first commit

backend/apps/accounts/migrations/0001_initial.py

@@ -0,0 +1,55 @@
+# Generated by Django 5.2.17 on 2026-08-10 08:31
+
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ('auth', '0012_alter_user_first_name_max_length'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='User',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('password', models.CharField(max_length=128, verbose_name='password')),
+                ('last_login', models.DateTimeField(blank=True, null=True, verbose_name='last login')),
+                ('is_superuser', models.BooleanField(default=False, help_text='Designates that this user has all permissions without explicitly assigning them.', verbose_name='superuser status')),
+                ('user_name', models.CharField(max_length=30, unique=True)),
+                ('is_staff', models.BooleanField(default=False)),
+                ('is_active', models.BooleanField(default=True)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('updated_at', models.DateTimeField(auto_now=True)),
+                ('groups', models.ManyToManyField(blank=True, help_text='The groups this user belongs to. A user will get all permissions granted to each of their groups.', related_name='user_set', related_query_name='user', to='auth.group', verbose_name='groups')),
+                ('user_permissions', models.ManyToManyField(blank=True, help_text='Specific permissions for this user.', related_name='user_set', related_query_name='user', to='auth.permission', verbose_name='user permissions')),
+            ],
+            options={
+                'db_table': 'user_access',
+                'ordering': ['user_name'],
+            },
+        ),
+        migrations.CreateModel(
+            name='ApiKey',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('name', models.CharField(max_length=100)),
+                ('prefix', models.CharField(db_index=True, max_length=12)),
+                ('key_hash', models.CharField(max_length=64)),
+                ('is_active', models.BooleanField(default=True)),
+                ('last_used_at', models.DateTimeField(blank=True, null=True)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('updated_at', models.DateTimeField(auto_now=True)),
+                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='api_keys', to=settings.AUTH_USER_MODEL)),
+            ],
+            options={
+                'db_table': 'api_keys',
+                'ordering': ['-created_at'],
+            },
+        ),
+    ]

backend/apps/accounts/migrations/0002_erd_named_primary_keys.py

@@ -0,0 +1,16 @@
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("accounts", "0001_initial"),
+    ]
+
+    operations = [
+        migrations.RenameField(
+            model_name="user",
+            old_name="id",
+            new_name="user_id",
+        ),
+    ]

backend/apps/accounts/migrations/0003_user_status.py

@@ -0,0 +1,39 @@
+from django.db import migrations, models
+
+
+def backfill_user_status(apps, schema_editor):
+    User = apps.get_model("accounts", "User")
+    for user in User.objects.all():
+        if user.is_superuser:
+            status = "superadmin"
+            flags = {"is_active": True, "is_staff": True, "is_superuser": True}
+        elif not user.is_active:
+            status = "inactive"
+            flags = {"is_active": False, "is_staff": False, "is_superuser": False}
+        else:
+            status = "active"
+            flags = {"is_active": True, "is_staff": False, "is_superuser": False}
+        User.objects.filter(pk=user.pk).update(status=status, **flags)
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("accounts", "0002_erd_named_primary_keys"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="user",
+            name="status",
+            field=models.CharField(
+                choices=[
+                    ("active", "Active"),
+                    ("inactive", "Inactive"),
+                    ("superadmin", "Super Admin"),
+                ],
+                default="active",
+                max_length=30,
+            ),
+        ),
+        migrations.RunPython(backfill_user_status, migrations.RunPython.noop),
+    ]

backend/apps/accounts/migrations/0004_sync_status_flags.py

@@ -0,0 +1,29 @@
+from django.db import migrations
+
+
+def sync_status_flags(apps, schema_editor):
+    User = apps.get_model("accounts", "User")
+    for user in User.objects.all():
+        if user.status == "inactive":
+            user.is_active = False
+            user.is_staff = False
+            user.is_superuser = False
+        elif user.status == "superadmin":
+            user.is_active = True
+            user.is_staff = False
+            user.is_superuser = True
+        else:
+            user.is_active = True
+            user.is_superuser = False
+        user.save(update_fields=["is_active", "is_staff", "is_superuser", "updated_at"])
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("accounts", "0003_user_status"),
+    ]
+
+    operations = [
+        migrations.RunPython(sync_status_flags, migrations.RunPython.noop),
+    ]

backend/apps/accounts/migrations/0005_executive_roles.py

@@ -0,0 +1,45 @@
+from django.db import migrations, models
+
+
+def migrate_legacy_statuses(apps, schema_editor):
+    User = apps.get_model("accounts", "User")
+    for user in User.objects.all():
+        if user.status == "superadmin":
+            new_status = "director_admin"
+            flags = {"is_active": True, "is_staff": True, "is_superuser": True}
+        elif user.status == "active":
+            new_status = "gm"
+            flags = {"is_active": True, "is_staff": False, "is_superuser": False}
+        elif user.status == "inactive":
+            new_status = "inactive"
+            flags = {"is_active": False, "is_staff": False, "is_superuser": False}
+        else:
+            continue
+        User.objects.filter(pk=user.pk).update(status=new_status, **flags)
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("accounts", "0004_sync_status_flags"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="user",
+            name="status",
+            field=models.CharField(
+                choices=[
+                    ("inactive", "Inactive"),
+                    ("gm", "GM"),
+                    ("gm_admin", "GM Admin"),
+                    ("buh", "BUH"),
+                    ("bu_admin", "BU Admin"),
+                    ("director", "Director"),
+                    ("director_admin", "Director Admin"),
+                ],
+                default="gm",
+                max_length=30,
+            ),
+        ),
+        migrations.RunPython(migrate_legacy_statuses, migrations.RunPython.noop),
+    ]

backend/apps/accounts/migrations/0006_user_managed_by.py

@@ -0,0 +1,26 @@
+# Generated for HQ visibility scoping
+
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("accounts", "0005_executive_roles"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="user",
+            name="managed_by",
+            field=models.ForeignKey(
+                blank=True,
+                limit_choices_to={"status__in": ("buh", "bu_admin")},
+                null=True,
+                on_delete=django.db.models.deletion.SET_NULL,
+                related_name="managed_gms",
+                to=settings.AUTH_USER_MODEL,
+            ),
+        ),
+    ]

backend/apps/accounts/migrations/0007_user_managed_by_pending.py

@@ -0,0 +1,28 @@
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("accounts", "0006_user_managed_by"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="user",
+            name="managed_by_pending",
+            field=models.ForeignKey(
+                blank=True,
+                limit_choices_to={"status__in": ("buh", "bu_admin")},
+                null=True,
+                on_delete=django.db.models.deletion.SET_NULL,
+                related_name="pending_managed_gms",
+                to="accounts.user",
+            ),
+        ),
+        migrations.AddField(
+            model_name="user",
+            name="managed_by_requested_at",
+            field=models.DateTimeField(blank=True, null=True),
+        ),
+    ]

backend/apps/accounts/migrations/0008_alter_managed_by_pending_buh_only.py

@@ -0,0 +1,25 @@
+# Generated manually for managed_by_pending BUH-only limit
+
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("accounts", "0007_user_managed_by_pending"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="user",
+            name="managed_by_pending",
+            field=models.ForeignKey(
+                blank=True,
+                limit_choices_to={"status": "buh"},
+                null=True,
+                on_delete=django.db.models.deletion.SET_NULL,
+                related_name="pending_managed_gms",
+                to="accounts.user",
+            ),
+        ),
+    ]

backend/apps/accounts/migrations/0009_account_admin_status.py

@@ -0,0 +1,30 @@
+# Generated manually for account_admin status
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("accounts", "0008_alter_managed_by_pending_buh_only"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="user",
+            name="status",
+            field=models.CharField(
+                choices=[
+                    ("inactive", "Inactive"),
+                    ("gm", "GM"),
+                    ("gm_admin", "GM Admin"),
+                    ("buh", "BUH"),
+                    ("bu_admin", "BU Admin"),
+                    ("director", "Director"),
+                    ("director_admin", "Director Admin"),
+                    ("account_admin", "Account Admin"),
+                ],
+                default="gm",
+                max_length=30,
+            ),
+        ),
+    ]

backend/apps/accounts/migrations/0010_remove_is_staff_decouple_director_admin.py

@@ -0,0 +1,22 @@
+from django.db import migrations
+
+
+def strip_director_admin_superuser(apps, schema_editor):
+    User = apps.get_model("accounts", "User")
+    User.objects.filter(status="director_admin", is_superuser=True).update(
+        is_superuser=False
+    )
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("accounts", "0009_account_admin_status"),
+    ]
+
+    operations = [
+        migrations.RunPython(strip_director_admin_superuser, migrations.RunPython.noop),
+        migrations.RemoveField(
+            model_name="user",
+            name="is_staff",
+        ),
+    ]

backend/apps/accounts/migrations/0011_superuser_status.py

@@ -0,0 +1,39 @@
+from django.db import migrations, models
+
+
+def migrate_break_glass_to_superuser_status(apps, schema_editor):
+    User = apps.get_model("accounts", "User")
+    User.objects.filter(is_superuser=True).exclude(status="inactive").update(
+        status="superuser"
+    )
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("accounts", "0010_remove_is_staff_decouple_director_admin"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="user",
+            name="status",
+            field=models.CharField(
+                choices=[
+                    ("inactive", "Inactive"),
+                    ("gm", "GM"),
+                    ("gm_admin", "GM Admin"),
+                    ("buh", "BUH"),
+                    ("bu_admin", "BU Admin"),
+                    ("director", "Director"),
+                    ("director_admin", "Director Admin"),
+                    ("account_admin", "Account Admin"),
+                    ("superuser", "Superuser"),
+                ],
+                default="gm",
+                max_length=30,
+            ),
+        ),
+        migrations.RunPython(
+            migrate_break_glass_to_superuser_status, migrations.RunPython.noop
+        ),
+    ]