Add user roles for organizations/gangs/sections

backend/root/settings/base.py

@@ -129,6 +129,7 @@
 
 AUTHENTICATION_BACKENDS = [
     'django.contrib.auth.backends.ModelBackend',  # default
+    'samfundet.backend.RoleAuthBackend',
 ]
 
 # Password validation

backend/root/utils/permissions.py

@@ -253,6 +253,11 @@
 SAMFUNDET_DELETE_RESERVATION = 'samfundet.delete_reservation'
 SAMFUNDET_VIEW_RESERVATION = 'samfundet.view_reservation'
 
+SAMFUNDET_ADD_ROLE = 'samfundet.add_role'
+SAMFUNDET_CHANGE_ROLE = 'samfundet.change_role'
+SAMFUNDET_DELETE_ROLE = 'samfundet.delete_role'
+SAMFUNDET_VIEW_ROLE = 'samfundet.view_role'
+
 SAMFUNDET_ADD_SAKSDOKUMENT = 'samfundet.add_saksdokument'
 SAMFUNDET_CHANGE_SAKSDOKUMENT = 'samfundet.change_saksdokument'
 SAMFUNDET_DELETE_SAKSDOKUMENT = 'samfundet.delete_saksdokument'
@@ -285,6 +290,21 @@
 SAMFUNDET_DELETE_USERFEEDBACKMODEL = 'samfundet.delete_userfeedbackmodel'
 SAMFUNDET_VIEW_USERFEEDBACKMODEL = 'samfundet.view_userfeedbackmodel'
 
+SAMFUNDET_ADD_USERGANGROLE = 'samfundet.add_usergangrole'
+SAMFUNDET_CHANGE_USERGANGROLE = 'samfundet.change_usergangrole'
+SAMFUNDET_DELETE_USERGANGROLE = 'samfundet.delete_usergangrole'
+SAMFUNDET_VIEW_USERGANGROLE = 'samfundet.view_usergangrole'
+
+SAMFUNDET_ADD_USERGANGSECTIONROLE = 'samfundet.add_usergangsectionrole'
+SAMFUNDET_CHANGE_USERGANGSECTIONROLE = 'samfundet.change_usergangsectionrole'
+SAMFUNDET_DELETE_USERGANGSECTIONROLE = 'samfundet.delete_usergangsectionrole'
+SAMFUNDET_VIEW_USERGANGSECTIONROLE = 'samfundet.view_usergangsectionrole'
+
+SAMFUNDET_ADD_USERORGROLE = 'samfundet.add_userorgrole'
+SAMFUNDET_CHANGE_USERORGROLE = 'samfundet.change_userorgrole'
+SAMFUNDET_DELETE_USERORGROLE = 'samfundet.delete_userorgrole'
+SAMFUNDET_VIEW_USERORGROLE = 'samfundet.view_userorgrole'
+
 SAMFUNDET_ADD_USERPREFERENCE = 'samfundet.add_userpreference'
 SAMFUNDET_CHANGE_USERPREFERENCE = 'samfundet.change_userpreference'
 SAMFUNDET_DELETE_USERPREFERENCE = 'samfundet.delete_userpreference'

backend/root/utils/routes.py

@@ -43,6 +43,30 @@
 admin__auth_group_delete = 'admin:auth_group_delete'
 admin__auth_group_change = 'admin:auth_group_change'
 adminauthgroup__objectId = ''
+admin__samfundet_role_changelist = 'admin:samfundet_role_changelist'
+admin__samfundet_role_add = 'admin:samfundet_role_add'
+admin__samfundet_role_history = 'admin:samfundet_role_history'
+admin__samfundet_role_delete = 'admin:samfundet_role_delete'
+admin__samfundet_role_change = 'admin:samfundet_role_change'
+adminsamfundetrole__objectId = ''
+admin__samfundet_userorgrole_changelist = 'admin:samfundet_userorgrole_changelist'
+admin__samfundet_userorgrole_add = 'admin:samfundet_userorgrole_add'
+admin__samfundet_userorgrole_history = 'admin:samfundet_userorgrole_history'
+admin__samfundet_userorgrole_delete = 'admin:samfundet_userorgrole_delete'
+admin__samfundet_userorgrole_change = 'admin:samfundet_userorgrole_change'
+adminsamfundetuserorgrole__objectId = ''
+admin__samfundet_usergangrole_changelist = 'admin:samfundet_usergangrole_changelist'
+admin__samfundet_usergangrole_add = 'admin:samfundet_usergangrole_add'
+admin__samfundet_usergangrole_history = 'admin:samfundet_usergangrole_history'
+admin__samfundet_usergangrole_delete = 'admin:samfundet_usergangrole_delete'
+admin__samfundet_usergangrole_change = 'admin:samfundet_usergangrole_change'
+adminsamfundetusergangrole__objectId = ''
+admin__samfundet_usergangsectionrole_changelist = 'admin:samfundet_usergangsectionrole_changelist'
+admin__samfundet_usergangsectionrole_add = 'admin:samfundet_usergangsectionrole_add'
+admin__samfundet_usergangsectionrole_history = 'admin:samfundet_usergangsectionrole_history'
+admin__samfundet_usergangsectionrole_delete = 'admin:samfundet_usergangsectionrole_delete'
+admin__samfundet_usergangsectionrole_change = 'admin:samfundet_usergangsectionrole_change'
+adminsamfundetusergangsectionrole__objectId = ''
 admin__auth_permission_permissions = 'admin:auth_permission_permissions'
 admin__auth_permission_permissions_manage_user = 'admin:auth_permission_permissions_manage_user'
 admin__auth_permission_permissions_manage_group = 'admin:auth_permission_permissions_manage_group'

backend/samfundet/admin.py

@@ -21,6 +21,8 @@
     CustomGuardedModelAdmin,
 )
 
+from samfundet.models.role import Role, UserOrgRole, UserGangRole, UserGangSectionRole
+
 from .models.event import Event, EventGroup, EventRegistration
 from .models.general import (
     Tag,
@@ -161,6 +163,27 @@ def members(self, obj: Group) -> int:
         return n
 
 
+@admin.register(Role)
+class RoleAdmin(admin.ModelAdmin):
+    list_display = ('name',)
+    filter_horizontal = ['permissions']
+
+
+@admin.register(UserOrgRole)
+class UserOrgRoleAdmin(admin.ModelAdmin):
+    list_display = ('user', 'role', 'obj')
+
+
+@admin.register(UserGangRole)
+class UserGangRoleAdmin(admin.ModelAdmin):
+    list_display = ('user', 'role', 'obj')
+
+
+@admin.register(UserGangSectionRole)
+class UserGangSectionRoleAdmin(admin.ModelAdmin):
+    list_display = ('user', 'role', 'obj')
+
+
 @admin.register(Permission)
 class PermissionAdmin(CustomGuardedModelAdmin):
     # ordering = []

backend/samfundet/backend.py

@@ -0,0 +1,37 @@
+from __future__ import annotations
+
+from typing import Any
+
+from django.contrib.auth.backends import BaseBackend
+
+from samfundet.utils import get_perm
+from samfundet.models import User
+from samfundet.models.role import UserOrgRole, UserGangRole, UserGangSectionRole
+
+
+class RoleAuthBackend(BaseBackend):
+    def has_perm(self, user_obj: User, perm: str, obj: Any = None) -> bool:  # noqa: C901
+        if not user_obj.is_active or obj is None:
+            return False
+
+        if user_obj.is_superuser:
+            return True
+
+        permission = get_perm(perm=perm, model=obj)
+
+        if hasattr(obj, 'resolve_org'):
+            org_id = obj.resolve_org(return_id=True)
+            if org_id is not None and UserOrgRole.objects.filter(user=user_obj, obj__id=org_id, role__permissions=permission).exists():
+                return True
+
+        if hasattr(obj, 'resolve_gang'):
+            gang_id = obj.resolve_gang(return_id=True)
+            if gang_id is not None and UserGangRole.objects.filter(user=user_obj, obj__id=gang_id, role__permissions=permission).exists():
+                return True
+
+        if hasattr(obj, 'resolve_section'):
+            section_id = obj.resolve_section(return_id=True)
+            if section_id is not None and UserGangSectionRole.objects.filter(user=user_obj, obj__id=section_id, role__permissions=permission).exists():
+                return True
+
+        return False

backend/samfundet/conftest.py

@@ -11,12 +11,15 @@
 from django.test import Client, TestCase
 from django.utils import timezone
 from django.core.files.images import ImageFile
-from django.contrib.auth.models import Group
+from django.contrib.auth.models import Group, Permission
+from django.contrib.contenttypes.models import ContentType
 
 import root.management.commands.seed_scripts.billig as billig_seed
 from root.settings import BASE_DIR
 
+from samfundet.backend import RoleAuthBackend
 from samfundet.constants import DEV_PASSWORD
+from samfundet.models.role import Role
 from samfundet.models.event import Event
 from samfundet.models.billig import BilligEvent
 from samfundet.models.general import (
@@ -29,6 +32,7 @@
     Campus,
     BlogPost,
     TextItem,
+    GangSection,
     Reservation,
     Organization,
     MerchVariation,
@@ -249,6 +253,64 @@ def fixture_gang2(fixture_organization: Organization) -> Iterator[Gang]:
     organization.delete()
 
 
+@pytest.fixture
+def fixture_gang_section(fixture_gang: Gang) -> Iterator[GangSection]:
+    gang_section = GangSection.objects.create(
+        name_nb='Test Gang Section',
+        name_en='Test Gang Section',
+        gang=fixture_gang,
+    )
+    yield gang_section
+    gang_section.delete()
+
+
+@pytest.fixture
+def fixture_role() -> Iterator[Role]:
+    role = Role.objects.create(
+        name='Test Role',
+    )
+    yield role
+    role.delete()
+
+
+@pytest.fixture
+def fixture_role_auth_backend() -> RoleAuthBackend:
+    return RoleAuthBackend()
+
+
+@pytest.fixture
+def fixture_org_permission() -> Iterator[Permission]:
+    permission = Permission.objects.create(
+        name='Test Org Permission',
+        codename='test_org_permission',
+        content_type=ContentType.objects.get_for_model(Organization),
+    )
+    yield permission
+    permission.delete()
+
+
+@pytest.fixture
+def fixture_gang_permission() -> Iterator[Permission]:
+    permission = Permission.objects.create(
+        name='Test Gang Permission',
+        codename='test_gang_permission',
+        content_type=ContentType.objects.get_for_model(Gang),
+    )
+    yield permission
+    permission.delete()
+
+
+@pytest.fixture
+def fixture_gang_section_permission() -> Iterator[Permission]:
+    permission = Permission.objects.create(
+        name='Test Gang Section Permission',
+        codename='test_gang_section_permission',
+        content_type=ContentType.objects.get_for_model(GangSection),
+    )
+    yield permission
+    permission.delete()
+
+
 @pytest.fixture
 def fixture_text_item() -> Iterator[TextItem]:
     text_item = TextItem.objects.create(

backend/samfundet/migrations/0004_role_usergangrole_usergangsectionrole_userorgrole.py

@@ -0,0 +1,75 @@
+# Generated by Django 5.0.6 on 2024-08-22 22:22
+
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('auth', '0012_alter_user_first_name_max_length'),
+        ('samfundet', '0003_recruitmentseparateposition_and_more'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Role',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('name', models.CharField(max_length=255)),
+                ('permissions', models.ManyToManyField(to='auth.permission')),
+            ],
+        ),
+        migrations.CreateModel(
+            name='UserGangRole',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('version', models.PositiveIntegerField(blank=True, default=0, editable=False, null=True)),
+                ('created_at', models.DateTimeField(blank=True, editable=False, null=True)),
+                ('updated_at', models.DateTimeField(blank=True, editable=False, null=True)),
+                ('created_by', models.ForeignKey(blank=True, editable=False, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='+', to=settings.AUTH_USER_MODEL)),
+                ('obj', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='samfundet.gang')),
+                ('role', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='samfundet.role')),
+                ('updated_by', models.ForeignKey(blank=True, editable=False, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='+', to=settings.AUTH_USER_MODEL)),
+                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to=settings.AUTH_USER_MODEL)),
+            ],
+            options={
+                'abstract': False,
+            },
+        ),
+        migrations.CreateModel(
+            name='UserGangSectionRole',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('version', models.PositiveIntegerField(blank=True, default=0, editable=False, null=True)),
+                ('created_at', models.DateTimeField(blank=True, editable=False, null=True)),
+                ('updated_at', models.DateTimeField(blank=True, editable=False, null=True)),
+                ('created_by', models.ForeignKey(blank=True, editable=False, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='+', to=settings.AUTH_USER_MODEL)),
+                ('obj', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='samfundet.gangsection')),
+                ('role', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='samfundet.role')),
+                ('updated_by', models.ForeignKey(blank=True, editable=False, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='+', to=settings.AUTH_USER_MODEL)),
+                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to=settings.AUTH_USER_MODEL)),
+            ],
+            options={
+                'abstract': False,
+            },
+        ),
+        migrations.CreateModel(
+            name='UserOrgRole',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('version', models.PositiveIntegerField(blank=True, default=0, editable=False, null=True)),
+                ('created_at', models.DateTimeField(blank=True, editable=False, null=True)),
+                ('updated_at', models.DateTimeField(blank=True, editable=False, null=True)),
+                ('created_by', models.ForeignKey(blank=True, editable=False, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='+', to=settings.AUTH_USER_MODEL)),
+                ('obj', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='samfundet.organization')),
+                ('role', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='samfundet.role')),
+                ('updated_by', models.ForeignKey(blank=True, editable=False, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='+', to=settings.AUTH_USER_MODEL)),
+                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to=settings.AUTH_USER_MODEL)),
+            ],
+            options={
+                'abstract': False,
+            },
+        ),
+    ]

backend/samfundet/models/__init__.py

@@ -12,12 +12,16 @@
     User,
     Image,
     Profile,
+    GangSection,
+    Organization,
     UserPreference,
 )
 
 __all__ = [
     'User',
     'Gang',
+    'GangSection',
+    'Organization',
     'Event',
     'Image',
     'Profile',

backend/samfundet/models/general.py

@@ -279,6 +279,11 @@ class Meta:
         verbose_name = 'Organization'
         verbose_name_plural = 'Organizations'
 
+    def resolve_org(self, *, return_id: bool = False) -> Organization | int:
+        if return_id:
+            return self.id
+        return self
+
     def __str__(self) -> str:
         return self.name
 
@@ -329,6 +334,17 @@ class Meta:
         verbose_name = 'Gang'
         verbose_name_plural = 'Gangs'
 
+    def resolve_org(self, *, return_id: bool = False) -> Organization | int:
+        if return_id:
+            # noinspection PyTypeChecker
+            return self.organization_id
+        return self.organization
+
+    def resolve_gang(self, *, return_id: bool = False) -> Gang | int:
+        if return_id:
+            return self.id
+        return self
+
     def __str__(self) -> str:
         return f'{self.gang_type} - {self.name_nb}'
 
@@ -339,6 +355,20 @@ class GangSection(CustomBaseModel):
     logo = models.ForeignKey(Image, on_delete=models.PROTECT, blank=True, null=True, verbose_name='Logo')
     gang = models.ForeignKey(Gang, blank=False, null=False, related_name='gang', on_delete=models.PROTECT, verbose_name='Gjeng')
 
+    def resolve_org(self, *, return_id: bool = False) -> Organization | int:
+        return self.gang.resolve_org(return_id=return_id)
+
+    def resolve_gang(self, *, return_id: bool = False) -> Gang | int:
+        if return_id:
+            # noinspection PyTypeChecker
+            return self.gang_id
+        return self.gang
+
+    def resolve_section(self, *, return_id: bool = False) -> GangSection | int:
+        if return_id:
+            return self.id
+        return self
+
     def __str__(self) -> str:
         return f'{self.gang.name_nb} - {self.name_nb}'