add support for group

Signed-off-by: tdruez <tdruez@aboutcode.org>

Author: tdruez

dje/api_permissions.py

@@ -8,11 +8,11 @@
 
 
 from django.contrib.auth import get_user_model
+from django.contrib.auth.models import Group
 from django.core.exceptions import ObjectDoesNotExist
 
 from guardian.shortcuts import assign_perm
-from guardian.shortcuts import get_perms
-from guardian.shortcuts import get_user_perms
+from guardian.shortcuts import get_groups_with_perms
 from guardian.shortcuts import get_users_with_perms
 from guardian.shortcuts import remove_perm
 from rest_framework import permissions
@@ -50,41 +50,50 @@ def has_object_permission(self, request, view, obj):
 
 class ObjectPermissionSerializer(serializers.Serializer):
     """
-    Generic serializer for representing or updating object-level permissions.
-    Accepts:
-      - user: username
-      - permissions: list of permission codenames
+    Validates POST/DELETE input for the manage_permissions action.
+    Exactly one of ``user`` or ``group`` must be provided alongside ``permissions``.
     """
 
-    user = DataspacedSlugRelatedField(queryset=User.objects.all(), slug_field="username")
+    user = DataspacedSlugRelatedField(
+        queryset=User.objects.all(),
+        slug_field="username",
+        required=False,
+        allow_null=True,
+        default=None,
+    )
+    group = serializers.SlugRelatedField(
+        queryset=Group.objects.all(),
+        slug_field="name",
+        required=False,
+        allow_null=True,
+        default=None,
+    )
     permissions = serializers.ListField(child=serializers.CharField(), allow_empty=False)
 
     class Meta:
-        fields = (
-            "user",
-            "permissions",
-        )
-
-    def to_representation(self, instance):
-        """Make sure to provide the target object in context via `context["object"]`."""
-        obj = self.context.get("object")
-        user = instance
-        return {
-            "dataspace": user.dataspace.name,
-            "username": user.get_username(),
-            "object_permissions": get_user_perms(user, obj),
-            "model_permissions": get_perms(user, obj),
-        }
+        fields = ("user", "group", "permissions")
+
+    def validate(self, data):
+        has_user = data.get("user") is not None
+        has_group = data.get("group") is not None
+        if not has_user and not has_group:
+            raise serializers.ValidationError("Either 'user' or 'group' must be provided.")
+        if has_user and has_group:
+            raise serializers.ValidationError(
+                "Only one of 'user' or 'group' can be provided, not both."
+            )
+        return data
 
 
 class ObjectPermissionsMixin:
     """
-    Mixin that adds a `/permissions/` endpoint for any object-level ViewSet.
-    Supports GET (list), POST (assign), and DELETE (remove) operations.
+    Mixin that adds a ``/permissions/`` endpoint for any object-level ViewSet.
+    Supports GET (list), POST (assign), and DELETE (remove) operations for
+    both individual users and groups.
 
-    GET /api/{model}/{uuid}/permissions/ list all users and perms
-    POST /api/{model}/{uuid}/permissions/ assign perms to a user
-    DELETE /api/{model}/{uuid}/permissions/ remove perms from a user
+    GET /api/{model}/{uuid}/permissions/
+    POST /api/{model}/{uuid}/permissions/
+    DELETE /api/{model}/{uuid}/permissions/
     """
 
     @action(
@@ -98,33 +107,48 @@ def manage_permissions(self, request, *args, **kwargs):
         """
         Manage object-level permissions for this object.
 
-        - GET: List users and their permissions.
-        - POST: Assign permissions to a user. Provide `user` and `permissions` list.
-        - DELETE: Remove permissions from a user. Provide `user` and `permissions` list.
+        - GET: List users and groups with their permissions.
+        - POST: Assign permissions. Provide ``user`` or ``group`` and ``permissions`` list.
+        - DELETE: Remove permissions. Provide ``user`` or ``group`` and ``permissions`` list.
         """
         obj = self.get_object()
         serializer_context = {**self.get_serializer_context(), "object": obj}
 
         if request.method == "GET":
             users_with_perms = get_users_with_perms(obj, attach_perms=True)
-            serializer = self.get_serializer(
-                users_with_perms.keys(), many=True, context=serializer_context
-            )
-            return Response(serializer.data, status=status.HTTP_200_OK)
+            groups_with_perms = get_groups_with_perms(obj, attach_perms=True)
+            data = {
+                "users": [
+                    {
+                        "dataspace": user.dataspace.name,
+                        "username": user.get_username(),
+                        "object_permissions": list(perms),
+                    }
+                    for user, perms in users_with_perms.items()
+                ],
+                "groups": [
+                    {
+                        "name": group.name,
+                        "object_permissions": list(perms),
+                    }
+                    for group, perms in groups_with_perms.items()
+                ],
+            }
+            return Response(data, status=status.HTTP_200_OK)
 
         # POST or DELETE
         serializer = self.get_serializer(data=request.data, context=serializer_context)
         if not serializer.is_valid():
             return Response({"errors": serializer.errors}, status=status.HTTP_400_BAD_REQUEST)
 
-        user = serializer.validated_data["user"]
+        target = serializer.validated_data["user"] or serializer.validated_data["group"]
         perms = serializer.validated_data["permissions"]
 
         if request.method == "POST":
             errors = []
             for perm in perms:
                 try:
-                    assign_perm(perm, user, obj)
+                    assign_perm(perm, target, obj)
                 except ObjectDoesNotExist:
                     errors.append(f"Cannot assign permission '{perm}' due to an internal error.")
 
@@ -137,7 +161,7 @@ def manage_permissions(self, request, *args, **kwargs):
             errors = []
             for perm in perms:
                 try:
-                    remove_perm(perm, user, obj)
+                    remove_perm(perm, target, obj)
                 except ObjectDoesNotExist:
                     errors.append(f"Cannot remove permission '{perm}' due to an internal error.")
 

product_portfolio/tests/test_api.py

@@ -587,6 +587,8 @@ def test_api_product_endpoint_cyclonedx_sbom_action(self):
         self.assertEqual("Spec version 10.10 not supported", response.data)
 
     def test_api_product_endpoint_manage_permissions_action(self):
+        from django.contrib.auth.models import Group
+
         url = reverse("api_v2:product-manage-permissions", args=[self.product1.uuid])
 
         # Unauthenticated access is rejected with 403
@@ -604,17 +606,20 @@ def test_api_product_endpoint_manage_permissions_action(self):
         response = self.client.get(url)
         self.assertEqual(status.HTTP_403_FORBIDDEN, response.status_code)
 
-        # Superuser can GET the permissions list
+        # Superuser GET: response has "users" and "groups" keys
         self.client.login(username=self.super_user.username, password="secret")
         response = self.client.get(url)
         self.assertEqual(status.HTTP_200_OK, response.status_code)
+        self.assertIn("users", response.data)
+        self.assertIn("groups", response.data)
         # base_user has view_product at this point
-        self.assertEqual(1, len(response.data))
-        self.assertEqual(self.base_user.username, response.data[0]["username"])
-        self.assertEqual(self.dataspace.name, response.data[0]["dataspace"])
-        self.assertIn("view_product", response.data[0]["object_permissions"])
+        self.assertEqual(1, len(response.data["users"]))
+        self.assertEqual(self.base_user.username, response.data["users"][0]["username"])
+        self.assertEqual(self.dataspace.name, response.data["users"][0]["dataspace"])
+        self.assertIn("view_product", response.data["users"][0]["object_permissions"])
+        self.assertEqual([], response.data["groups"])
 
-        # Superuser can POST to assign multiple permissions at once
+        # Superuser can POST to assign multiple permissions to a user at once
         data = {
             "user": self.admin_user.username,
             "permissions": ["view_product", "change_product"],
@@ -625,14 +630,36 @@ def test_api_product_endpoint_manage_permissions_action(self):
         self.assertIn("view_product", get_perms(self.admin_user, self.product1))
         self.assertIn("change_product", get_perms(self.admin_user, self.product1))
 
-        # Superuser can DELETE to remove permissions
+        # Superuser can DELETE to remove user permissions
         data = {"user": self.admin_user.username, "permissions": ["view_product", "change_product"]}
         response = self.client.delete(url, data, content_type="application/json")
         self.assertEqual(status.HTTP_200_OK, response.status_code)
         self.assertEqual({"status": "permissions removed"}, response.data)
         self.assertNotIn("view_product", get_perms(self.admin_user, self.product1))
         self.assertNotIn("change_product", get_perms(self.admin_user, self.product1))
 
+        # Superuser can POST to assign permissions to a group
+        team = Group.objects.create(name="backend-team")
+        data = {"group": team.name, "permissions": ["view_product", "change_product"]}
+        response = self.client.post(url, data, format="json")
+        self.assertEqual(status.HTTP_200_OK, response.status_code)
+        self.assertEqual({"status": "permissions assigned"}, response.data)
+        self.assertIn("view_product", get_perms(team, self.product1))
+        self.assertIn("change_product", get_perms(team, self.product1))
+
+        # GET lists the group with its permissions
+        response = self.client.get(url)
+        self.assertEqual(status.HTTP_200_OK, response.status_code)
+        self.assertEqual(1, len(response.data["groups"]))
+        self.assertEqual(team.name, response.data["groups"][0]["name"])
+        self.assertIn("view_product", response.data["groups"][0]["object_permissions"])
+
+        # Superuser can DELETE to remove group permissions
+        data = {"group": team.name, "permissions": ["view_product", "change_product"]}
+        response = self.client.delete(url, data, content_type="application/json")
+        self.assertEqual(status.HTTP_200_OK, response.status_code)
+        self.assertNotIn("view_product", get_perms(team, self.product1))
+
         # Product creator (created_by) can GET, POST, and DELETE
         self.product1.created_by = self.admin_user
         self.product1.save()
@@ -661,8 +688,18 @@ def test_api_product_endpoint_manage_permissions_action(self):
         response = self.client.delete(url, data, content_type="application/json")
         self.assertEqual(status.HTTP_200_OK, response.status_code)
 
-        # Missing required fields returns 400
-        response = self.client.post(url, {}, format="json")
+        # Neither user nor group returns 400
+        response = self.client.post(url, {"permissions": ["view_product"]}, format="json")
+        self.assertEqual(status.HTTP_400_BAD_REQUEST, response.status_code)
+        self.assertIn("errors", response.data)
+
+        # Both user and group returns 400
+        data = {
+            "user": self.base_user.username,
+            "group": team.name,
+            "permissions": ["view_product"],
+        }
+        response = self.client.post(url, data, format="json")
         self.assertEqual(status.HTTP_400_BAD_REQUEST, response.status_code)
         self.assertIn("errors", response.data)