View source for References/User & Skills

{{Doc header
|type=reference
|domain=access-governance
|title=User & Skills
|order=2
|introduced=3.0
|model=User&Skills
|concept=Concepts/Patient
|reference=References/Base models &amp; conventions
}}

A <code>User</code> is a Care account — authentication, profile, clinician credentials, and notification/MFA data. The Django model is the storage layer. The Pydantic resource specs in <code>care/emr/resources/user/</code> and <code>care/emr/resources/mfa/</code> are the API layer: they define enums, validation, the shape of the opaque <code>JSONField</code>s, and the separate request/response schemas you write to and read from.

'''Source:''' [<nowiki/>https://github.com/ohcnetwork/care/blob/develop/care/users/models.py <code>care/users/models.py</code>], [<nowiki/>https://github.com/ohcnetwork/care/blob/develop/care/facility/models/patient.py <code>care/facility/models/patient.py</code>], [<nowiki/>https://github.com/ohcnetwork/care/blob/develop/care/emr/resources/user/spec.py <code>care/emr/resources/user/spec.py</code>], [<nowiki/>https://github.com/ohcnetwork/care/blob/develop/care/emr/resources/mfa/spec.py <code>care/emr/resources/mfa/spec.py</code>]

== Models ==

{| class="wikitable"
|-
! Model
! Purpose
|-
| <code>User</code>
| Care account: authentication, profile, clinician credentials, and notification/MFA data
|-
| <code>Skill</code>
| Instance-wide skill/competency definition
|-
| <code>UserSkill</code>
| Through model linking a <code>User</code> to a <code>Skill</code>
|-
| <code>UserFlag</code>
| Feature flag scoped to a single <code>User</code>
|-
| <code>PlugConfig</code>
| Slug-keyed JSON configuration for installed plugs
|-
| <code>MobileOTP</code>
| One-time password issued against a phone number
|}

The base class determines which audit fields each model carries:

* <code>User</code> extends Django's <code>AbstractUser</code>, adding its own <code>external_id</code> and a soft-delete <code>deleted</code> flag. It is not an <code>EMRBaseModel</code>.
* <code>Skill</code>, <code>UserSkill</code>, and <code>MobileOTP</code> extend [[References/Base models &amp; conventions|<code>BaseModel</code>]] (<code>external_id</code>, <code>created_date</code>, <code>modified_date</code>, soft-delete via <code>deleted</code>).
* <code>UserFlag</code> extends <code>BaseFlag</code>, a <code>BaseModel</code> subclass that adds a <code>flag</code> field plus a cache-invalidating <code>save()</code>.
* <code>PlugConfig</code> extends plain <code>django.db.models.Model</code> — no audit or soft-delete fields.

== <code>User</code> fields ==

<code>User</code> inherits <code>password</code>, <code>email</code>, <code>first_name</code>, <code>last_name</code>, <code>is_staff</code>, <code>is_active</code>, <code>is_superuser</code>, <code>last_login</code>, and <code>date_joined</code> from <code>AbstractUser</code>. The fields below are Care additions or overrides. Queries run through <code>CustomUserManager</code>, which drops <code>deleted=True</code> rows by default; <code>get_entire_queryset()</code> bypasses that filter.

=== Identity &amp; profile ===

{| class="wikitable"
|-
! Field
! Type
! Notes
{{Field|model=User&Skills|section=Identity &amp; profile|name=external_id|type=UUIDField|notes=Unique, indexed; stable public identifier. Surfaced as <code>id</code> in every read spec}}
{{Field|model=User&Skills|section=Identity &amp; profile|name=username|type=CharField(150)|notes=Unique; model-validated by <code>UsernameValidator</code>. On create, the API additionally enforces <code>^[a-zA-Z0-9_-]{3,}$</code> and global uniqueness, including deleted users}}
{{Field|model=User&Skills|section=Identity &amp; profile|name=user_type|type=CharField(100)|notes=Nullable; free-text role label (e.g. <code>administrator</code>). No user spec exposes it — set internally or by <code>create_superuser</code>}}
{{Field|model=User&Skills|section=Identity &amp; profile|name=prefix|type=CharField(10)|notes=Name prefix (e.g. Dr.); spec caps length at 10. Optional in specs}}
{{Field|model=User&Skills|section=Identity &amp; profile|name=suffix|type=CharField(50)|notes=Name suffix; spec caps length at 50. Optional in specs}}
{{Field|model=User&Skills|section=Identity &amp; profile|name=gender|type=CharField(100)|notes=Nullable in DB. Write specs constrain it to <code>GenderChoices</code> and require it; read specs return it as a plain string. See [[#genderchoices-values}}
{{Field|model=User&Skills|section=Identity &amp; profile|name=old_gender|type=IntegerField|notes=Legacy <code>GENDER_CHOICES</code> (<code>1</code> Male, <code>2</code> Female, <code>3</code> Non-binary); nullable. No user spec exposes it}}
{{Field|model=User&Skills|section=Identity &amp; profile|name=date_of_birth|type=DateField|notes=Nullable. Read-only (nullable string) in <code>CurrentUserRetrieveSpec</code>}}
{{Field|model=User&Skills|section=Identity &amp; profile|name=profile_picture_url|type=CharField(500)|notes=Storage key, not a URL. Read specs return the resolved URL via <code>read_profile_picture_url()</code>, not the raw key}}
{{Field|model=User&Skills|section=Identity &amp; profile|name=created_by|type=FK → User (self, SET_NULL)|notes=Account creator; <code>related_name=&quot;users_created&quot;</code>. Serialized in <code>UserRetrieveSpec</code> as a cached nested <code>UserSpec</code> dict (nullable)}}
{{Field|model=User&Skills|section=Identity &amp; profile|name=deleted|type=BooleanField|notes=Soft-delete flag (default <code>False</code>); read-only in <code>UserSpec</code>}}
{{Field|model=User&Skills|section=Identity &amp; profile|name=verified|type=BooleanField|notes=Default <code>False</code>; read-only in <code>CurrentUserRetrieveSpec</code>}}
{{Field|model=User&Skills|section=Identity &amp; profile|name=is_service_account|type=BooleanField|notes=Default <code>False</code>; marks machine/integration accounts. Settable on create, read in <code>UserRetrieveSpec</code>}}
|}

=== Contact ===

{| class="wikitable"
|-
! Field
! Type
! Notes
{{Field|model=User&Skills|section=Contact|name=phone_number|type=CharField(14)|notes=Model: <code>mobile_or_landline_number_validator</code>. Required in specs, capped at 14 chars; must be globally unique on create}}
{{Field|model=User&Skills|section=Contact|name=alt_phone_number|type=CharField(14)|notes=Nullable; model <code>mobile_validator</code>. Read-only string in <code>CurrentUserRetrieveSpec</code>}}
{{Field|model=User&Skills|section=Contact|name=video_connect_link|type=URLField|notes=Nullable; tele-consult link. No user spec exposes it}}
|}

=== Clinician credentials ===

{| class="wikitable"
|-
! Field
! Type
! Notes
{{Field|model=User&Skills|section=Clinician credentials|name=qualification|type=TextField|notes=Nullable. Read-only (nullable string) in <code>CurrentUserRetrieveSpec</code>}}
{{Field|model=User&Skills|section=Clinician credentials|name=doctor_experience_commenced_on|type=DateField|notes=Nullable; experience is derived from this. Read-only (nullable string) in <code>CurrentUserRetrieveSpec</code>}}
{{Field|model=User&Skills|section=Clinician credentials|name=doctor_medical_council_registration|type=CharField(255)|notes=Nullable; council registration number. Read-only (nullable string) in <code>CurrentUserRetrieveSpec</code>}}
{{Field|model=User&Skills|section=Clinician credentials|name=weekly_working_hours|type=IntegerField|notes=Nullable; model-validated <code>0</code>–<code>168</code>. Read-only (nullable string) in <code>CurrentUserRetrieveSpec</code>}}
|}

=== Organization &amp; facility ===

{| class="wikitable"
|-
! Field
! Type
! Notes
{{Field|model=User&Skills|section=Organization &amp; facility|name=geo_organization|type=FK → emr.Organization (SET_NULL)|notes=Geographic/administrative org. Write specs accept a <code>UUID4</code> and resolve it to an <code>Organization</code> with <code>org_type=&quot;govt&quot;</code> (404 otherwise). Read in <code>UserRetrieveSpec</code> as a nested <code>OrganizationReadSpec</code> dict. Listed in <code>UserBaseSpec.__exclude__</code>, so it never round-trips through the generic field copy}}
{{Field|model=User&Skills|section=Organization &amp; facility|name=home_facility|type=FK → facility.Facility (PROTECT)|notes=Primary facility. No user spec exposes it}}
{{Field|model=User&Skills|section=Organization &amp; facility|name=skills|type=ManyToManyField → Skill|notes=Through <code>UserSkill</code>}}
{{Field|model=User&Skills|section=Organization &amp; facility|name=cached_role_orgs|type=JSONField|notes=Nullable; cached role/organization map. Lazily populated by <code>get_cached_role_orgs()</code> and surfaced as <code>role_orgs</code> in read specs. Platform-maintained — do not write directly}}
|}

=== Notifications, MFA &amp; preferences ===

{| class="wikitable"
|-
! Field
! Type
! Notes
{{Field|model=User&Skills|section=Notifications, MFA &amp; preferences|name=pf_endpoint|type=TextField|notes=Web-push endpoint; nullable. Read-only in <code>CurrentUserRetrieveSpec</code>}}
{{Field|model=User&Skills|section=Notifications, MFA &amp; preferences|name=pf_p256dh|type=TextField|notes=Web-push key; nullable. Read-only in <code>CurrentUserRetrieveSpec</code>}}
{{Field|model=User&Skills|section=Notifications, MFA &amp; preferences|name=pf_auth|type=TextField|notes=Web-push auth secret; nullable. Read-only in <code>CurrentUserRetrieveSpec</code>}}
{{Field|model=User&Skills|section=Notifications, MFA &amp; preferences|name=totp_secret|type=TextField|notes=Nullable; TOTP seed. Never serialized; written only via the MFA setup/verify flow}}
{{Field|model=User&Skills|section=Notifications, MFA &amp; preferences|name=mfa_settings|type=JSONField|notes=Default <code>{}</code>. Shape: <code>{ &quot;totp&quot;: { &quot;enabled&quot;: bool, ... } }</code>. <code>is_mfa_enabled()</code> reads <code>mfa_settings[&quot;totp&quot;][&quot;enabled&quot;]</code>; surfaced as the boolean <code>mfa_enabled</code> in <code>UserSpec</code>. Clients never write it directly}}
{{Field|model=User&Skills|section=Notifications, MFA &amp; preferences|name=preferences|type=JSONField|notes=Default <code>{}</code>; open per-user UI/app preferences bag. Read-only <code>dict</code> in <code>CurrentUserRetrieveSpec</code>}}
|}

<code>REQUIRED_FIELDS = [&quot;email&quot;]</code>, and the model is managed by <code>CustomUserManager</code>.

== Enum values ==

=== GenderChoices values ===

Bound to <code>gender</code> on every write spec (<code>UserUpdateSpec</code>, <code>UserCreateSpec</code>). Defined in [<nowiki/>https://github.com/ohcnetwork/care/blob/develop/care/emr/resources/patient/spec.py <code>care/emr/resources/patient/spec.py</code>] and reused here; read specs return <code>gender</code> as a free string.

{| class="wikitable"
|-
! Value
|-
| <code>male</code>
|-
| <code>female</code>
|-
| <code>non_binary</code>
|-
| <code>transgender</code>
|}

<code>create_superuser()</code> sets <code>gender=&quot;non_binary&quot;</code>, which is a member of this enum. The model's legacy integer <code>GENDER_CHOICES</code> (<code>1</code> Male, <code>2</code> Female, <code>3</code> Non-binary) is separate and unused by the API.

=== LoginMethod values ===

Used by <code>MFALoginRequest.method</code> in [<nowiki/>https://github.com/ohcnetwork/care/blob/develop/care/emr/resources/mfa/spec.py <code>care/emr/resources/mfa/spec.py</code>].

{| class="wikitable"
|-
! Value
! Meaning
|-
| <code>totp</code>
| Authenticator app one-time code
|-
| <code>backup</code>
| Single-use backup recovery code
|}

== Resource specs (API schema) ==

Every user spec builds on <code>EMRResource</code> ([<nowiki/>https://github.com/ohcnetwork/care/blob/develop/care/emr/resources/base.py <code>care/emr/resources/base.py</code>]), which provides <code>serialize</code> (DB → pydantic) and <code>de_serialize</code> (pydantic → DB) plus the <code>perform_extra_serialization</code> / <code>perform_extra_deserialization</code> hooks. <code>UserBaseSpec</code> sets <code>__model__ = User</code> and <code>__exclude__ = [&quot;geo_organization&quot;]</code>.

{| class="wikitable"
|-
! Spec class
! Role
! Fields / behaviour
|-
| <code>UserBaseSpec</code>
| shared base
| <code>id</code>, <code>first_name</code>, <code>last_name</code>, <code>phone_number</code> (max 14), <code>prefix</code> (max 10, optional), <code>suffix</code> (max 50, optional)
|-
| <code>UserUpdateSpec</code>
| write · update
| Base + <code>gender</code> (<code>GenderChoices</code>, required), <code>phone_number</code> (max 14), <code>geo_organization</code> (<code>UUID4</code>, optional). De-serialize resolves <code>geo_organization</code> to an <code>Organization</code> with <code>org_type=&quot;govt&quot;</code> (404 if missing)
|-
| <code>UserCreateSpec</code>
| write · create
| Extends <code>UserUpdateSpec</code> + <code>password</code> (optional), <code>username</code>, <code>email</code>, <code>is_service_account</code> (default <code>False</code>), <code>role_orgs: list[UserRoleOrgCreateSpec]</code>. Validates username pattern/uniqueness, phone uniqueness, email format/uniqueness, and password strength. De-serialize stashes <code>role_orgs</code> on the instance and calls <code>set_password()</code>
|-
| <code>UserRoleOrgCreateSpec</code>
| write · nested
| <code>organization: UUID4</code>, <code>role: UUID4</code> — one role-in-organization assignment supplied at user creation
|-
| <code>UserSpec</code>
| read · list/summary
| Base + <code>last_login</code>, <code>profile_picture_url</code>, <code>gender</code> (string), <code>username</code>, <code>mfa_enabled</code> (default <code>False</code>), <code>phone_number</code>, <code>deleted</code> (default <code>False</code>), <code>role_orgs: dict</code>. <code>@cacheable(use_base_manager=True)</code> — cached, and resolves deleted users. Sets <code>id</code> from <code>external_id</code>, resolves the picture URL, computes <code>mfa_enabled</code>, loads <code>role_orgs</code>
|-
| <code>UserRetrieveSpec</code>
| read · detail
| Extends <code>UserSpec</code> + <code>geo_organization: dict</code>, <code>created_by: dict | None</code>, <code>email</code>, <code>flags: list[str]</code>, <code>is_service_account</code>. Serializes <code>created_by</code> (cached <code>UserSpec</code>), <code>geo_organization</code> (<code>OrganizationReadSpec</code>), and <code>flags</code> (<code>get_all_flags()</code>)
|-
| <code>CurrentUserRetrieveSpec</code>
| read · self (<code>/users/getcurrentuser</code>-style)
| Extends <code>UserRetrieveSpec</code> + <code>is_superuser</code>, <code>qualification</code>, <code>doctor_experience_commenced_on</code>, <code>doctor_medical_council_registration</code>, <code>weekly_working_hours</code>, <code>alt_phone_number</code>, <code>date_of_birth</code> (all nullable strings), <code>verified</code>, <code>pf_endpoint</code>/<code>pf_p256dh</code>/<code>pf_auth</code>, <code>organizations: list[dict]</code>, <code>facilities: list[dict]</code>, <code>permissions: list[str]</code>, <code>preferences: dict</code>. Computes the caller's organizations, facilities (excluding deleted), and resolved permission slugs
|-
| <code>PublicUserReadSpec</code>
| read · public
| Base + <code>last_login</code>, <code>profile_picture_url</code>, <code>gender</code>, <code>username</code>, <code>role_orgs: list[dict]</code>. Minimal unauthenticated projection
|}

The password-reset flow uses plain-<code>BaseModel</code> request/response DTOs (not <code>EMRResource</code>, no model binding), all in <code>user/spec.py</code>:

{| class="wikitable"
|-
! DTO
! Shape
|-
| <code>ResetPasswordCheckRequest</code>
| <code>{ token: str }</code>
|-
| <code>ResetPasswordConfirmRequest</code>
| <code>{ token: str, password: str }</code>
|-
| <code>ResetPasswordResponse</code>
| <code>{ detail: str }</code>
|-
| <code>ResetPasswordRequestTokenRequest</code>
| <code>{ username: str }</code>
|}

=== MFA specs ===

Plain-<code>BaseModel</code> DTOs in [<nowiki/>https://github.com/ohcnetwork/care/blob/develop/care/emr/resources/mfa/spec.py <code>care/emr/resources/mfa/spec.py</code>]. They carry no model binding and drive the TOTP/backup-code flow that writes <code>totp_secret</code> and <code>mfa_settings</code>.

{| class="wikitable"
|-
! DTO
! Direction
! Shape
|-
| <code>TOTPSetupResponse</code>
| response
| <code>{ uri: str, secret_key: str }</code>
|-
| <code>TOTPVerifyRequest</code>
| request
| <code>{ code: str }</code>
|-
| <code>TOTPVerifyResponse</code>
| response
| <code>{ backup_codes: list[str] }</code>
|-
| <code>PasswordVerifyRequest</code>
| request
| <code>{ password: str }</code>
|-
| <code>MFALoginRequest</code>
| request
| <code>{ method: LoginMethod, code: str, temp_token: str }</code>
|-
| <code>MFALoginResponse</code>
| response
| <code>{ access: str, refresh: str }</code> (JWT pair)
|}

=== Validation rules (write specs) ===

{| class="wikitable"
|-
! Field
! Rule
! Source
|-
| <code>username</code>
| Matches <code>^[a-zA-Z0-9_-]{3,}$</code>; must not already exist (checked against the entire queryset, including deleted)
| <code>UserCreateSpec.validate_username</code>
|-
| <code>phone_number</code>
| Must not already exist on any user
| <code>UserCreateSpec.validate_phone_number</code>
|-
| <code>email</code>
| Must not already exist; must pass Django <code>validate_email</code>
| <code>UserCreateSpec.validate_user_email</code>
|-
| <code>password</code>
| If provided, must pass Django <code>validate_password</code> (else &quot;Password is too weak&quot;); <code>None</code> is allowed
| <code>UserCreateSpec.validate_password</code>
|-
| <code>gender</code>
| Must be a <code>GenderChoices</code> member
| type annotation
|-
| <code>geo_organization</code>
| Must reference an existing <code>Organization</code> with <code>org_type=&quot;govt&quot;</code>
| <code>UserUpdateSpec.perform_extra_deserialization</code>
|}

=== Server-maintained behaviour ===

* <code>role_orgs</code> on create — <code>UserCreateSpec.perform_extra_deserialization</code> copies <code>role_orgs</code> onto <code>obj._role_orgs</code> so the view can apply role/organization assignments after the user is saved. It is not a DB column.
* <code>set_password</code> — create hashes the supplied password via <code>obj.set_password(self.password)</code>, or sets an unusable password when it is <code>None</code>.
* Cache — <code>UserSpec</code> is <code>@cacheable(use_base_manager=True)</code>. Saving a <code>User</code> invalidates the cache via <code>post_save</code>, and <code>created_by</code> is read through <code>model_from_cache(UserSpec, ...)</code>. <code>use_base_manager=True</code> lets cached lookups resolve soft-deleted users.
* Computed read fields — <code>id</code> (from <code>external_id</code>), <code>profile_picture_url</code> (resolved), <code>mfa_enabled</code>, <code>role_orgs</code>, <code>flags</code>, <code>geo_organization</code>, <code>created_by</code>, and the current-user <code>organizations</code>/<code>facilities</code>/<code>permissions</code> are all populated in <code>perform_extra_serialization</code>, never copied straight from columns.

== Shared spec types ==

Defined in <code>care/emr/resources/base.py</code> and <code>care/emr/resources/common/</code>. No user spec binds these period and contact types; they belong to the shared resource vocabulary documented here for cross-reference.

{| class="wikitable"
|-
! Type
! Shape
! Source
|-
| <code>PeriodSpec</code>
| <code>{ start: datetime | None, end: datetime | None }</code> — both must be timezone-aware; <code>start ≤ end</code> enforced
| [<nowiki/>https://github.com/ohcnetwork/care/blob/develop/care/emr/resources/base.py <code>base.py</code>]
|-
| <code>Period</code>
| <code>{ id: str?, start: datetime?, end: datetime? }</code>, <code>extra=&quot;forbid&quot;</code>
| [<nowiki/>https://github.com/ohcnetwork/care/blob/develop/care/emr/resources/common/period.py <code>common/period.py</code>]
|-
| <code>ContactPoint</code>
| <code>{ system: ContactPointSystemChoices, value: str, use: ContactPointUseChoices }</code>
| [<nowiki/>https://github.com/ohcnetwork/care/blob/develop/care/emr/resources/common/contact_point.py <code>common/contact_point.py</code>]
|-
| <code>PhoneNumber</code>
| E.164 string (<code>PhoneNumberValidator</code>)
| [<nowiki/>https://github.com/ohcnetwork/care/blob/develop/care/emr/resources/base.py <code>base.py</code>]
|}

<code>ContactPointSystemChoices</code>: <code>phone</code>, <code>fax</code>, <code>email</code>, <code>pager</code>, <code>url</code>, <code>sms</code>, <code>other</code>. <code>ContactPointUseChoices</code>: <code>home</code>, <code>work</code>, <code>temp</code>, <code>old</code>, <code>mobile</code>.

== Related models ==

=== <code>Skill</code> ===

Instance-wide competency definition. Extends [[References/Base models &amp; conventions|<code>BaseModel</code>]].

<syntaxhighlight lang="text">name        → CharField(255), unique
description → TextField (nullable, default "")</syntaxhighlight>
=== <code>UserSkill</code> ===

Through model joining <code>User</code> and <code>Skill</code>. Extends [[References/Base models &amp; conventions|<code>BaseModel</code>]].

<syntaxhighlight lang="text">user  → FK User (CASCADE, nullable)
skill → FK Skill (CASCADE, nullable)</syntaxhighlight>
The <code>unique_user_skill</code> constraint blocks duplicate <code>(skill, user)</code> pairs among non-deleted rows.

=== <code>UserFlag</code> ===

Feature flag attached to a single user. Extends <code>BaseFlag</code> (a [[References/Base models &amp; conventions|<code>BaseModel</code>]] subclass with a <code>flag</code> field).

<syntaxhighlight lang="text">user → FK User (CASCADE)
flag → CharField(1024)  (inherited from BaseFlag)</syntaxhighlight>
<code>flag_type = FlagType.USER</code>. The <code>unique_user_flag</code> constraint blocks duplicate <code>(user, flag)</code> pairs among non-deleted rows. Flags are read through <code>UserFlag.check_user_has_flag(user_id, flag_name)</code> and <code>get_all_flags(user_id)</code>, both cache-backed (TTL 1 day). <code>UserRetrieveSpec.flags</code> surfaces these names as a <code>list[str]</code>.

=== <code>PlugConfig</code> ===

Slug-keyed configuration for installed plugs. Extends plain <code>models.Model</code> (no audit/soft-delete fields).

<syntaxhighlight lang="text">slug → CharField(255), unique
meta → JSONField (default {})</syntaxhighlight>
=== <code>MobileOTP</code> ===

Defined in <code>care/facility/models/patient.py</code>. One-time password issued against a phone number for verification flows. Extends [[References/Base models &amp; conventions|<code>BaseModel</code>]].

<syntaxhighlight lang="text">is_used      → BooleanField (default False)
phone_number → CharField(14)  (mobile_or_landline_number_validator)
otp          → CharField(10)</syntaxhighlight>
== Methods &amp; save behaviour ==

<code>User</code> overrides neither <code>save()</code> nor <code>delete()</code>. Its helpers back the computed read fields:

* <code>get_cached_role_orgs()</code> — returns <code>cached_role_orgs</code> if set; otherwise loads from <code>OrganizationUser.get_cached_role_orgs(self.id)</code> and persists it via <code>save(update_fields=[&quot;cached_role_orgs&quot;])</code>. Read specs surface the result as <code>role_orgs</code>.
* <code>read_profile_picture_url()</code> — resolves <code>profile_picture_url</code> against <code>FACILITY_CDN</code> or the S3 bucket endpoint; returns <code>None</code> when unset. Backs every read spec's <code>profile_picture_url</code>.
* <code>is_mfa_enabled()</code> — <code>True</code> when <code>mfa_settings[&quot;totp&quot;][&quot;enabled&quot;]</code> is set; surfaced as <code>mfa_enabled</code>.
* <code>full_name</code> (property) — joins <code>prefix</code>, <code>get_full_name()</code>, and <code>suffix</code>.
* <code>check_username_exists(username)</code> (static) — checks across the entire (including deleted) queryset; used by <code>UserCreateSpec.validate_username</code>.
* <code>get_all_flags()</code> — delegates to <code>UserFlag.get_all_flags(self.id)</code>; surfaced as <code>flags</code> in <code>UserRetrieveSpec</code>.

<code>CustomUserManager</code> adds:

* <code>get_queryset()</code> filters <code>deleted=False</code>; <code>get_entire_queryset()</code> returns all rows.
* <code>create_superuser()</code> forces <code>phone_number=&quot;+919696969696&quot;</code>, <code>gender=&quot;non_binary&quot;</code>, and <code>user_type=&quot;administrator&quot;</code>.
* <code>make_random_password()</code> generates a secure password guaranteeing lower/upper/digit composition.

<code>UserFlag.save()</code> (via <code>BaseFlag</code>) validates the flag name against the registry and invalidates the per-flag and all-flags cache keys on every write.

== API integration notes ==

* The public identifier is <code>external_id</code>, returned as <code>id</code>. Never key on the integer PK or <code>username</code> alone.
* <code>CustomUserManager</code> honours <code>deleted</code>: soft-deleted users drop out of normal queries, but cached <code>UserSpec</code> lookups use the base manager (<code>use_base_manager=True</code>) and can still resolve them — for example as a <code>created_by</code> reference.
* Authorization is not stored on <code>User</code>. Access resolves through the roles/permissions/organization system, and <code>cached_role_orgs</code> is a platform-maintained cache — clients must not write it. New users supply <code>role_orgs</code> (organization + role UUIDs) at create time.
* <code>mfa_settings</code>, <code>preferences</code>, and <code>PlugConfig.meta</code> are open JSON bags for evolving config without migrations. <code>mfa_settings</code> is mutated by the MFA flow (<code>mfa/spec.py</code>), not by user create/update.
* <code>is_service_account</code> distinguishes machine/integration accounts from human users.
* Write through <code>UserCreateSpec</code> / <code>UserUpdateSpec</code>; read through <code>UserSpec</code> (list), <code>UserRetrieveSpec</code> (detail), <code>CurrentUserRetrieveSpec</code> (self), and <code>PublicUserReadSpec</code> (public). Picture URLs, MFA status, roles, flags, and nested org/creator objects are all computed server-side.

{{Related}}