✨ GDPR: record directory view and directory export

3 files changed, 30 insertions, 5 deletions

diff --git a/ishtar_common/models.py b/ishtar_common/models.py
index a7f715516..b9944e4bb 100644
--- a/ishtar_common/models.py
+++ b/ishtar_common/models.py
@@ -3212,6 +3212,10 @@ GDPR_ACTIVITY = (
     ("PC", _("Person creation")),
     ("PM", _("Person modification")),
     ("PD", _("Person deletion")),
+    ("AC", _("Admin - Directory consultation")),
+    ("AE", _("Admin - Directory export")),
+    ("AV", _("Admin - Person view")),
+    ("AM", _("Admin - Person modification")),
 )
 
 GDPR_ACTIVITY_DICT = dict(GDPR_ACTIVITY)
@@ -3263,24 +3267,28 @@ class GDPRLog(models.Model):
         return f"{self.user.username} - {self.date} - {self.activity_lbl}"
 
     @classmethod
-    def create_log(cls, request, activity, person_query):
+    def create_log(cls, request, activity, person_query, slice_query=None):
         if not request.user:
             # log creation is for logged user should be a script, a bug or a hacker...
             user_id = None
         else:
             user_id = request.user.id
         client_ip, routable_ip = get_client_ip(request)
-        cls._create_log(user_id, client_ip, routable_ip, activity, person_query)
+        cls._create_log(user_id, client_ip, routable_ip, activity, person_query, slice_query)
 
     @classmethod
-    def _create_log(cls, user_id, ip, routable_ip, activity, person_query):
+    def _create_log(cls, user_id, ip, routable_ip, activity, person_query, slice_query=None):
         log = cls.objects.create(user_id=user_id, ip=ip, routable_ip=routable_ip, activity=activity)
         person_query = person_query.exclude(raw_name__isnull=True).exclude(raw_name="")
-
+        start, end = None, None
+        if slice_query:
+            start, end = slice_query
         # create all missing GDPRPerson
         missing_gdpr_person_q = person_query.filter(gdpr_person=None)
         gdpr_persons_creation = []
         values = missing_gdpr_person_q.values_list("id", "raw_name")
+        if start is not None:
+            values = values[start:end]
         for person_id, raw_name in values:
             gdpr_persons_creation.append(GDPRPerson(person_id=person_id, raw_name=raw_name))
         GDPRPerson.objects.bulk_create(gdpr_persons_creation)
@@ -3288,6 +3296,8 @@ class GDPRLog(models.Model):
         # attach gdpr persons
         gdpr_persons = []
         values = person_query.values_list("gdpr_person__pk", flat=True)
+        if start is not None:
+            values = values[start:end]
         for pk in values:
             gdpr_persons.append(cls.persons.through(gdprperson_id=pk, gdprlog_id=log.pk))
         cls.persons.through.objects.bulk_create(gdpr_persons)
diff --git a/ishtar_common/views.py b/ishtar_common/views.py
index 3d86583b1..c96876713 100644
--- a/ishtar_common/views.py
+++ b/ishtar_common/views.py
@@ -1108,7 +1108,14 @@ detail_organization = get_short_html_detail(models.Organization)
 new_author = new_qa_item(models.Author, forms.AuthorForm, page_name=_("New author"))
 show_person = show_item(models.Person, "person")
 
-get_person = get_item(models.Person, "get_person", "person")
+
+def get_person_gdpr_log(request, data_type, queryset, slice_query):
+    activity = "DE" if data_type == "csv" else "DC"
+    models.GDPRLog.create_log(request, activity, queryset, slice_query)
+
+
+get_person = get_item(models.Person, "get_person", "person",
+                      callback=get_person_gdpr_log)
 
 get_person_for_account = get_item(
     models.Person,
diff --git a/ishtar_common/views_item.py b/ishtar_common/views_item.py
index 846646d6b..3ed380465 100644
--- a/ishtar_common/views_item.py
+++ b/ishtar_common/views_item.py
@@ -1773,6 +1773,7 @@ def get_item(
     alt_query_own=None,
     search_form=None,
     no_permission_check=False,
+    callback=None,
 ):
     """
     Generic treatment of tables
@@ -1796,6 +1797,7 @@ def get_item(
     :param model_for_perms: use another model to check permission
     :param alt_query_own: name of alternate method to get query_own
     :param search_form: associated search form to manage JSON query keys
+    :callback: callback to execute after request. It is called with three arguments: request, export format and queryset of the result
     :return:
     """
 
@@ -2421,6 +2423,12 @@ def get_item(
             start = 0
             end = 20
 
+        if callback:
+            slice_query = None
+            if not manual_sort_key:
+                slice_query = (start, end)
+            callback(request, data_type, items, slice_query)
+
         if manual_sort_key:
             items = items.all()
         else: