patrick
06bb1c1664
FZA Einzelstunden:
- Absence.fza_hours (Numeric 5,2) — FZA in Stunden statt Tagen
- Migration 0032: fza_hours Spalte in absences
- AbsenceCreate/AbsenceOut Schema um fza_hours erweitert
- absence_service: _deduct/_refund_overtime nutzt fza_hours direkt wenn gesetzt
- Frontend: Tage/Stunden-Toggle im FZA-Antrag-Modal
Security K-1: Privilege Escalation via PATCH /users/{id}.role
- user_service: Whitelist für Rollenänderungen, SUPER_ADMIN nur durch SUPER_ADMIN
- Letzter COMPANY_ADMIN gegen Selbst-Demotion gesichert
Security K-2: Kiosk-IP-Whitelist hinter nginx
- kiosk_security: _get_client_ip() liest X-Real-IP statt request.client.host
Security K-3: Kiosk-PIN Brute-Force-Schutz
- kiosk_auth_service: Redis-Lockout nach 5 Fehlversuchen (15 min)
Security K-4: TOTP-Setup-Hijacking
- auth router: /totp/setup abgelehnt wenn TOTP bereits aktiv
Security K-5: Separater Fernet-Key
- config: SECRET_KEY_DATA Feld (optional, Fallback auf SECRET_KEY)
- crypto: get_fernet_key() mit Warning bei fehlendem SECRET_KEY_DATA
Security H-2: Vacation Balance nur HR/Admin
- absences router: PATCH /balance nur noch HR/COMPANY_ADMIN/SUPER_ADMIN + AuditLog
Security H-3: Rate-Limits auf /auth/refresh + /auth/logout
- auth router: 30/min auf refresh, 60/min auf logout
Security H-4: Login-Failure-Logging + Lockout
- auth_service: Redis-Counter, Lockout nach 10 Versuchen (15 min)
- AuditLog für login_success und login_failed
Security M-1: Nginx Security-Header
- nginx.conf: X-Frame-Options, X-Content-Type-Options, CSP, Referrer-Policy, X-XSS-Protection, Permissions-Policy
Security M-3: AuditLog bei Rollenänderungen
- user_service: action=role_changed mit old/new role
Security M-6: create_all nur in Development
- main.py: Base.metadata.create_all nur wenn not settings.is_production
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
92 lines
3.8 KiB
Python
92 lines
3.8 KiB
Python
import uuid
|
||
import enum
|
||
from datetime import date, datetime
|
||
from decimal import Decimal
|
||
from typing import TYPE_CHECKING
|
||
|
||
from sqlalchemy import Boolean, Date, DateTime, Enum, ForeignKey, Numeric, String, Text, func
|
||
from sqlalchemy.dialects.postgresql import JSONB, UUID
|
||
from sqlalchemy.orm import Mapped, mapped_column, relationship
|
||
|
||
from app.core.database import Base
|
||
|
||
if TYPE_CHECKING:
|
||
from app.models.user import User
|
||
from app.models.absence_type import AbsenceType
|
||
|
||
|
||
class AbsenceStatus(str, enum.Enum):
|
||
PENDING = "pending"
|
||
APPROVED = "approved"
|
||
REJECTED = "rejected"
|
||
CANCELLED = "cancelled"
|
||
|
||
|
||
class Absence(Base):
|
||
__tablename__ = "absences"
|
||
|
||
id: Mapped[uuid.UUID] = mapped_column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
|
||
user_id: Mapped[uuid.UUID] = mapped_column(
|
||
UUID(as_uuid=True), ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
|
||
)
|
||
type_id: Mapped[uuid.UUID] = mapped_column(
|
||
UUID(as_uuid=True), ForeignKey("absence_types.id", ondelete="RESTRICT"), nullable=False
|
||
)
|
||
start_date: Mapped[date] = mapped_column(Date, nullable=False)
|
||
end_date: Mapped[date] = mapped_column(Date, nullable=False)
|
||
half_day_start: Mapped[bool] = mapped_column(Boolean, default=False)
|
||
half_day_end: Mapped[bool] = mapped_column(Boolean, default=False)
|
||
working_days: Mapped[float] = mapped_column(Numeric(5, 1), default=0)
|
||
status: Mapped[AbsenceStatus] = mapped_column(
|
||
Enum(AbsenceStatus, name="absencestatus", values_callable=lambda x: [e.value for e in x]),
|
||
nullable=False, default=AbsenceStatus.PENDING,
|
||
)
|
||
approved_by: Mapped[uuid.UUID | None] = mapped_column(
|
||
UUID(as_uuid=True), ForeignKey("users.id", ondelete="SET NULL")
|
||
)
|
||
substitute_id: Mapped[uuid.UUID | None] = mapped_column(
|
||
UUID(as_uuid=True), ForeignKey("users.id", ondelete="SET NULL")
|
||
)
|
||
note: Mapped[str | None] = mapped_column(Text)
|
||
rejection_reason: Mapped[str | None] = mapped_column(Text)
|
||
correction_note: Mapped[str | None] = mapped_column(Text)
|
||
|
||
# Zusatzinformationen (Weiterbildung, Dienstreise, etc.)
|
||
# Struktur je Kategorie:
|
||
# training: {"course_name": str, "provider": str, "location": str}
|
||
# business_trip: {"destination": str, "purpose": str}
|
||
meta: Mapped[dict | None] = mapped_column(JSONB)
|
||
|
||
# FZA in Stunden statt Tagen (bei Stunden-FZA ist start_date == end_date)
|
||
fza_hours: Mapped[Decimal | None] = mapped_column(Numeric(5, 2))
|
||
|
||
# Krankheit: Arbeitsunfähigkeitsbescheinigung
|
||
certificate_required_by: Mapped[date | None] = mapped_column(Date)
|
||
certificate_received_at: Mapped[date | None] = mapped_column(Date)
|
||
|
||
# CalDAV-Sync
|
||
caldav_uid: Mapped[str | None] = mapped_column(String(255))
|
||
caldav_user_etag: Mapped[str | None] = mapped_column(Text)
|
||
caldav_company_etag: Mapped[str | None] = mapped_column(Text)
|
||
caldav_last_error: Mapped[str | None] = mapped_column(Text)
|
||
caldav_synced_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
|
||
|
||
created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), server_default=func.now())
|
||
|
||
user: Mapped["User"] = relationship(
|
||
"User", primaryjoin="Absence.user_id == User.id",
|
||
foreign_keys="[Absence.user_id]", lazy="noload",
|
||
)
|
||
absence_type: Mapped["AbsenceType"] = relationship("AbsenceType", lazy="noload")
|
||
approver: Mapped["User | None"] = relationship(
|
||
"User", primaryjoin="Absence.approved_by == User.id",
|
||
foreign_keys="[Absence.approved_by]", lazy="noload",
|
||
)
|
||
substitute: Mapped["User | None"] = relationship(
|
||
"User", primaryjoin="Absence.substitute_id == User.id",
|
||
foreign_keys="[Absence.substitute_id]", lazy="noload",
|
||
)
|
||
|
||
def __repr__(self) -> str:
|
||
return f"<Absence {self.user_id} {self.start_date}–{self.end_date} [{self.status}]>"
|