Prepare ERP source for Gitea deployment

app/modules/core/iam/lifecycle.py

@@ -0,0 +1,75 @@
+from __future__ import annotations
+
+from datetime import datetime, timezone
+from sqlalchemy.orm import Session
+
+from app.modules.core.iam.models import User
+from app.modules.core.iam.scope import UserScope, ensure_manageable_existing_user
+
+
+class LifecycleError(Exception):
+    pass
+
+
+def utcnow_naive() -> datetime:
+    return datetime.now(timezone.utc).replace(tzinfo=None)
+
+
+def ensure_not_self(actor: User, target: User, action_label: str) -> None:
+    if actor.id == target.id:
+        raise LifecycleError(f"You cannot {action_label} your own account.")
+
+
+def ensure_not_bootstrap_admin(target: User) -> None:
+    if (target.email or '').strip().lower() == 'admin@auditfirm.local':
+        raise LifecycleError('Bootstrap system admin cannot be modified by this action.')
+
+
+def ensure_manageable_lifecycle(scope: UserScope, db: Session, actor: User, target: User, action_label: str) -> None:
+    ensure_manageable_existing_user(db, scope, target)
+    ensure_not_self(actor, target, action_label)
+
+
+def activate_user(user: User) -> None:
+    user.is_active = True
+    if user.deleted_at is not None:
+        user.deleted_at = None
+
+
+def deactivate_user(user: User) -> None:
+    user.is_active = False
+
+
+def enable_login(user: User) -> None:
+    user.allow_login = True
+
+
+def disable_login(user: User) -> None:
+    user.allow_login = False
+
+
+def lock_user(user: User) -> None:
+    user.is_locked = True
+    user.locked_at_utc = utcnow_naive()
+
+
+def unlock_user(user: User) -> None:
+    user.is_locked = False
+    user.locked_at_utc = None
+
+
+def soft_delete_user(user: User) -> None:
+    user.deleted_at = utcnow_naive()
+    user.is_active = False
+    user.allow_login = False
+    user.is_locked = True
+    if user.locked_at_utc is None:
+        user.locked_at_utc = utcnow_naive()
+
+
+def restore_user(user: User) -> None:
+    user.deleted_at = None
+    user.is_active = True
+    user.allow_login = True
+    user.is_locked = False
+    user.locked_at_utc = None