1527c649e6
- Add meeting:moderate capability to trainer role in ROLE_CAPABILITIES - IsMeetingModerator permission class already in place from TRA-372 (training:signoff or meeting:moderate) - Moderation endpoints (mute/unmute/kick, screen-share, session lifecycle) restricted to meeting:moderate - Add migration 0003 for MeetingParticipant.attendance_session FK - Add integration tests: 18 cases covering trainer allowed / learner 403 / unauthenticated 401 for mute, unmute, kick, screen share (start/stop), call session (start/end/view), audit log Co-Authored-By: Paperclip <noreply@paperclip.ing>
108 lines
3.7 KiB
Python
108 lines
3.7 KiB
Python
import uuid
|
|
|
|
from django.contrib.auth.models import AbstractBaseUser, PermissionsMixin
|
|
from django.db import models
|
|
|
|
from .managers import AccountUserManager
|
|
|
|
|
|
class AccountUser(AbstractBaseUser, PermissionsMixin):
|
|
id = models.UUIDField(primary_key=True, default=uuid.uuid4, editable=False)
|
|
email = models.EmailField(unique=True)
|
|
display_name = models.CharField(max_length=255, blank=True)
|
|
oidc_sub = models.CharField(max_length=512, unique=True, db_index=True, null=True, blank=True)
|
|
is_active = models.BooleanField(default=True)
|
|
is_staff = models.BooleanField(default=False)
|
|
last_login_at = models.DateTimeField(null=True, blank=True)
|
|
created_at = models.DateTimeField(auto_now_add=True)
|
|
|
|
objects = AccountUserManager()
|
|
|
|
USERNAME_FIELD = "email"
|
|
REQUIRED_FIELDS = []
|
|
|
|
class Meta:
|
|
db_table = "accounts_user"
|
|
|
|
def __str__(self):
|
|
return self.email
|
|
|
|
def get_full_name(self):
|
|
return self.display_name or self.email
|
|
|
|
def get_short_name(self):
|
|
return self.display_name or self.email.split("@")[0]
|
|
|
|
|
|
class Role(models.Model):
|
|
slug = models.CharField(max_length=50, unique=True)
|
|
name = models.CharField(max_length=100)
|
|
|
|
class Meta:
|
|
db_table = "accounts_role"
|
|
|
|
def __str__(self):
|
|
return self.slug
|
|
|
|
|
|
ROLE_CAPABILITIES: dict[str, list[str]] = {
|
|
"learner": ["courses:view", "courses:enroll", "progress:view_own", "assessments:take"],
|
|
"trainer": ["courses:view", "progress:view_team", "assessments:view", "training:signoff", "meeting:moderate"],
|
|
"author": ["courses:view", "courses:create", "courses:edit", "cms:manage"],
|
|
"manager": ["courses:view", "courses:manage", "progress:view_all", "reports:view", "users:list"],
|
|
"admin": [
|
|
"courses:view", "courses:manage",
|
|
"progress:view_all", "reports:view",
|
|
"users:list", "users:manage",
|
|
"certificates:manage", "audit:view",
|
|
],
|
|
}
|
|
|
|
|
|
class UserRoleBinding(models.Model):
|
|
user = models.ForeignKey(AccountUser, on_delete=models.CASCADE, related_name="role_bindings")
|
|
role = models.ForeignKey(Role, on_delete=models.PROTECT)
|
|
org_id = models.UUIDField(null=True, blank=True, db_index=True)
|
|
source = models.CharField(max_length=20, default="oidc") # "oidc" | "manual"
|
|
|
|
class Meta:
|
|
db_table = "accounts_user_role_binding"
|
|
constraints = [
|
|
models.UniqueConstraint(fields=["user", "role", "org_id"], name="unique_user_role_org"),
|
|
]
|
|
|
|
def __str__(self):
|
|
return f"{self.user.email}:{self.role.slug}:{self.org_id or 'global'}:{self.source}"
|
|
|
|
|
|
class GroupRoleMap(models.Model):
|
|
oidc_group = models.CharField(max_length=255, db_index=True)
|
|
role = models.ForeignKey(Role, on_delete=models.CASCADE)
|
|
org_id = models.UUIDField(null=True, blank=True) # null = global mapping
|
|
|
|
class Meta:
|
|
db_table = "accounts_group_role_map"
|
|
constraints = [
|
|
models.UniqueConstraint(fields=["oidc_group", "role", "org_id"], name="unique_group_role_org"),
|
|
]
|
|
|
|
def __str__(self):
|
|
return f"{self.oidc_group} -> {self.role.slug}"
|
|
|
|
|
|
class OrganizationProfile(models.Model):
|
|
org_id = models.UUIDField(unique=True, db_index=True)
|
|
company_name = models.CharField(max_length=255)
|
|
# Any positive integer — common values are 20, 50, 100, 1000 but not enforced
|
|
license_user_limit = models.PositiveIntegerField(default=20)
|
|
brand_logo_url = models.URLField(blank=True, default="")
|
|
created_at = models.DateTimeField(auto_now_add=True)
|
|
updated_at = models.DateTimeField(auto_now=True)
|
|
|
|
class Meta:
|
|
db_table = "accounts_organization_profile"
|
|
ordering = ["company_name", "org_id"]
|
|
|
|
def __str__(self):
|
|
return f"{self.company_name} ({self.org_id})"
|