From 671adbd1a29e06bc2a7bd2af86c59017d6339ab3 Mon Sep 17 00:00:00 2001
From: A R R R Associates <admin@arrrassociates.com>
Date: Mon, 6 Jul 2026 23:01:53 +0530
Subject: [PATCH] Default OTP requirement to system admin only

---
 .../system_settings/templates/tenant_create.html    |  3 ++-
 .../system_settings/templates/tenant_edit.html      |  3 ++-
 app/modules/system_settings/ui.py                   | 13 +++++++------
 app/modules/wizards/service.py                      |  3 ++-
 .../wizards/templates/wizards/system_firm_new.html  |  3 ++-
 app/modules/wizards/ui.py                           |  7 ++++---
 6 files changed, 19 insertions(+), 13 deletions(-)

diff --git a/app/modules/system_settings/templates/tenant_create.html b/app/modules/system_settings/templates/tenant_create.html
index 5d6ca35..6e898f6 100644
--- a/app/modules/system_settings/templates/tenant_create.html
+++ b/app/modules/system_settings/templates/tenant_create.html
@@ -43,7 +43,7 @@
 
           <label class="grid gap-1 md:col-span-2">
             <span class="text-sm text-slate-600">Default OTP Required Roles (CSV)</span>
-            <input class="border rounded-xl px-3 py-2" name="default_otp_required_roles_csv" value="Partner,System Admin" />
+            <input class="border rounded-xl px-3 py-2" name="default_otp_required_roles_csv" value="System Admin" />
           </label>
 
           <label class="grid gap-1">
@@ -64,3 +64,4 @@
     </div>
   </form>
 {% endblock %}
+
diff --git a/app/modules/system_settings/templates/tenant_edit.html b/app/modules/system_settings/templates/tenant_edit.html
index e4e72f4..a1e02fb 100644
--- a/app/modules/system_settings/templates/tenant_edit.html
+++ b/app/modules/system_settings/templates/tenant_edit.html
@@ -43,7 +43,7 @@
 
           <label class="grid gap-1 md:col-span-2">
             <span class="text-sm text-slate-600">Default OTP Required Roles (CSV)</span>
-            <input class="border rounded-xl px-3 py-2" name="default_otp_required_roles_csv" value="{{ tenant.default_otp_required_roles_csv or 'Partner,System Admin' }}" />
+            <input class="border rounded-xl px-3 py-2" name="default_otp_required_roles_csv" value="{{ tenant.default_otp_required_roles_csv or 'System Admin' }}" />
           </label>
 
           <label class="grid gap-1">
@@ -68,3 +68,4 @@
     </div>
   </form>
 {% endblock %}
+
diff --git a/app/modules/system_settings/ui.py b/app/modules/system_settings/ui.py
index 200cb89..19e163d 100644
--- a/app/modules/system_settings/ui.py
+++ b/app/modules/system_settings/ui.py
@@ -243,7 +243,7 @@ def tenant_create_submit(
     firm_type: str = Form("proprietorship"),
     default_timezone: str = Form("Asia/Kolkata"),
     default_session_duration_minutes: int = Form(480),
-    default_otp_required_roles_csv: str = Form("Partner,System Admin"),
+    default_otp_required_roles_csv: str = Form("System Admin"),
     default_storage_mode: str = Form("local_only"),
     csrf_token: str = Form(...),
 ):
@@ -266,7 +266,7 @@ def tenant_create_submit(
             firm_type=(firm_type or "partnership").strip(),
             default_timezone=(default_timezone or "Asia/Kolkata").strip(),
             default_session_duration_minutes=default_session_duration_minutes or 480,
-            default_otp_required_roles_csv=(default_otp_required_roles_csv or "Partner,System Admin").strip(),
+            default_otp_required_roles_csv=(default_otp_required_roles_csv or "System Admin").strip(),
             default_storage_mode=(default_storage_mode or "local_only").strip(),
         )
         db.add(tenant)
@@ -319,7 +319,7 @@ def tenant_edit_submit(
     firm_type: str = Form("proprietorship"),
     default_timezone: str = Form("Asia/Kolkata"),
     default_session_duration_minutes: int = Form(480),
-    default_otp_required_roles_csv: str = Form("Partner,System Admin"),
+    default_otp_required_roles_csv: str = Form("System Admin"),
     default_storage_mode: str = Form("local_only"),
     is_active: str | None = Form(None),
     csrf_token: str = Form(...),
@@ -345,7 +345,7 @@ def tenant_edit_submit(
         tenant.firm_type = (firm_type or "partnership").strip()
         tenant.default_timezone = (default_timezone or "Asia/Kolkata").strip()
         tenant.default_session_duration_minutes = default_session_duration_minutes or 480
-        tenant.default_otp_required_roles_csv = (default_otp_required_roles_csv or "Partner,System Admin").strip()
+        tenant.default_otp_required_roles_csv = (default_otp_required_roles_csv or "System Admin").strip()
         tenant.default_storage_mode = (default_storage_mode or "local_only").strip()
         tenant.is_active = is_active is not None
         db.commit()
@@ -656,7 +656,7 @@ def branch_edit_submit(
     max_file_mb: str = Form("25"),
     allowed_ext_csv: str = Form("pdf,jpg,jpeg,png,xlsx,xls,docx,zip"),
     retention_years: str = Form("8"),
-    otp_required_roles_csv: str = Form("Partner,System Admin"),
+    otp_required_roles_csv: str = Form("System Admin"),
     session_duration_minutes: str = Form("480"),
     lockout_attempts: str = Form("5"),
     lockout_minutes: str = Form("15"),
@@ -739,7 +739,7 @@ def branch_edit_submit(
         settings.max_file_mb = int(max_file_mb) if str(max_file_mb).strip() else 25
         settings.allowed_ext_csv = (allowed_ext_csv or "pdf,jpg,jpeg,png,xlsx,xls,docx,zip").strip()
         settings.retention_years = int(retention_years) if str(retention_years).strip() else 8
-        settings.otp_required_roles_csv = (otp_required_roles_csv or "Partner,System Admin").strip()
+        settings.otp_required_roles_csv = (otp_required_roles_csv or "System Admin").strip()
         settings.session_duration_minutes = int(session_duration_minutes) if str(session_duration_minutes).strip() else 480
         settings.lockout_attempts = int(lockout_attempts) if str(lockout_attempts).strip() else 5
         settings.lockout_minutes = int(lockout_minutes) if str(lockout_minutes).strip() else 15
@@ -1492,3 +1492,4 @@ def switch_active_branch(request: Request, branch_id: int):
         return _redirect_back(request)
     finally:
         db.close()
+
diff --git a/app/modules/wizards/service.py b/app/modules/wizards/service.py
index 5689c71..b6a147f 100644
--- a/app/modules/wizards/service.py
+++ b/app/modules/wizards/service.py
@@ -119,7 +119,7 @@ def build_firm_wizard_payload(form: dict[str, Any]) -> dict[str, Any]:
         "firm_type": clean_text(str(form.get("firm_type") or "partnership")) or "partnership",
         "default_timezone": clean_text(str(form.get("default_timezone") or "Asia/Kolkata")) or "Asia/Kolkata",
         "default_session_duration_minutes": parse_int(form.get("default_session_duration_minutes"), 480),
-        "default_otp_required_roles_csv": clean_text(str(form.get("default_otp_required_roles_csv") or "Partner,System Admin")) or "Partner,System Admin",
+        "default_otp_required_roles_csv": clean_text(str(form.get("default_otp_required_roles_csv") or "System Admin")) or "System Admin",
         "default_storage_mode": clean_text(str(form.get("default_storage_mode") or "local_only")) or "local_only",
         "branch_code": branch_code,
         "branch_name": clean_text(str(form.get("branch_name") or "Head Office")) or "Head Office",
@@ -378,3 +378,4 @@ def create_firm_from_wizard(db: Session, payload: dict[str, Any]) -> FirmWizardR
         invite_email_status=invite_email_status,
         invite_email_error=invite_email_error,
     )
+
diff --git a/app/modules/wizards/templates/wizards/system_firm_new.html b/app/modules/wizards/templates/wizards/system_firm_new.html
index d65a247..b8a5af2 100644
--- a/app/modules/wizards/templates/wizards/system_firm_new.html
+++ b/app/modules/wizards/templates/wizards/system_firm_new.html
@@ -61,7 +61,7 @@
         </label>
         <label class="grid gap-1 md:col-span-2">
           <span class="text-sm text-slate-600">OTP required roles CSV</span>
-          <input class="rounded-xl border px-3 py-2" name="default_otp_required_roles_csv" value="{{ form.default_otp_required_roles_csv or 'Partner,System Admin' }}" />
+          <input class="rounded-xl border px-3 py-2" name="default_otp_required_roles_csv" value="{{ form.default_otp_required_roles_csv or 'System Admin' }}" />
         </label>
       </div>
     </section>
@@ -182,3 +182,4 @@
   </form>
 </div>
 {% endblock %}
+
diff --git a/app/modules/wizards/ui.py b/app/modules/wizards/ui.py
index 2c1f149..a511597 100644
--- a/app/modules/wizards/ui.py
+++ b/app/modules/wizards/ui.py
@@ -66,7 +66,7 @@ def _default_form_values() -> dict:
         "firm_type": "partnership",
         "default_timezone": "Asia/Kolkata",
         "default_session_duration_minutes": 480,
-        "default_otp_required_roles_csv": "Partner,System Admin",
+        "default_otp_required_roles_csv": "System Admin",
         "default_storage_mode": "local_only",
         "branch_code": "HO",
         "branch_name": "Head Office",
@@ -121,7 +121,7 @@ def system_firm_preview(
     firm_type: str = Form("partnership"),
     default_timezone: str = Form("Asia/Kolkata"),
     default_session_duration_minutes: int = Form(480),
-    default_otp_required_roles_csv: str = Form("Partner,System Admin"),
+    default_otp_required_roles_csv: str = Form("System Admin"),
     default_storage_mode: str = Form("local_only"),
     branch_code: str = Form("HO"),
     branch_name: str = Form("Head Office"),
@@ -181,7 +181,7 @@ def system_firm_confirm(
     firm_type: str = Form("partnership"),
     default_timezone: str = Form("Asia/Kolkata"),
     default_session_duration_minutes: int = Form(480),
-    default_otp_required_roles_csv: str = Form("Partner,System Admin"),
+    default_otp_required_roles_csv: str = Form("System Admin"),
     default_storage_mode: str = Form("local_only"),
     branch_code: str = Form("HO"),
     branch_name: str = Form("Head Office"),
@@ -290,3 +290,4 @@ def system_firm_confirm(
         )
     finally:
         db.close()
+