------------------------------------------- from datetime import date, timedelta from django.db.models import Count, Sum, Q from django.db.models.functions import TruncMonth class SuperAdminOnly(IsAuthenticated): def has_permission(self, request, view): ok = super().has_permission(request, view) return ok and bool(request.user and request.user.is_superuser) class PlatformStatsView(APIView): permission_classes = [SuperAdminOnly] def get(self, request): from tenancy.models import Tenant from collections_management.models import CollectionCase, CollectionAction, Payment, PaymentPromise # Tenants tenants_total = Tenant.objects.count() tenants_active = Tenant.objects.filter(status="active").count() # Cases — all tenants cases = CollectionCase.objects.all() totals = cases.aggregate( total=Count("id"), total_paid=Sum("total_paid_amount"), principal=Sum("principal_amount"), interest=Sum("interest_amount"), penalty=Sum("penalty_amount"), fees=Sum("fees_amount"), overdue=Count("id", filter=Q( next_action_date__lt=date.today(), next_action_date__isnull=False, )), ) total_amount = float( (totals["principal"] or 0) + (totals["interest"] or 0) + (totals["penalty"] or 0) + (totals["fees"] or 0) ) total_paid = float(totals["total_paid"] or 0) recovery_rate = round(total_paid / total_amount * 100, 1) if total_amount > 0 else 0.0 by_status = [ {"status": s["status"], "count": s["count"]} for s in cases.values("status").annotate(count=Count("id")) ] # Top tenants by case count top_tenants = list( cases.values("tenant__name") .annotate(count=Count("id"), total_paid=Sum("total_paid_amount")) .order_by("-count")[:10] ) # Monthly payments — last 6 months six_months_ago = date.today().replace(day=1) - timedelta(days=150) payments_qs = Payment.objects.all() monthly = [ { "month": m["month"].strftime("%Y-%m"), "amount": float(m["amount"] or 0), "count": m["count"], } for m in ( payments_qs .filter(paid_at__date__gte=six_months_ago) .annotate(month=TruncMonth("paid_at")) .values("month") .annotate(amount=Sum("amount"), count=Count("id")) .order_by("month") ) ] by_method = [ {"method": p["method"], "count": p["count"], "amount": float(p["amount"] or 0)} for p in payments_qs.values("method").annotate(count=Count("id"), amount=Sum("amount")) ] # Actions by type by_action_type = [ {"type": a["action_type"], "count": a["count"]} for a in ( CollectionAction.objects .values("action_type") .annotate(count=Count("id")) .order_by("-count") ) ] return Response({ "tenants": { "total": tenants_total, "active": tenants_active, "suspended": tenants_total - tenants_active, }, "cases": { "total": totals["total"] or 0, "overdue": totals["overdue"] or 0, "total_amount": total_amount, "total_paid": total_paid, "recovery_rate": recovery_rate, "by_status": by_status, }, "payments": { "by_method": by_method, "monthly_trend": monthly, }, "actions": { "by_type": by_action_type, }, "top_tenants": [ { "name": t["tenant__name"] or "—", "count": t["count"], "total_paid": float(t["total_paid"] or 0), } for t in top_tenants ], }) # ------------------------------------------------------------------- # Integrations — Email, SMS, API Keys # ------------------------------------------------------------------- from accounts.models import SmsConfig, TenantApiKey from django.conf import settings as django_settings from django.core.mail import send_mail class IntegrationEmailStatusView(APIView): permission_classes = [SuperAdminOnly] def get(self, request): return Response({ "host": getattr(django_settings, "EMAIL_HOST", ""), "port": getattr(django_settings, "EMAIL_PORT", 587), "user": getattr(django_settings, "EMAIL_HOST_USER", ""), "use_tls": getattr(django_settings, "EMAIL_USE_TLS", True), "from": getattr(django_settings, "DEFAULT_FROM_EMAIL", ""), "is_configured": bool(getattr(django_settings, "EMAIL_HOST", "")), }) def post(self, request): """Envoyer un email de test à l'adresse fournie.""" to = request.data.get("to") or request.user.email if not to: return Response({"detail": "Adresse email de destination manquante."}, status=400) try: send_mail( subject="[ACX] Email de test", message="Ceci est un email de test envoyé depuis la plateforme ACX Collections.", from_email=getattr(django_settings, "DEFAULT_FROM_EMAIL", None), recipient_list=[to], fail_silently=False, ) return Response({"detail": f"Email envoyé à {to}."}) except Exception as e: return Response({"detail": str(e)}, status=500) class SmsConfigView(APIView): permission_classes = [SuperAdminOnly] def get(self, request): cfg = SmsConfig.get_or_create_singleton() return Response({ "provider": cfg.provider, "sender_id": cfg.sender_id, "api_key": "•" * 8 if cfg.api_key else "", "api_secret": "•" * 8 if cfg.api_secret else "", "is_active": cfg.is_active, "updated_at": cfg.updated_at, }) def put(self, request): cfg = SmsConfig.get_or_create_singleton() data = request.data cfg.provider = data.get("provider", cfg.provider) cfg.sender_id = data.get("sender_id", cfg.sender_id) if data.get("api_key") and not all(c == "•" for c in data["api_key"]): cfg.api_key = data["api_key"] if data.get("api_secret") and not all(c == "•" for c in data["api_secret"]): cfg.api_secret = data["api_secret"] cfg.is_active = data.get("is_active", cfg.is_active) cfg.updated_by = request.user cfg.save() return Response({"detail": "Configuration SMS mise à jour."}) class TenantApiKeyListView(APIView): permission_classes = [SuperAdminOnly] def get(self, request): tenant_id = request.query_params.get("tenant_id") qs = TenantApiKey.objects.select_related("tenant", "created_by") if tenant_id: qs = qs.filter(tenant_id=tenant_id) return Response([ { "id": k.id, "tenant_id": k.tenant_id, "tenant_name": k.tenant.name, "label": k.label, "key_prefix": k.key_prefix, "is_active": k.is_active, "created_by": k.created_by.username if k.created_by else "—", "last_used_at": k.last_used_at, "created_at": k.created_at, } for k in qs ]) def post(self, request): from tenancy.models import Tenant as TenantModel tenant_id = request.data.get("tenant_id") label = (request.data.get("label") or "").strip() if not tenant_id or not label: return Response({"detail": "tenant_id et label sont requis."}, status=400) try: tenant = TenantModel.objects.get(pk=tenant_id) except TenantModel.DoesNotExist: return Response({"detail": "Tenant introuvable."}, status=404) key_obj, raw_key = TenantApiKey.generate(tenant=tenant, label=label, created_by=request.user) return Response({ "id": key_obj.id, "tenant_id": key_obj.tenant_id, "label": key_obj.label, "key_prefix": key_obj.key_prefix, "raw_key": raw_key, # affiché UNE SEULE FOIS "is_active": key_obj.is_active, "created_at": key_obj.created_at, }, status=201) class TenantApiKeyDetailView(APIView): permission_classes = [SuperAdminOnly] def delete(self, request, pk): try: key = TenantApiKey.objects.get(pk=pk) except TenantApiKey.DoesNotExist: return Response({"detail": "Clé introuvable."}, status=404) key.is_active = False key.save(update_fields=["is_active"]) return Response({"detail": "Clé révoquée."}) # ------------------------------------------------------------------- # Platform Settings (super admin) # ------------------------------------------------------------------- class PlatformSettingsView(APIView): permission_classes = [SuperAdminOnly] def get(self, request): from accounts.models import PlatformSettings cfg = PlatformSettings.get_or_create_singleton() return Response({ "platform_name": cfg.platform_name, "default_currency": cfg.default_currency, "default_language": cfg.default_language, "timezone": cfg.timezone, "support_email": cfg.support_email, "updated_at": cfg.updated_at, }) def put(self, request): from accounts.models import PlatformSettings cfg = PlatformSettings.get_or_create_singleton() data = request.data cfg.platform_name = data.get("platform_name", cfg.platform_name) cfg.default_currency = data.get("default_currency", cfg.default_currency) cfg.default_language = data.get("default_language", cfg.default_language) cfg.timezone = data.get("timezone", cfg.timezone) cfg.support_email = data.get("support_email", cfg.support_email) cfg.updated_by = request.user cfg.save() return Response({"detail": "Paramètres mis à jour."})