From 24c2f28e434dca509610a5bd4def7ae0164a5387 Mon Sep 17 00:00:00 2001
From: lokses <admin@lokses.od.ua>
Date: Sun, 31 May 2026 15:11:44 +0300
Subject: [PATCH] Hide is_staff from regular employee form, show only to
 superusers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Renamed is_staff label to 'Доступ к панели администратора' with
  clearer help text explaining it's for IT admins only
- Removed is_staff from the standard Authentication fieldset
- Added get_fieldsets() override: superusers get an extra collapsed
  'Системный доступ' tab with is_staff and user_permissions
---
 apps/employees/admin.py       | 15 ++++++++++++++-
 apps/employees/models/base.py |  4 ++--
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/apps/employees/admin.py b/apps/employees/admin.py
index 9538b9b..ea88ed7 100644
--- a/apps/employees/admin.py
+++ b/apps/employees/admin.py
@@ -116,7 +116,7 @@ class EmployeeAdmin(ModelAdmin):
 
     fieldsets = (
         (_('Аутентификация'), {
-            'fields': ('username', 'email', 'groups', 'is_staff', 'is_active'),
+            'fields': ('username', 'email', 'groups', 'is_active'),
             'classes': ('tab',),
         }),
         (_('ФИО'), {
@@ -162,6 +162,19 @@ class EmployeeAdmin(ModelAdmin):
         }),
     )
 
+    def get_fieldsets(self, request, obj=None):
+        fieldsets = list(super().get_fieldsets(request, obj))
+        if request.user.is_superuser:
+            fieldsets.append((
+                _('Системный доступ'),
+                {
+                    'fields': ('is_staff', 'user_permissions'),
+                    'classes': ('tab', 'collapse'),
+                    'description': _('Только для IT-администраторов. is_staff — вход в Django admin.'),
+                },
+            ))
+        return fieldsets
+
     # def permissions_summary(self, obj):
     #     perms = obj.effective_permissions()
     #     group = obj.permission_group.name if obj.permission_group_id else None
diff --git a/apps/employees/models/base.py b/apps/employees/models/base.py
index 420592b..8ded6f1 100644
--- a/apps/employees/models/base.py
+++ b/apps/employees/models/base.py
@@ -41,8 +41,8 @@ class Employee(AbstractBaseUser, PermissionsMixin, BaseModel):
     first_name  = models.CharField(_('Имя'), max_length=150)
     middle_name = models.CharField(_('Отчество'), max_length=150, blank=True)
 
-    is_staff   = models.BooleanField(_('Персонал'), default=False,
-                                      help_text=_('Доступ в Django admin'))
+    is_staff   = models.BooleanField(_('Доступ к панели администратора'), default=False,
+                                      help_text=_('Разрешает вход в Django admin. Только для IT-администраторов системы.'))
     is_active  = models.BooleanField(_('Активный'), default=True,
                                       help_text=_('Работает ли сотрудник сейчас'))
     date_joined = models.DateTimeField(_('Дата создания аккаунта'), default=timezone.now)