add payment_link and banks

apps/payments/admin.py

@@ -0,0 +1,128 @@
+from django.contrib import admin
+from django.core.exceptions import PermissionDenied
+from django.db import connection
+from . import models, policies, services
+
+
+@admin.register(models.PaymentAccessLink)
+class PaymentAccessLinkAdmin(admin.ModelAdmin):
+    list_display = ('customer', 'notice', 'receipt', 'created_at', 'expires_at', 'revoked_at', 'view_count')
+    list_filter = ('revoked_at', 'expires_at')
+    exclude = ('token_hash',)
+    readonly_fields = ('customer', 'notice', 'receipt', 'created_at', 'expires_at', 'revoked_at', 'view_count', 'last_used_at', 'submitted_receipts')
+    actions = ['revoke_links']
+
+    def has_add_permission(self, request):
+        return False
+
+    def has_delete_permission(self, request, obj=None):
+        return False
+
+    @admin.action(description='ابطال لینک‌های انتخاب‌شده')
+    def revoke_links(self, request, queryset):
+        from django.utils import timezone
+        for link in queryset.filter(revoked_at__isnull=True):
+            link.revoked_at = timezone.now()
+            link.save(update_fields=['revoked_at'])
+            services.audit(request.user, 'PAYMENT_LINK_REVOKED', link)
+from .forms import BankAccountForm
+
+
+class AuditedConfigurationAdmin(admin.ModelAdmin):
+    permission = 'manage_payment_approval_policy'
+    singleton_configuration = False
+
+    def has_view_permission(self, request, obj=None):
+        return policies.has_permission(request.user,self.permission)
+
+    def has_add_permission(self, request):
+        return self.has_view_permission(request) and not (self.singleton_configuration and self.model.objects.exists())
+
+    def has_change_permission(self, request, obj=None):
+        return self.has_view_permission(request,obj)
+
+    def has_delete_permission(self, request, obj=None):
+        return False
+
+    def save_model(self, request, obj, form, change):
+        if not self.has_change_permission(request,obj):
+            raise PermissionDenied
+        current = self.model.objects.select_for_update().get(pk=obj.pk) if change else None
+        before = services.configuration_snapshot(current) if current else {}
+        super().save_model(request,obj,form,change)
+        services.audit(request.user,'CONFIG_SAVED',obj,{'fields': form.changed_data,
+            'before':before,'after':services.configuration_snapshot(obj)})
+
+    def save_related(self, request, form, formsets, change):
+        super().save_related(request,form,formsets,change)
+        if isinstance(form.instance,models.PaymentApprovalPolicy):
+            services.audit(request.user,'POLICY_ASSIGNMENTS_CHANGED',form.instance,{'reviewers':list(form.instance.reviewers.values_list('pk',flat=True)), 'seniors':list(form.instance.seniors.values_list('pk',flat=True))})
+
+
+@admin.register(models.PaymentApprovalPolicy)
+class ApprovalPolicyAdmin(AuditedConfigurationAdmin):
+    list_display = ['name','unit','is_active']
+    filter_horizontal = ['reviewers','seniors']
+
+    def formfield_for_manytomany(self, db_field, request, **kwargs):
+        from apps.accounts.models import User
+        if db_field.name in ['reviewers','seniors']:
+            kwargs['queryset'] = User.objects.filter(account_type='STAFF',is_active=True).exclude(staff_profile__is_active=False)
+        return super().formfield_for_manytomany(db_field,request,**kwargs)
+
+
+@admin.register(models.PaymentAccessConfiguration)
+class AccessAdmin(AuditedConfigurationAdmin):
+    permission = 'manage_payment_access'
+    singleton_configuration = True
+
+
+@admin.register(models.CompanyBankAccount)
+class AccountAdmin(AuditedConfigurationAdmin):
+    form = BankAccountForm
+    list_display = ['name','bank','requires_deposit_id','is_active','available_to_staff','available_to_customers']
+    permission = 'manage_company_bankaccounts'
+
+    def has_view_permission(self, request, obj=None):
+        return policies.can_manage_banks(request.user)
+
+    def get_queryset(self, request):
+        queryset = super().get_queryset(request)
+        # Django wraps POST change forms in atomic(): lock before token validation.
+        if request.method == 'POST' and connection.in_atomic_block:
+            return queryset.select_for_update(of=('self',))
+        return queryset
+
+
+@admin.register(models.BankInstitution)
+class BankAdmin(AccountAdmin):
+    form = admin.ModelAdmin.form
+    list_display = ['name','code','is_active','historical']
+
+
+class EvidenceAdmin(admin.ModelAdmin):
+    def has_view_permission(self, request, obj=None):
+        if self.model in [models.PaymentNotice, models.PaymentReceipt]:
+            return super().has_view_permission(request, obj)
+        return policies.has_permission(request.user, 'view_payment_audit')
+
+    def has_add_permission(self, request):
+        return False
+
+    def has_change_permission(self, request, obj=None):
+        return False
+
+    def has_delete_permission(self, request, obj=None):
+        return False
+
+    def get_queryset(self, request):
+        queryset = super().get_queryset(request)
+        if queryset.model in [models.PaymentNotice,models.PaymentReceipt]:
+            return policies.visible(queryset,request.user)
+        return queryset if policies.has_permission(request.user,'view_payment_audit') else queryset.none()
+
+
+for model in [models.PaymentNotice,models.PaymentReceipt,models.PaymentReceiptRevision,models.ReceiptApprovalCycle,
+              models.ReceiptApprovalAssignment,models.ReceiptDecision,models.PaymentAuditEvent,
+              models.PaymentNotification,models.PaymentNotificationAttempt]:
+    admin.site.register(model,EvidenceAdmin)