add payment_link and banks

apps/payments/middleware.py

@@ -0,0 +1,53 @@
+"""Audit administrative financial grant changes with the actual request actor.
+Only selected non-secret fields and payments permissions are captured."""
+from django.apps import apps
+from django.db import OperationalError, ProgrammingError
+from .models import PaymentAuditEvent
+
+TARGETS = {'accounts/user': 'accounts.User', 'auth/group': 'auth.Group',
+           'staff/organizationalunit': 'staff.OrganizationalUnit', 'staff/unitmembership': 'staff.UnitMembership',
+           'staff/staffprofile': 'staff.StaffProfile'}
+
+
+def access_snapshot(obj):
+    fields = ['is_active','account_type','user_id','unit_id','ticket_scope','role','primary_unit_id']
+    result = {field:getattr(obj,field) for field in fields if hasattr(obj,field)}
+    for name in ['permissions','user_permissions']:
+        relation = getattr(obj,name,None)
+        if relation is not None:
+            result[name] = sorted(relation.filter(content_type__app_label='payments').values_list('codename',flat=True))
+    if hasattr(obj,'groups'):
+        result['groups'] = sorted(obj.groups.filter(permissions__content_type__app_label='payments').values_list('pk',flat=True).distinct())
+    return result
+
+
+class FinancialGrantAuditMiddleware:
+    def __init__(self,get_response):
+        self.get_response=get_response
+
+    def __call__(self,request):
+        target = self.target(request)
+        before = access_snapshot(target) if target else None
+        response = self.get_response(request)
+        if target and response.status_code < 400:
+            try:
+                target.refresh_from_db()
+                after=access_snapshot(target)
+                if before != after:
+                    from .services import audit
+                    audit(request.user,'FINANCIAL_ACCESS_CHANGED',target,{'before':before,'after':after})
+            except target.DoesNotExist:
+                from .services import audit
+                audit(request.user,'FINANCIAL_ACCESS_REMOVED',target,{'before':before})
+        return response
+
+    def target(self,request):
+        if request.method != 'POST' or not request.user.is_authenticated or not request.path.startswith('/x5admin/'):
+            return None
+        parts=request.path.strip('/').split('/')
+        if len(parts)<5 or not parts[3].isdecimal():
+            return None
+        label=TARGETS.get('/'.join(parts[1:3]))
+        if not label:
+            return None
+        return apps.get_model(label).objects.filter(pk=parts[3]).first()