# Face Attendance

A modern Flask attendance application with staff authentication, role-based access control, face enrollment, camera-based recognition, and attendance reporting.

## Roles

- `admin`: manages staff accounts, enrolls people, records attendance, and views reports.
- `operator`: enrolls people, uses the attendance kiosk, and views reports.
- `viewer`: read-only access to people and attendance reports.

Only admins can create staff accounts.

## Requirements

- Python 3.11 or 3.12 is recommended for production.
- Native build prerequisites for `face-recognition`/`dlib` may be required by your OS.
- A production WSGI server such as Gunicorn on Linux or Waitress on Windows.

## Setup

```powershell
py -3.12 -m venv .venv
.\.venv\Scripts\Activate.ps1
pip install -r requirements.txt
Copy-Item .env.example .env
```

Edit `.env` and set a strong `SECRET_KEY`. For production, set `APP_ENV=production` and use a durable database URL.

## Database

Initialize the database with migrations:

```powershell
$env:FLASK_APP = "wsgi:app"
flask db upgrade
flask create-admin
```

## Run Locally

```powershell
$env:FLASK_APP = "wsgi:app"
flask run
```

Open `http://127.0.0.1:5000` and sign in with the admin account created above.

## Tests

```powershell
pytest
```

The tests use an isolated SQLite database and disable CSRF only for test requests.

## Production Notes

- Use HTTPS. Production config enables secure cookies.
- Set `SECRET_KEY`, `DATABASE_URL`, and `APP_ENV=production`.
- Run `flask db upgrade` during deployment.
- Run behind a reverse proxy that forwards HTTPS headers correctly.
- Treat face encodings as biometric data. Restrict database access, define a retention policy, and back up securely.

## What Changed

- Replaced the legacy single-file Flask script with an application factory and Blueprints.
- Added SQLAlchemy models and Alembic migrations.
- Added Flask-Login authentication, admin-created accounts, password hashing, and role checks.
- Replaced raw SQL with ORM queries.
- Removed global enrollment state.
- Rebuilt the UI in English with reusable templates and responsive Bootstrap-based layouts.
- Added CSRF protection, secure cookie settings, security headers, validation, and error pages.
- Added pytest coverage for authentication, roles, models, and attendance recording.