2c38fd862d
- AccountUser custom user model (UUID PK, email login, oidc_sub field)
- Role, UserRoleBinding, GroupRoleMap domain models with migrations
- TrainingOIDCBackend: create_user/update_user with Authentik claim hooks
- sync_roles_from_oidc_claims: reconciles OIDC-sourced bindings only,
preserving manually-granted bindings
- get_effective_capabilities: flat capability set from role slugs
- DRF views: /me/, /me/permissions/, /users/, /users/{id}/roles/
- IsAdminOrManager and IsAdmin permission classes
- Audit signal logging on UserRoleBinding post_save/post_delete
- Seed migration for canonical role slugs (learner/trainer/author/manager/admin)
- AUTH_USER_MODEL = accounts.AccountUser wired in base settings
- OIDC settings: scopes, username algo, store_access/refresh_token flags
- Test suite: 20 unit + integration tests covering sync, capabilities, API
Co-Authored-By: Paperclip <noreply@paperclip.ing>
38 lines
1.2 KiB
Python
38 lines
1.2 KiB
Python
from django.contrib import admin
|
|
from django.contrib.auth.admin import UserAdmin
|
|
|
|
from .models import AccountUser, GroupRoleMap, Role, UserRoleBinding
|
|
|
|
|
|
@admin.register(AccountUser)
|
|
class AccountUserAdmin(UserAdmin):
|
|
list_display = ("email", "display_name", "is_active", "is_staff", "created_at")
|
|
search_fields = ("email", "display_name", "oidc_sub")
|
|
ordering = ("email",)
|
|
fieldsets = (
|
|
(None, {"fields": ("email", "password")}),
|
|
("Profile", {"fields": ("display_name", "oidc_sub", "last_login_at")}),
|
|
("Permissions", {"fields": ("is_active", "is_staff", "is_superuser", "groups", "user_permissions")}),
|
|
)
|
|
add_fieldsets = (
|
|
(None, {"classes": ("wide",), "fields": ("email", "password1", "password2")}),
|
|
)
|
|
|
|
|
|
@admin.register(Role)
|
|
class RoleAdmin(admin.ModelAdmin):
|
|
list_display = ("slug", "name")
|
|
|
|
|
|
@admin.register(UserRoleBinding)
|
|
class UserRoleBindingAdmin(admin.ModelAdmin):
|
|
list_display = ("user", "role", "org_id", "source")
|
|
list_filter = ("source", "role")
|
|
raw_id_fields = ("user",)
|
|
|
|
|
|
@admin.register(GroupRoleMap)
|
|
class GroupRoleMapAdmin(admin.ModelAdmin):
|
|
list_display = ("oidc_group", "role", "org_id")
|
|
list_filter = ("role",)
|