From e094d8cbb7bb789382264ba2278e021576710119 Mon Sep 17 00:00:00 2001
From: Richard Jones <richard@cottagelabs.com>
Date: Thu, 30 Apr 2026 17:23:40 +0100
Subject: [PATCH 1/5] add support for user attributes on user accounts

---
 portality/constants.py                        |  21 ++
 portality/forms/validate.py                   |  20 +-
 .../migrate/4317_user_attributes/__init__.py  |   0
 .../apply_user_attributes.py                  | 185 ++++++++++++++++++
 portality/models/account.py                   |  79 ++++++++
 .../_account/includes/_edit_form_js.html      |  67 ++++++-
 .../_account/includes/_edit_user_form.html    |  57 +++++-
 portality/templates-v2/management/base.html   |  12 ++
 portality/view/account.py                     |  50 ++++-
 9 files changed, 473 insertions(+), 18 deletions(-)
 create mode 100644 portality/migrate/4317_user_attributes/__init__.py
 create mode 100644 portality/migrate/4317_user_attributes/apply_user_attributes.py

diff --git a/portality/constants.py b/portality/constants.py
index 4ed8d7c3a5..a8569d71f3 100644
--- a/portality/constants.py
+++ b/portality/constants.py
@@ -113,6 +113,27 @@
 # TODO add ultra_bulk_delete and refactor view to use constants
 ROLE_ADMIN_REPORT_WITH_NOTES = "ultra_admin_reports_with_notes"  # MUST start with ultra_ so that superusers don't gain
 
+USER_ATTR__WORKFLOW = "workflow"
+USER_ATTR__LANGUAGE = "language"
+USER_ATTR__COUNTRY = "country"
+USER_ATTR__TAG = "tag"
+
+USER_ATTR__ALL = [
+    USER_ATTR__WORKFLOW,
+    USER_ATTR__LANGUAGE,
+    USER_ATTR__COUNTRY,
+    USER_ATTR__TAG
+]
+
+EWF__TRIAGE = "Triage"
+EWF__QUICK_FAIL = "Quick Fail"
+EWF__QUALITY_REVIEW = "Quality Review"
+
+EWF__ALL_STAGES = [
+    EWF__TRIAGE,
+    EWF__QUICK_FAIL,
+    EWF__QUALITY_REVIEW
+]
 
 CRON_NEVER = {"month": "2", "day": "31", "day_of_week": "*", "hour": "*", "minute": "*"}
 
diff --git a/portality/forms/validate.py b/portality/forms/validate.py
index 228ca2b803..e3afc275c3 100644
--- a/portality/forms/validate.py
+++ b/portality/forms/validate.py
@@ -670,9 +670,13 @@ def __init__(self, message=None):
 
     def __call__(self, form, field):
         if field.data is not None and field.data != '':
-            check = get_currency_code(field.data, fail_if_not_found=True)
-            if check is None:
-                raise validators.ValidationError(self.message)
+            value = field.data
+            if not isinstance(value, list):
+                value = [value]
+            for v in value:
+                check = get_currency_code(v, fail_if_not_found=True)
+                if check is None:
+                    raise validators.ValidationError(self.message)
 
 
 class CurrentISOLanguage(object):
@@ -683,6 +687,10 @@ def __init__(self, message=None):
 
     def __call__(self, form, field):
         if field.data is not None and field.data != '':
-            check = isolang.find(field.data)
-            if check is None:
-                raise validators.ValidationError(self.message)
+            value = field.data
+            if not isinstance(value, list):
+                value = [value]
+            for v in value:
+                check = isolang.find(v)
+                if check is None:
+                    raise validators.ValidationError(self.message)
diff --git a/portality/migrate/4317_user_attributes/__init__.py b/portality/migrate/4317_user_attributes/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/portality/migrate/4317_user_attributes/apply_user_attributes.py b/portality/migrate/4317_user_attributes/apply_user_attributes.py
new file mode 100644
index 0000000000..dde8fd1a38
--- /dev/null
+++ b/portality/migrate/4317_user_attributes/apply_user_attributes.py
@@ -0,0 +1,185 @@
+"""Migration script to add user attributes (country and language) based on Editor Group CSVs.
+
+Usage:
+    python -m portality.migrate.4317_user_attributes /path/to/countries.csv /path/to/languages.csv
+
+The first CSV should have two columns with headers: the first is the country name, the second the Editor Group name.
+The second CSV should have two columns with headers: the first is the language name, the second the Editor Group name.
+
+For each row this script finds the EditorGroup by name, collects the accounts attached to the group
+(maned, editor, associates) and schedules the appropriate ISO code to be added to each user's attributes
+('country' or 'language'). All validations are done against the portality datasets (pycountry/isolang).
+
+The script collates all labels for each user and performs a single save per user at the end.
+"""
+
+import csv
+import sys
+import argparse
+from collections import defaultdict
+
+from portality.models.editors import EditorGroup
+from portality.models.account import Account
+from portality import datasets, constants
+from portality.lib import isolang
+from portality.core import app
+
+
+def resolve_country_code(name: str):
+    """Return a 2-character country code for a given country name, or None if not found."""
+    if not name:
+        return None
+    code = datasets.get_country_code(name, fail_if_not_found=True)
+    return code
+
+
+def resolve_language_code(name: str):
+    """Return a 2-character language code (alpha2) for a given language name, or None if not found."""
+    if not name:
+        return None
+    lang = isolang.find(name)
+    if not lang:
+        return None
+    # isolang.find returns a dict with 'alpha2' key
+    return lang.get('alpha2')
+
+
+def read_pairs_from_csv(path):
+    """Read CSV and return list of (label, editor_group_name) pairs using the first two columns.
+
+    Expects two columns with headers; will take the first and second header values.
+    """
+    pairs = []
+    with open(path, newline='') as fh:
+        reader = csv.DictReader(fh)
+        headers = reader.fieldnames
+        if not headers or len(headers) < 2:
+            raise ValueError(f"CSV at {path} must have at least two columns with headers")
+        col_label = headers[0]
+        col_group = headers[1]
+        for row in reader:
+            label = (row.get(col_label) or '').strip()
+            group = (row.get(col_group) or '').strip()
+            if label and group:
+                pairs.append((label, group))
+    return pairs
+
+
+def collate_attributes(country_pairs, language_pairs):
+    """Process pairs and collate desired attributes per account id.
+
+    Returns mapping: account_id -> { 'country': set(...), 'language': set(...) }
+    """
+    account_attrs = defaultdict(lambda: {'country': set(), 'language': set()})
+
+    def _collect_for_group(group_name, code, attr_type):
+        eg = EditorGroup.group_by_name(group_name)
+        if eg is None:
+            app.logger.warning(f"EditorGroup not found: '{group_name}'")
+            print(f"WARNING: EditorGroup not found: '{group_name}'")
+            return
+
+        # collect maned, editor, associates
+        acct_ids = set()
+        if eg.maned:
+            acct_ids.add(eg.maned)
+        if eg.editor:
+            acct_ids.add(eg.editor)
+        for a in eg.associates or []:
+            acct_ids.add(a)
+
+        for aid in acct_ids:
+            if not aid:
+                continue
+            account_attrs[aid][attr_type].add(code)
+
+    # countries
+    for country_name, group_name in country_pairs:
+        code = resolve_country_code(country_name)
+        if code is None:
+            app.logger.warning(f"Unable to resolve country '{country_name}'")
+            print(f"WARNING: Unable to resolve country '{country_name}'")
+            continue
+        _collect_for_group(group_name, code.upper(), 'country')
+
+    # languages
+    for lang_name, group_name in language_pairs:
+        code = resolve_language_code(lang_name)
+        if code is None:
+            app.logger.warning(f"Unable to resolve language '{lang_name}'")
+            print(f"WARNING: Unable to resolve language '{lang_name}'")
+            continue
+        _collect_for_group(group_name, code.upper(), 'language')
+
+    return account_attrs
+
+
+def apply_attributes(account_attrs, dry_run=False):
+    """Apply collated attributes to Account objects and save them once each.
+
+    Returns a summary dict.
+    """
+    summary = {'updated': 0, 'skipped_missing_account': 0}
+    for aid, attrs in account_attrs.items():
+        acc = Account.pull(aid)
+        if acc is None:
+            summary['skipped_missing_account'] += 1
+            app.logger.warning(f"Account not found: {aid}")
+            print(f"WARNING: Account not found: {aid}")
+            continue
+
+        changed = False
+        # countries
+        for c in sorted(attrs.get('country', [])):
+            try:
+                if not acc.has_attribute(constants.USER_ATTR__COUNTRY, c):
+                    acc.add_attribute(constants.USER_ATTR__COUNTRY, c)
+                    changed = True
+            except Exception:
+                app.logger.exception(f"Failed to add country attribute '{c}' to account {aid}")
+
+        for l in sorted(attrs.get('language', [])):
+            try:
+                if not acc.has_attribute(constants.USER_ATTR__LANGUAGE, l):
+                    acc.add_attribute(constants.USER_ATTR__LANGUAGE, l)
+                    changed = True
+            except Exception:
+                app.logger.exception(f"Failed to add language attribute '{l}' to account {aid}")
+
+        if changed:
+            if dry_run:
+                print(f"DRY RUN: Would save account {aid} with new attributes: {attrs}")
+            else:
+                acc.save()
+                print(f"Saved account {aid} (added {len(attrs.get('country', []))} country(s), {len(attrs.get('language', []))} language(s))")
+            summary['updated'] += 1
+
+    return summary
+
+
+def main():
+    parser = argparse.ArgumentParser(description='Add user attributes from Editor Group CSVs')
+    parser.add_argument('countries_csv', help='CSV: first col country name, second col Editor Group name')
+    parser.add_argument('languages_csv', help='CSV: first col language name, second col Editor Group name')
+    parser.add_argument('--dry-run', action='store_true', help='Do not save changes, just report')
+
+    args = parser.parse_args()
+
+    country_pairs = read_pairs_from_csv(args.countries_csv)
+    language_pairs = read_pairs_from_csv(args.languages_csv)
+
+    print(f"Read {len(country_pairs)} country rows and {len(language_pairs)} language rows")
+
+    account_attrs = collate_attributes(country_pairs, language_pairs)
+
+    print(f"Collated attributes for {len(account_attrs)} accounts")
+
+    summary = apply_attributes(account_attrs, dry_run=args.dry_run)
+
+    print("Done. Summary:")
+    print(summary)
+
+
+if __name__ == '__main__':
+    main()
+
diff --git a/portality/models/account.py b/portality/models/account.py
index bd733d98f2..714917a77a 100644
--- a/portality/models/account.py
+++ b/portality/models/account.py
@@ -219,6 +219,56 @@ def set_role(self, role):
             role = [role]
         self.data["role"] = role
 
+    ###############################
+    ## user attributes
+
+    @property
+    def attributes(self):
+        return self.data.get("attributes")
+
+    @attributes.deleter
+    def attributes(self):
+        if "attributes" in self.data:
+            del self.data["attributes"]
+
+    @property
+    def attribute_workflow(self):
+        return self.data.get("attributes", {}).get(constants.USER_ATTR__WORKFLOW, [])
+
+    @property
+    def attribute_language(self):
+        return self.data.get("attributes", {}).get(constants.USER_ATTR__LANGUAGE, [])
+
+    @property
+    def attribute_country(self):
+        return self.data.get("attributes", {}).get(constants.USER_ATTR__COUNTRY, [])
+
+    @property
+    def attribute_tag(self):
+        return self.data.get("attributes", {}).get(constants.USER_ATTR__TAG, [])
+
+    def add_attribute(self, attribute_type, value):
+        if attribute_type not in constants.USER_ATTR__ALL:
+            raise ValueError("Unknown user attribute type: {}".format(attribute_type))
+        if "attributes" not in self.data:
+            self.data["attributes"] = {}
+        if attribute_type not in self.data["attributes"]:
+            self.data["attributes"][attribute_type] = []
+        if value not in self.data["attributes"][attribute_type]:
+            self.data["attributes"][attribute_type].append(value)
+
+    def has_attribute(self, attribute_type, value):
+        if attribute_type not in constants.USER_ATTR__ALL:
+            raise ValueError("Unknown user attribute type: {}".format(attribute_type))
+        return value in self.data.get("attributes", {}).get(attribute_type, [])
+
+    def get_attributes(self, attribute_type):
+        if attribute_type not in constants.USER_ATTR__ALL:
+            raise ValueError("Unknown user attribute type: {}".format(attribute_type))
+        return self.data.get("attributes", {}).get(attribute_type, [])
+
+    #######################
+
     def prep(self):
         self.data['last_updated'] = dates.now_str()
 
@@ -273,3 +323,32 @@ def is_enable_publisher_email(cls) -> bool:
         # TODO: in the long run this needs to move out to the user's email preferences but for now it
         # is here to replicate the behaviour in the code it replaces
         return app.config.get("ENABLE_PUBLISHER_EMAIL", False)
+
+    @classmethod
+    def find_by_attributes(cls, attribute_types_and_values:list[tuple[str, str]], limit=1000):
+        q = AttributesQuery(attribute_types_and_values, limit)
+        return cls.object_query(q.query())
+
+
+class AttributesQuery:
+    def __init__(self, attribute_types_and_values, page_size):
+        self._tup = attribute_types_and_values
+        self._size = page_size
+
+    def query(self):
+        musts = []
+        for t, v in self._tup.items():
+            if not isinstance(v, list):
+                v = [v]
+            f = {"terms": {f"attribute.{t}.exact": v}}
+            musts.append(f)
+
+        q = {
+            "query": {
+                "bool": {
+                    "must": musts
+                }
+            },
+            "size": self._size
+        }
+        return q
diff --git a/portality/templates-v2/_account/includes/_edit_form_js.html b/portality/templates-v2/_account/includes/_edit_form_js.html
index bb6cf3ebfe..d313f79361 100644
--- a/portality/templates-v2/_account/includes/_edit_form_js.html
+++ b/portality/templates-v2/_account/includes/_edit_form_js.html
@@ -2,8 +2,71 @@
 
 <script type="text/javascript">
     jQuery(document).ready(function($) {
-        // Populate select2 role picker
-        $('#roles').select2({tags:["{{current_user.all_top_level_roles()|join('","')|safe}}"]})
+        // Populate select2 role picker (multiple select)
+        // Use JSON serialization for the available tags to avoid quoting issues
+        var roleTags = {{ current_user.all_top_level_roles()|tojson }};
+        $('#roles').select2({
+            tags: roleTags,
+            tokenSeparators: [',', ';'],
+            placeholder: 'Select or type roles',
+            width: '100%',
+            closeOnSelect: false, // keep dropdown open for multiple selection
+            allowClear: true
+        });
+
+        var $attrWf = $("#attribute_workflow");
+        $attrWf.select2({
+            placeholder: 'Select workflow stages',
+            width: '100%',
+            allowClear: true,
+            closeOnSelect: $attrWf.prop('multiple') ? false : true
+        });
+
+        // Initialise select2 for language field. If the underlying select is multiple,
+        // keep the dropdown open on select (closeOnSelect = false).
+        var $attrLang = $("#attribute_language");
+        $attrLang.select2({
+            placeholder: 'Select language',
+            width: '100%',
+            allowClear: true,
+            closeOnSelect: $attrLang.prop('multiple') ? false : true
+        });
+
+        let $attrCountry = $("#attribute_country");
+        $attrCountry.select2({
+            placeholder: 'Select country',
+            width: '100%',
+            allowClear: true,
+            closeOnSelect: $attrCountry.prop('multiple') ? false : true
+        })
+
+        let $otherAttr = $("#attribute_tag");
+        // Turn a simple text field into a free-text tag entry box.
+        // Use comma as the token separator so users can enter tags separated by commas.
+        $otherAttr.select2({
+            tags: true,
+            tokenSeparators: [','],
+            placeholder: 'Add tags',
+            width: '100%',
+            allowClear: true,
+            closeOnSelect: true,
+            // Remove the built-in "Searching..." message/spinner since there is
+            // no remote data source — return an empty string for the searching
+            // message so the spinner text is not shown.
+            language: {
+                searching: function() { return ''; }
+            },
+            // Ensure markup isn't escaped so empty searching messages don't show markup
+            escapeMarkup: function (markup) { return markup; },
+            // Normalize entered tags by trimming whitespace and preventing empty tags
+            createTag: function (params) {
+                var term = $.trim(params.term);
+                if (term === '') {
+                    return null;
+                }
+                return { id: term, text: term };
+            }
+        });
 
         // Scroll to errors
         let firstError = $('.errors')[0];
diff --git a/portality/templates-v2/_account/includes/_edit_user_form.html b/portality/templates-v2/_account/includes/_edit_user_form.html
index bca8acce8a..16294bc2aa 100644
--- a/portality/templates-v2/_account/includes/_edit_user_form.html
+++ b/portality/templates-v2/_account/includes/_edit_user_form.html
@@ -1,10 +1,21 @@
 {% from "includes/_formhelpers.html" import render_field %}
 
+<style>
+    .select2-container-multi .select2-choices .select2-search-field input.select2-active {
+        background-image: none !important;
+    }
+</style>
+
 <h2>Edit your details</h2>
 
 <form id="edit_user" class="form form--compact" action="" method="POST">
 
     <fieldset>
+        {# Full name #}
+        <div class="form__question">
+            {{ render_field(form.name, placeholder="Firstname Lastname") }}
+        </div>
+
         {# User role #}
         {% if current_user.is_super %}
             <div class="form__question">
@@ -19,10 +30,48 @@ <h2>Edit your details</h2>
             </dl>
         {% endif %}
 
-        {# Full name #}
-        <div class="form__question">
-            {{ render_field(form.name, placeholder="Firstname Lastname") }}
-        </div>
+        {# User Attributes #}
+        {# only show this to admins, and only show if the user has at least the associate_editor role (editors and admins will have
+            that role implicitly) #}
+        {% if account.has_role(constants.ROLE_ASSOCIATE_EDITOR) %}
+            <h2>Editor User Attributes</h2>
+            <p>Attributes supplied here will control which workflow items the user will be able to work on in the
+            new Editorial Workflow</p>
+            {% if current_user.is_super %}
+                <div class="form__question">
+                    {{ render_field(form.attribute_workflow, value=account.attribute_workflow|join(','), style="width: 75%") }}
+                </div>
+                <div class="form__question">
+                    {{ render_field(form.attribute_language, value=account.attribute_language|join(','), style="width: 75%") }}
+                </div>
+                <div class="form__question">
+                    {{ render_field(form.attribute_country, value=account.attribute_country|join(','), style="width: 75%") }}
+                </div>
+                <div class="form__question">
+                    {{ render_field(form.attribute_tag, value=account.attribute_tag|join(','), style="width: 75%") }}
+                </div>
+            {% else %}
+                <dl>
+                    <dt>Workflow Participation</dt>
+                    {% for wf in account.attribute_workflow %}
+                        <dd class="tag">{{ wf }}</dd>
+                    {% endfor %}
+                    <dt>Language</dt>
+                    {% for language in account.attribute_language %}
+                        <dd class="tag">{{ datasets.name_for_lang(language) }}</dd>
+                    {% endfor %}
+                    <dt>Country</dt>
+                    {% for country in account.attribute_country %}
+                        <dd class="tag">{{ datasets.get_country_name(country) }}</dd>
+                    {% endfor %}
+                    <dt>Other Attribute Tags</dt>
+                    {% for tag in account.attribute_tag %}
+                        <dd class="tag">{{ tag }}</dd>
+                    {% endfor %}
+                </dl>
+            {% endif %}
+        {% endif %}
+
     </fieldset>
     <fieldset>
         <p class="alert">
diff --git a/portality/templates-v2/management/base.html b/portality/templates-v2/management/base.html
index af33fe854a..1d9dc0f4ba 100644
--- a/portality/templates-v2/management/base.html
+++ b/portality/templates-v2/management/base.html
@@ -169,7 +169,19 @@ <h1>
                         {% endif %}
                     </dl>
                 </nav>
+{#                <div>#}
+{#                    {% for attribute in current_user.get_attributes(constants.USER_ATTR__LANGUAGE) %}#}
+{#                        <span class="label tag">Language:{{ datasets.name_for_lang(attribute) }}</span>#}
+{#                    {% endfor %}#}
+{#                    {% for attribute in current_user.get_attributes(constants.USER_ATTR__COUNTRY) %}#}
+{#                        <span class="label tag">Country:{{ datasets.get_country_name(attribute) }}</span>#}
+{#                    {% endfor %}#}
+{#                    {% for attribute in current_user.get_attributes(constants.USER_ATTR__TAG) %}#}
+{#                        <span class="label tag">Tag:{{ attribute }}</span>#}
+{#                    {% endfor %}#}
+{#                </div>#}
             </div>
+
         </header>
         {% include "includes/_flash_notification.html" %}
         {% block management_content %}{% endblock %}
diff --git a/portality/view/account.py b/portality/view/account.py
index 61162afab6..a21f6adc5e 100644
--- a/portality/view/account.py
+++ b/portality/view/account.py
@@ -3,14 +3,17 @@
 from flask import Blueprint, request, url_for, flash, redirect, make_response
 from flask import render_template, abort
 from flask_login import login_user, logout_user, current_user, login_required
-from wtforms import StringField, HiddenField, PasswordField, DecimalField, validators, Form
+from wtforms import StringField, HiddenField, PasswordField, DecimalField, validators, Form, SelectMultipleField
 
 from portality import util
 from portality import constants
 from portality.core import app
+from portality.datasets import language_options, country_options
 from portality.decorators import ssl_required, write_required
+from portality.forms.application_forms import MultiSelectBuilder, iso_language_list
 from portality.models import Account, Event
-from portality.forms.validate import DataOptional, EmailAvailable, ReservedUsernames, IdAvailable, IgnoreUnchanged
+from portality.forms.validate import DataOptional, EmailAvailable, ReservedUsernames, IdAvailable, IgnoreUnchanged, \
+    CurrentISOLanguage
 from portality.bll import DOAJ
 from portality.ui.messages import Messages
 
@@ -48,6 +51,22 @@ class UserEditForm(Form):
     ])
     email_confirm = StringField('Confirm email address')
     roles = StringField('User roles')
+    attribute_workflow = SelectMultipleField(
+        "Workflow Participation",
+        choices=[(x,x) for x in constants.EWF__ALL_STAGES]
+    )
+    attribute_language = SelectMultipleField(
+        'Can Review Languages',
+        [
+            CurrentISOLanguage()
+        ],
+        choices=language_options
+    )
+    attribute_country = SelectMultipleField(
+        'Can Review Applications from Countries',
+        choices=country_options
+    )
+    attribute_tag = StringField('Other User Attributes')
     password_change = PasswordField('Change password', [
         validators.EqualTo('password_confirm', message='Passwords must match'),
     ])
@@ -106,10 +125,29 @@ def username(username):
         if 'password_change' in newdata and len(newdata['password_change']) > 0 and not newdata['password_change'].startswith('sha1'):
             acc.set_password(newdata['password_change'])
 
-        # only super users can re-write roles
-        if "roles" in newdata and current_user.is_super:
-            new_roles = [r.strip() for r in newdata.get("roles").split(",")]
-            acc.set_role(new_roles)
+        # only super users can re-write roles and attributes
+        if current_user.is_super:
+            if "roles" in newdata:
+                new_roles = [r.strip() for r in newdata.get("roles").split(",")]
+                acc.set_role(new_roles)
+
+            # remove old attributes
+            del acc.attributes
+
+            # apply new attributes
+            if hasattr(form, "attribute_workflow") and form.attribute_workflow.data:
+                for aw in form.attribute_workflow.data:
+                    acc.add_attribute(constants.USER_ATTR__WORKFLOW, aw)
+            if hasattr(form, "attribute_language") and form.attribute_language.data:
+                for al in form.attribute_language.data:
+                    acc.add_attribute(constants.USER_ATTR__LANGUAGE, al)
+            if hasattr(form, "attribute_country") and form.attribute_country.data:
+                for ac in form.attribute_country.data:
+                    acc.add_attribute(constants.USER_ATTR__COUNTRY, ac)
+            if "attribute_tag" in newdata:
+                for at in newdata["attribute_tag"].split(","):
+                    acc.add_attribute(constants.USER_ATTR__TAG, at.strip())
+
 
         if "marketing_consent" in newdata:
             acc.set_marketing_consent(newdata["marketing_consent"] == "true")

From 5a99d30a77af18aa470d33032ca6780ea20b2eb5 Mon Sep 17 00:00:00 2001
From: Richard Jones <richard@cottagelabs.com>
Date: Wed, 6 May 2026 20:37:18 +0100
Subject: [PATCH 2/5] updated user test scripts and minor ui changes associated

---
 .../user_management/user_management.yml       |  42 +++++-
 doajtest/unit/test_models.py                  |  56 +++++++-
 portality/models/account.py                   |  10 +-
 .../_account/includes/_edit_user_form.html    |  42 ++++--
 portality/view/account.py                     | 126 ++++++++++--------
 5 files changed, 199 insertions(+), 77 deletions(-)

diff --git a/doajtest/testbook/user_management/user_management.yml b/doajtest/testbook/user_management/user_management.yml
index 55795719bd..cd9f2a55b1 100644
--- a/doajtest/testbook/user_management/user_management.yml
+++ b/doajtest/testbook/user_management/user_management.yml
@@ -88,6 +88,7 @@ tests:
     - You are taken to the new user form
     - The "api" role and "publisher" role are pre-filled in the Roles field.
     - The ID box is prefilled with an alphanumeric value
+    - There are no user attributes options available in the form
   - step: Click in the "Roles" field
     results:
     - A pull-down menu appears with all the allowed roles
@@ -95,14 +96,13 @@ tests:
     results:
     - It is editable
     - Change the ID to something memorable
-  - step: Enter test values into each field in the form
-  - step: Click "Create User"
+  - step: Enter test values into each remaining field in the form
+  - step: Click "Register"
     results:
     - You are taken back to the /account
-    - You see a message  Debug mode - url for verify is /account/reset/f1b6b123b5f34cd0aa81807a90a096f2
-    - /account/reset/f1b6b123b5f34cd0aa81807a90a096f2 is a link and is clickable DO
-      NOT CLICK IT YET
-    - 'You see a message '' Account created for dom+test5@doaj.org. View Account:
+    - You see a message like "Debug mode - url for verify is ..."
+    - The verify URL in the message is a link and is clickable DO NOT CLICK IT YET
+    - 'You see a message '' Account created for [some email address]. View Account:
       /account/testingID'''
     - /account/testingID is a link and is clickable DO NOT CLICK IT YET
     - The ID (/testerID in the example above) matches the ID you chose on line 11
@@ -145,9 +145,26 @@ tests:
     - Your account page is shown
     - Your ID and email address are displayed
     - You can see your user roles but you cannot edit them
+    - You do not have any user attribute fields available to you
   - include:
       fragment: edit_account
-  
+
+- title: Edit your own user account (editor / associate editor)
+  context:
+    role: editor
+  setup:
+  - create an editor account with some attributes set
+  steps:
+  - step: Log in to your editor account
+  - step: Go to Settings under My Account
+    results:
+    - Your account page is shown
+    - Your ID and email address are displayed
+    - You can see your user roles but you cannot edit them
+    - You can see your user attributes but you cannot edit them
+  - include:
+      fragment: edit_account
+
 - title: Edit your own user account (admin)
   context:
     role: admin
@@ -157,6 +174,12 @@ tests:
     results:
     - Your account page is shown
     - Your ID and email address are displayed
+    - You can see your user roles and you can edit them
+    - You can see your user attributes and you can edit them
+  - step: Add one or more workflow attributes
+  - step: Add one or more language attributes
+  - step: Add one or more country attributes
+  - step: Add one or more free text tag attributes
   - include:
       fragment: edit_account
   - step: Log back in to your admin account and go to Settings
@@ -180,6 +203,10 @@ tests:
     - The user's account page is displayed
     - A warning alerts you 'NOTE you are editing a user account that is not your own.
       Be careful!'
+  - step: Add one or more workflow attributes
+  - step: Add one or more language attributes
+  - step: Add one or more country attributes
+  - step: Add one or more free text tag attributes
   - include:
       fragment: edit_account
   - include:
@@ -192,6 +219,7 @@ tests:
   - step: Put the username of the account you deleted into the search box
     results:
     - There are no results to display
+
 - title: User account with journals/applications
   context:
     role: admin
diff --git a/doajtest/unit/test_models.py b/doajtest/unit/test_models.py
index 348eb1bd8b..91a983fdff 100644
--- a/doajtest/unit/test_models.py
+++ b/doajtest/unit/test_models.py
@@ -585,13 +585,15 @@ def test_08_iterate(self):
     def test_09_account(self):
         # Make a new account
         acc = models.Account.make_account(email='user@example.com', username='mrs_user',
-                                          roles=['api', 'associate_editor'])
+                                          roles=['api', 'associate_editor'],
+                                          attributes={constants.USER_ATTR__WORKFLOW: ["triage"]})
 
         # Check the new user has the right roles
         assert acc.has_role('api')
         assert acc.has_role('associate_editor')
         assert not acc.has_role('admin')
         assert acc.marketing_consent is None
+        assert acc.has_attribute(constants.USER_ATTR__WORKFLOW, "triage")
 
         # check the api key has been generated
         assert acc.api_key is not None
@@ -624,6 +626,58 @@ def test_09_account(self):
         acc2.save()
         assert acc2.api_key is not None
 
+    def test_09a_account_attributes(self):
+        acc = models.Account.make_account(email='user@example.com', username='mrs_user',
+                                          roles=['api', 'associate_editor'],
+                                          attributes={constants.USER_ATTR__WORKFLOW: ["triage"]})
+        assert acc.has_attribute(constants.USER_ATTR__WORKFLOW, "triage")
+
+        acc.add_attribute(constants.USER_ATTR__WORKFLOW, "quality")
+        acc.add_attribute(constants.USER_ATTR__LANGUAGE, "FR")
+        acc.add_attribute(constants.USER_ATTR__LANGUAGE, "EN")
+        acc.add_attribute(constants.USER_ATTR__COUNTRY, "DE")
+        acc.add_attribute(constants.USER_ATTR__COUNTRY, "ES")
+        acc.add_attribute(constants.USER_ATTR__TAG, "test")
+
+        raw = acc.attributes
+        assert raw.get(constants.USER_ATTR__WORKFLOW) == ["triage", "quality"]
+        assert raw.get(constants.USER_ATTR__LANGUAGE) == ["FR", "EN"]
+        assert raw.get(constants.USER_ATTR__COUNTRY) == ["DE", "ES"]
+        assert raw.get(constants.USER_ATTR__TAG) == ["test"]
+
+        assert acc.attribute_workflow == ["triage", "quality"]
+        assert acc.attribute_language == ["FR", "EN"]
+        assert acc.attribute_country == ["DE", "ES"]
+        assert acc.attribute_tag == ["test"]
+
+        assert acc.has_attribute(constants.USER_ATTR__WORKFLOW, "triage")
+        assert acc.has_attribute(constants.USER_ATTR__WORKFLOW, "quality")
+        assert acc.has_attribute(constants.USER_ATTR__LANGUAGE, "FR")
+        assert acc.has_attribute(constants.USER_ATTR__LANGUAGE, "EN")
+        assert acc.has_attribute(constants.USER_ATTR__COUNTRY, "DE")
+        assert acc.has_attribute(constants.USER_ATTR__COUNTRY, "ES")
+        assert acc.has_attribute(constants.USER_ATTR__TAG, "test")
+
+        assert acc.get_attributes(constants.USER_ATTR__WORKFLOW) == ["triage", "quality"]
+        assert acc.get_attributes(constants.USER_ATTR__LANGUAGE) == ["FR", "EN"]
+        assert acc.get_attributes(constants.USER_ATTR__COUNTRY) == ["DE", "ES"]
+        assert acc.get_attributes(constants.USER_ATTR__TAG) == ["test"]
+
+        del acc.attributes
+        raw = acc.attributes
+        assert raw is None
+
+        # try some error cases
+        with self.assertRaises(ValueError):
+            acc.add_attribute("whatever", "something")
+
+        with self.assertRaises(ValueError):
+            acc.has_attribute("whatever", "something")
+
+        with self.assertRaises(ValueError):
+            acc.get_attributes("whatever")
+
+
     def test_10_block(self):
         a = models.Article()
         a.save()
diff --git a/portality/models/account.py b/portality/models/account.py
index 714917a77a..4db0956c14 100644
--- a/portality/models/account.py
+++ b/portality/models/account.py
@@ -19,7 +19,7 @@ def __init__(self, **kwargs):
         super(Account, self).__init__(**kwargs)
 
     @classmethod
-    def make_account(cls, email, username=None, name=None, roles=None, associated_journal_ids=None):
+    def make_account(cls, email, username=None, name=None, roles=None, associated_journal_ids=None, attributes:dict[str, list]=None):
         if roles is None:
             roles = []
 
@@ -39,9 +39,17 @@ def make_account(cls, email, username=None, name=None, roles=None, associated_jo
 
         for role in roles:
             a.add_role(role)
+
         for jid in associated_journal_ids:
             a.add_journal(jid)
 
+        if attributes is not None:
+            for attr_type, value in attributes.items():
+                if not isinstance(value, list):
+                    value = [value]
+                for v in value:
+                    a.add_attribute(attr_type, v)
+
         # New accounts don't have passwords set - create a reset token for password.
         reset_token = uuid.uuid4().hex
         # give them 14 days to create their first password if timeout not specified in config
diff --git a/portality/templates-v2/_account/includes/_edit_user_form.html b/portality/templates-v2/_account/includes/_edit_user_form.html
index 16294bc2aa..25640bb0d3 100644
--- a/portality/templates-v2/_account/includes/_edit_user_form.html
+++ b/portality/templates-v2/_account/includes/_edit_user_form.html
@@ -35,7 +35,7 @@ <h2>Edit your details</h2>
             that role implicitly) #}
         {% if account.has_role(constants.ROLE_ASSOCIATE_EDITOR) %}
             <h2>Editor User Attributes</h2>
-            <p>Attributes supplied here will control which workflow items the user will be able to work on in the
+            <p>Attributes defined here will control which workflow items you will be able to work on in the
             new Editorial Workflow</p>
             {% if current_user.is_super %}
                 <div class="form__question">
@@ -53,21 +53,37 @@ <h2>Editor User Attributes</h2>
             {% else %}
                 <dl>
                     <dt>Workflow Participation</dt>
-                    {% for wf in account.attribute_workflow %}
-                        <dd class="tag">{{ wf }}</dd>
-                    {% endfor %}
+                    {% if account.attribute_workflow %}
+                        {% for wf in account.attribute_workflow %}
+                            <dd class="tag">{{ wf }}</dd>
+                        {% endfor %}
+                    {% else %}
+                        <dd style="font-size: .889em">None</dd>
+                    {% endif %}
                     <dt>Language</dt>
-                    {% for language in account.attribute_language %}
-                        <dd class="tag">{{ datasets.name_for_lang(language) }}</dd>
-                    {% endfor %}
+                    {% if account.attribute_language %}
+                        {% for language in account.attribute_language %}
+                            <dd class="tag">{{ datasets.name_for_lang(language) }}</dd>
+                        {% endfor %}
+                    {% else %}
+                        <dd style="font-size: .889em">None</dd>
+                    {% endif %}
                     <dt>Country</dt>
-                    {% for country in account.attribute_country %}
-                        <dd class="tag">{{ datasets.get_country_name(country) }}</dd>
-                    {% endfor %}
+                    {% if account.attribute_country %}
+                        {% for country in account.attribute_country %}
+                            <dd class="tag">{{ datasets.get_country_name(country) }}</dd>
+                        {% endfor %}
+                    {% else %}
+                        <dd style="font-size: .889em">None</dd>
+                    {% endif %}
                     <dt>Other Attribute Tags</dt>
-                    {% for tag in account.attribute_tag %}
-                        <dd class="tag">{{ tag }}</dd>
-                    {% endfor %}
+                    {% if account.attribute_tag %}
+                        {% for tag in account.attribute_tag %}
+                            <dd class="tag">{{ tag }}</dd>
+                        {% endfor %}
+                    {% else %}
+                        <dd style="font-size: .889em">None</dd>
+                    {% endif %}
                 </dl>
             {% endif %}
         {% endif %}
diff --git a/portality/view/account.py b/portality/view/account.py
index a21f6adc5e..d27f9e55f3 100644
--- a/portality/view/account.py
+++ b/portality/view/account.py
@@ -1,6 +1,6 @@
 import uuid, json
 
-from flask import Blueprint, request, url_for, flash, redirect, make_response
+from flask import Blueprint, request, url_for, flash, redirect, make_response, g
 from flask import render_template, abort
 from flask_login import login_user, logout_user, current_user, login_required
 from wtforms import StringField, HiddenField, PasswordField, DecimalField, validators, Form, SelectMultipleField
@@ -9,7 +9,7 @@
 from portality import constants
 from portality.core import app
 from portality.datasets import language_options, country_options
-from portality.decorators import ssl_required, write_required
+from portality.decorators import ssl_required, write_required, restrict_to_role
 from portality.forms.application_forms import MultiSelectBuilder, iso_language_list
 from portality.models import Account, Event
 from portality.forms.validate import DataOptional, EmailAvailable, ReservedUsernames, IdAvailable, IgnoreUnchanged, \
@@ -26,6 +26,20 @@ def pull_lang(endpoint, values):
     # Remove 'lang' so it is not passed to the view function
     if values:
         lang = values.pop('lang', None)
+        # store the active language on the flask.g so url_defaults can access it
+        g.lang = lang
+
+
+@blueprint.url_defaults
+def add_lang(endpoint, values):
+    """Ensure that url_for() populates the 'lang' value for this blueprint when generating URLs.
+
+    If a language has been set on g (by pull_lang) then default the 'lang' for generated URLs
+    to that value so callers don't need to explicitly pass it.
+    """
+    lang = getattr(g, 'lang', None)
+    if lang:
+        values.setdefault('lang', lang)
 
 @blueprint.route('/')
 @login_required
@@ -35,6 +49,31 @@ def index():
         abort(401)
     return render_template(templates.USER_LIST)
 
+class RedirectForm(Form):
+    next = HiddenField()
+
+    def __init__(self, *args, **kwargs):
+        Form.__init__(self, *args, **kwargs)
+        if not self.next.data:
+            self.next.data = get_redirect_target() or ''
+
+    def redirect(self, endpoint='index', **values):
+        if self.next.data == util.is_safe_url(self.next.data):
+            return redirect(self.next.data)
+        target = get_redirect_target()
+        return redirect(target or url_for(endpoint, **values))
+
+
+class LoginForm(RedirectForm):
+    user = StringField('Email address or username', [validators.DataRequired()])
+    password = PasswordField('Password', [validators.DataRequired()])
+
+class ResetForm(Form):
+    password = PasswordField('Password', [
+        validators.DataRequired(),
+        validators.EqualTo('confirm', message='Passwords must match')
+    ])
+    confirm = PasswordField('Repeat Password')
 
 class UserEditForm(Form):
 
@@ -72,6 +111,27 @@ class UserEditForm(Form):
     ])
     password_confirm = PasswordField('Confirm password')
 
+class RegisterForm(RedirectForm):
+    identifier = StringField('ID', [ReservedUsernames(), IdAvailable()])
+    name = StringField('Name', [validators.Optional(), validators.Length(min=3, max=64)])
+    sender_email = StringField('Email address', [
+        validators.DataRequired(),
+        validators.Length(min=3, max=254),
+        validators.Email(message='Must be a valid email address'),
+        EmailAvailable(message="That email address is already in use. Please <a href='/account/forgot'>reset your password</a>. If you still cannot login, <a href='/contact'>contact us</a>.")
+    ])
+    roles = StringField('Roles')
+    # These are honeypot (bot-trap) fields
+    email = StringField('email')
+    hptimer = DecimalField('hptimer', [validators.Optional()])
+
+    def is_bot(self):
+        """
+        Checks honeypot fields and determines whether the form was submitted by a bot
+        :return: True, if bot suspected; False, if human
+        """
+        return self.email.data != "" or self.hptimer.data is None or self.hptimer.data < app.config.get("HONEYPOT_TIMER_THRESHOLD", 5000)
+
 
 @blueprint.route('/<username>', methods=['GET', 'POST', 'DELETE'])
 @login_required
@@ -210,27 +270,6 @@ def get_redirect_target(form=None, acc=None):
 
     return url_for(app.config.get("DEFAULT_LOGIN_DESTINATION"))
 
-
-class RedirectForm(Form):
-    next = HiddenField()
-
-    def __init__(self, *args, **kwargs):
-        Form.__init__(self, *args, **kwargs)
-        if not self.next.data:
-            self.next.data = get_redirect_target() or ''
-
-    def redirect(self, endpoint='index', **values):
-        if self.next.data == util.is_safe_url(self.next.data):
-            return redirect(self.next.data)
-        target = get_redirect_target()
-        return redirect(target or url_for(endpoint, **values))
-
-
-class LoginForm(RedirectForm):
-    user = StringField('Email address or username', [validators.DataRequired()])
-    password = PasswordField('Password', [validators.DataRequired()])
-
-
 @blueprint.route('/login', methods=['GET', 'POST'])
 @ssl_required
 def login():
@@ -308,14 +347,6 @@ def forgot():
     return render_template(templates.FORGOT_PASSWORD)
 
 
-class ResetForm(Form):
-    password = PasswordField('Password', [
-        validators.DataRequired(),
-        validators.EqualTo('confirm', message='Passwords must match')
-    ])
-    confirm = PasswordField('Repeat Password')
-
-
 @blueprint.route("/reset/<reset_token>", methods=["GET", "POST"])
 @ssl_required
 @write_required()
@@ -353,28 +384,6 @@ def logout():
     flash('You are now logged out', 'success')
     return redirect('/')
 
-
-class RegisterForm(RedirectForm):
-    identifier = StringField('ID', [ReservedUsernames(), IdAvailable()])
-    name = StringField('Name', [validators.Optional(), validators.Length(min=3, max=64)])
-    sender_email = StringField('Email address', [
-        validators.DataRequired(),
-        validators.Length(min=3, max=254),
-        validators.Email(message='Must be a valid email address'),
-        EmailAvailable(message="That email address is already in use. Please <a href='/account/forgot'>reset your password</a>. If you still cannot login, <a href='/contact'>contact us</a>.")
-    ])
-    roles = StringField('Roles')
-    # These are honeypot (bot-trap) fields
-    email = StringField('email')
-    hptimer = DecimalField('hptimer', [validators.Optional()])
-
-    def is_bot(self):
-        """
-        Checks honeypot fields and determines whether the form was submitted by a bot
-        :return: True, if bot suspected; False, if human
-        """
-        return self.email.data != "" or self.hptimer.data is None or self.hptimer.data < app.config.get("HONEYPOT_TIMER_THRESHOLD", 5000)
-
 @blueprint.route('/register', methods=['GET', 'POST'])
 @ssl_required
 @write_required()
@@ -394,8 +403,12 @@ def register(template=templates.REGISTER):
             return render_template(template, form=form)
 
         if form.validate():
-            account = Account.make_account(email=form.sender_email.data, username=form.identifier.data, name=form.name.data,
-                                           roles=[r.strip() for r in form.roles.data.split(',')])
+            account = Account.make_account(email=form.sender_email.data, username=form.identifier.data, name=form.name.data)
+            if current_user.is_authenticated and current_user.has_role(constants.ROLE_ADMIN):
+                roles = [r.strip() for r in form.roles.data.split(',')]
+                for r in roles:
+                    account.add_role(r)
+
             account.save()
 
             event_svc = DOAJ.eventsService()
@@ -421,5 +434,8 @@ def register(template=templates.REGISTER):
 
 @blueprint.route('/create/', methods=['GET', 'POST'])
 @write_required()
+@login_required
 def create():
+    if not current_user.has_role(constants.ROLE_ADMIN):
+        abort(404)
     return register(template=templates.CREATE_USER)
\ No newline at end of file

From 4da829c0cbc2e2d9399f287916ea68499dacaed2 Mon Sep 17 00:00:00 2001
From: Richard Jones <richard@cottagelabs.com>
Date: Tue, 12 May 2026 16:23:03 +0100
Subject: [PATCH 3/5] fix select2 behaviours on the user page (and some style
 improvements site-wide)

---
 cms/sass/components/_select2.scss             | 11 ++-
 .../_account/includes/_edit_form_js.html      | 82 +++++++++++++------
 portality/view/admin.py                       | 12 +++
 3 files changed, 78 insertions(+), 27 deletions(-)

diff --git a/cms/sass/components/_select2.scss b/cms/sass/components/_select2.scss
index 2675ff6bfc..fd395c855a 100644
--- a/cms/sass/components/_select2.scss
+++ b/cms/sass/components/_select2.scss
@@ -76,6 +76,12 @@ $s2-size:  20px;
       }
     }
 
+    .select2-search-choice-focus {
+      .select2-search-choice-close {
+        background-position: 0;
+      }
+    }
+
     .select2-chosen {
       padding-bottom: $s2-space;
 
@@ -105,7 +111,6 @@ $s2-size:  20px;
 }
 
 .select2-results {
-  .select2-highlighted,
   .select2-no-results,
   .select2-searching,
   .select2-ajax-error,
@@ -113,6 +118,10 @@ $s2-size:  20px;
     background: $white;
     color: $warm-black;
   }
+  .select2-highlighted {
+    background: $light-grey;
+    color: $warm-black;
+  }
 }
 
 .select2-drop.select2-drop-above,
diff --git a/portality/templates-v2/_account/includes/_edit_form_js.html b/portality/templates-v2/_account/includes/_edit_form_js.html
index d313f79361..46f6c2386c 100644
--- a/portality/templates-v2/_account/includes/_edit_form_js.html
+++ b/portality/templates-v2/_account/includes/_edit_form_js.html
@@ -18,8 +18,7 @@
         $attrWf.select2({
             placeholder: 'Select workflow stages',
             width: '100%',
-            allowClear: true,
-            closeOnSelect: $attrWf.prop('multiple') ? false : true
+            newOption: true,
         });
 
         // Initialise select2 for language field. If the underlying select is multiple,
@@ -28,45 +27,76 @@
         $attrLang.select2({
             placeholder: 'Select language',
             width: '100%',
-            allowClear: true,
-            closeOnSelect: $attrLang.prop('multiple') ? false : true
+            newOption: true,
         });
 
         let $attrCountry = $("#attribute_country");
         $attrCountry.select2({
             placeholder: 'Select country',
             width: '100%',
-            allowClear: true,
-            closeOnSelect: $attrCountry.prop('multiple') ? false : true
+            newOption: true
         })
 
         let $otherAttr = $("#attribute_tag");
         // Turn a simple text field into a free-text tag entry box.
         // Use comma as the token separator so users can enter tags separated by commas.
         $otherAttr.select2({
-            tags: true,
-            tokenSeparators: [','],
-            placeholder: 'Add tags',
-            width: '100%',
-            allowClear: true,
-            closeOnSelect: true,
-            // Remove the built-in "Searching..." message/spinner since there is
-            // no remote data source — return an empty string for the searching
-            // message so the spinner text is not shown.
-            language: {
-                searching: function() { return ''; }
+            multiple: true,
+            minimumInputLength: 1,
+            ajax: {
+                url: current_scheme + "//" + current_domain + "/admin/autocomplete/user_tags",
+                dataType: 'json',
+                data: function (term, page) {
+                    return {
+                        q: term
+                    };
+                },
+                results: function (data, page) {
+                    return {results: data["suggestions"]};
+                }
             },
-            // Ensure markup isn't escaped so empty searching messages don't show markup
-            escapeMarkup: function (markup) { return markup; },
-            // Normalize entered tags by trimming whitespace and preventing empty tags
-            createTag: function (params) {
-                var term = $.trim(params.term);
-                if (term === '') {
-                    return null;
+            createSearchChoice: function (term) {
+                return {id: $.trim(term), text: $.trim(term)};
+            },
+            initSelection: function (element, callback) {
+                var initial = element.val();
+                var entries = initial.split(",").map(x => x.trim()).filter(x => x !== "");
+                var data = [];
+                for (var i = 0; i < entries.length; i++) {
+                    data.push({id: entries[i], text: entries[i]});
                 }
-                return { id: term, text: term };
-            }
+                callback(data);
+            },
+            placeholder: "Add tags",
+            allowClear: false,
+            tags: true,
+            tokenSeparators: [',', ";"],
+            width: 'resolve'
         });
+        {#$otherAttr.select2({#}
+        {#    tags: true,#}
+        {#    tokenSeparators: [','],#}
+        {#    placeholder: 'Add tags',#}
+        {#    width: '100%',#}
+        {#    allowClear: true,#}
+        {#    closeOnSelect: true,#}
+        {#    // Remove the built-in "Searching..." message/spinner since there is#}
+        {#    // no remote data source — return an empty string for the searching#}
+        {#    // message so the spinner text is not shown.#}
+        {#    language: {#}
+        {#        searching: function() { return ''; }#}
+        {#    },#}
+        {#    // Ensure markup isn't escaped so empty searching messages don't show markup#}
+        {#    escapeMarkup: function (markup) { return markup; },#}
+        {#    // Normalize entered tags by trimming whitespace and preventing empty tags#}
+        {#    createTag: function (params) {#}
+        {#        var term = $.trim(params.term);#}
+        {#        if (term === '') {#}
+        {#            return null;#}
+        {#        }#}
+        {#        return { id: term, text: term };#}
+        {#    }#}
+        {#});#}
 
         // Scroll to errors
         let firstError = $('.errors')[0];
diff --git a/portality/view/admin.py b/portality/view/admin.py
index d0ed408f1f..d576d24f7b 100644
--- a/portality/view/admin.py
+++ b/portality/view/admin.py
@@ -687,6 +687,18 @@ def user_autocomplete():
     resp.mimetype = "application/json"
     return resp
 
+@blueprint.route("/autocomplete/user_tags")
+@login_required
+@ssl_required
+def user_tags_autocomplete():
+    q = request.values.get("q")
+    s = request.values.get("s", 10)
+    ac = models.Account.autocomplete("attributes." + constants.USER_ATTR__TAG + ".exact", q, size=s)
+
+    # return a json response
+    resp = make_response(json.dumps({"suggestions": ac}))
+    resp.mimetype = "application/json"
+    return resp
 
 # Route which returns the associate editor account names within a given editor group
 @blueprint.route("/dropdown/eg_associates")

From 9d05808f82585c9ae6f10038f0c11e0f30f41e7c Mon Sep 17 00:00:00 2001
From: Steven Eardley <steve@eardley.xyz>
Date: Fri, 24 Jul 2026 15:49:36 +0100
Subject: [PATCH 4/5] undo class code relocation to simplify merge with develop

---
 portality/view/account.py | 54 ++++++++++++++++++++-------------------
 1 file changed, 28 insertions(+), 26 deletions(-)

diff --git a/portality/view/account.py b/portality/view/account.py
index d27f9e55f3..471cd491ef 100644
--- a/portality/view/account.py
+++ b/portality/view/account.py
@@ -49,32 +49,6 @@ def index():
         abort(401)
     return render_template(templates.USER_LIST)
 
-class RedirectForm(Form):
-    next = HiddenField()
-
-    def __init__(self, *args, **kwargs):
-        Form.__init__(self, *args, **kwargs)
-        if not self.next.data:
-            self.next.data = get_redirect_target() or ''
-
-    def redirect(self, endpoint='index', **values):
-        if self.next.data == util.is_safe_url(self.next.data):
-            return redirect(self.next.data)
-        target = get_redirect_target()
-        return redirect(target or url_for(endpoint, **values))
-
-
-class LoginForm(RedirectForm):
-    user = StringField('Email address or username', [validators.DataRequired()])
-    password = PasswordField('Password', [validators.DataRequired()])
-
-class ResetForm(Form):
-    password = PasswordField('Password', [
-        validators.DataRequired(),
-        validators.EqualTo('confirm', message='Passwords must match')
-    ])
-    confirm = PasswordField('Repeat Password')
-
 class UserEditForm(Form):
 
     # Let's not allow anyone to change IDs - there lies madness and destruction (referential integrity)
@@ -270,6 +244,34 @@ def get_redirect_target(form=None, acc=None):
 
     return url_for(app.config.get("DEFAULT_LOGIN_DESTINATION"))
 
+
+class RedirectForm(Form):
+    next = HiddenField()
+
+    def __init__(self, *args, **kwargs):
+        Form.__init__(self, *args, **kwargs)
+        if not self.next.data:
+            self.next.data = get_redirect_target() or ''
+
+    def redirect(self, endpoint='index', **values):
+        if self.next.data == util.is_safe_url(self.next.data):
+            return redirect(self.next.data)
+        target = get_redirect_target()
+        return redirect(target or url_for(endpoint, **values))
+
+
+class LoginForm(RedirectForm):
+    user = StringField('Email address or username', [validators.DataRequired()])
+    password = PasswordField('Password', [validators.DataRequired()])
+
+class ResetForm(Form):
+    password = PasswordField('Password', [
+        validators.DataRequired(),
+        validators.EqualTo('confirm', message='Passwords must match')
+    ])
+    confirm = PasswordField('Repeat Password')
+
+
 @blueprint.route('/login', methods=['GET', 'POST'])
 @ssl_required
 def login():

From 5c7f27fc8d579d2ea7d54498fca0d017ce12cc4a Mon Sep 17 00:00:00 2001
From: Steven Eardley <steve@eardley.xyz>
Date: Fri, 24 Jul 2026 16:01:57 +0100
Subject: [PATCH 5/5] reapply class refactor

---
 portality/view/account.py | 34 +++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/portality/view/account.py b/portality/view/account.py
index e8a3450f12..81acf0c59d 100644
--- a/portality/view/account.py
+++ b/portality/view/account.py
@@ -1,4 +1,5 @@
 import uuid, json
+import random
 
 from flask import Blueprint, request, url_for, flash, redirect, make_response, g, current_app
 from flask import render_template, abort
@@ -9,8 +10,7 @@
 from portality import constants
 from portality.core import app
 from portality.datasets import language_options, country_options
-from portality.decorators import ssl_required, write_required, restrict_to_role
-from portality.forms.application_forms import MultiSelectBuilder, iso_language_list
+from portality.decorators import ssl_required, write_required
 from portality.models import Account, Event
 from portality.forms.validate import DataOptional, EmailAvailable, ReservedUsernames, IdAvailable, IgnoreUnchanged, \
     CurrentISOLanguage
@@ -46,6 +46,20 @@ def add_lang(endpoint, values):
         if lang:
             values.setdefault('lang', lang)
 
+class RedirectForm(Form):
+    next = HiddenField()
+
+    def __init__(self, *args, **kwargs):
+        Form.__init__(self, *args, **kwargs)
+        if not self.next.data:
+            self.next.data = get_redirect_target() or ''
+
+    def redirect(self, endpoint='index', **values):
+        if self.next.data == util.is_safe_url(self.next.data):
+            return redirect(self.next.data)
+        target = get_redirect_target()
+        return redirect(target or url_for(endpoint, **values))
+
 @blueprint.route('/')
 @login_required
 @ssl_required
@@ -250,26 +264,12 @@ def get_redirect_target(form=None, acc=None):
     return url_for(app.config.get("DEFAULT_LOGIN_DESTINATION"))
 
 
-class RedirectForm(Form):
-    next = HiddenField()
-
-    def __init__(self, *args, **kwargs):
-        Form.__init__(self, *args, **kwargs)
-        if not self.next.data:
-            self.next.data = get_redirect_target() or ''
-
-    def redirect(self, endpoint='index', **values):
-        if self.next.data == util.is_safe_url(self.next.data):
-            return redirect(self.next.data)
-        target = get_redirect_target()
-        return redirect(target or url_for(endpoint, **values))
-
-
 class LoginForm(RedirectForm):
     user = StringField('Email address or username', [validators.DataRequired()])
     password = PasswordField('Password', [validators.Optional()])
     action = StringField('Action', [validators.DataRequired()])
 
+
 class LoginCodeForm(RedirectForm):
     code = StringField('Code', [validators.DataRequired()])
     user = HiddenField('User')