Improve logging for DAB RBAC migrations

Author: AlanCoding

ansible_base/rbac/management/__init__.py

@@ -30,13 +30,14 @@ def create_dab_permissions(app_config, verbosity=2, interactive=True, using=DEFA
     try:
         dab_ct_cls = apps.get_model("dab_rbac", "RoleDefinition")
     except LookupError:
-        logger.warning('Skipping DAB RBAC type and permission creation initial migration has not happened')
+        if app_config.label == 'dab_rbac':
+            logger.warning('Skipping DAB RBAC type and permission creation initial migration has not happened')
         return
 
     try:
         dab_ct_cls = apps.get_model("dab_rbac", "DABContentType")
     except LookupError:
-        logger.info('Running historical permission creation method')
+        logger.info(f'Running historical permission creation method for {app_config.label} app')
         old_create_dab_permissions(app_config, apps=apps)
         return
 

ansible_base/rbac/migrations/0005_remote_permissions_data.py

@@ -1,8 +1,13 @@
 # Generated by Django 4.2.23 on 2025-06-30 12:48
 
+import logging
+
 from django.db import migrations
 
 
+logger = logging.getLogger(__name__)
+
+
 def create_types_if_needed(apps, schema_editor):
     """Before we can migrate to the new DABContentType, entries in that table must be created.
 
@@ -12,6 +17,7 @@ def create_types_if_needed(apps, schema_editor):
     permission_cls = apps.get_model('dab_rbac', 'DABPermission')
     rd_cls = apps.get_model('dab_rbac', 'RoleDefinition')
     if permission_cls.objects.exists() or rd_cls.objects.exists():
+        logger.info('Running DABContentType creation script as part of 0005 migration')
         from ansible_base.rbac.management.create_types import create_DAB_contenttypes
 
         create_DAB_contenttypes(apps=apps)
@@ -22,6 +28,7 @@ def migrate_content_type(apps, schema_editor):
     ct_cls.objects.clear_cache()
     for model_name in ('dabpermission', 'objectrole', 'roledefinition', 'roleuserassignment', 'roleteamassignment'):
         cls = apps.get_model('dab_rbac', model_name)
+        update_ct = 0
         for obj in cls.objects.all():
             old_ct = obj.content_type
             if old_ct:
@@ -33,16 +40,23 @@ def migrate_content_type(apps, schema_editor):
                         f"Failed to get new content type for a {model_name} pk={obj.pk}, obj={obj.__dict__}"
                     ) from e
                 obj.save()
+                update_ct += 1
+        if update_ct:
+            logger.info(f'Updated content_type reference to new model for {model_name} for {update_ct} entries')
     for model_name in ('roleevaluation', 'roleevaluationuuid'):
         cls = apps.get_model('dab_rbac', model_name)
         cls.objects.all().delete()
 
     # DABPermission model had api_slug added in last migration
     # if records existed before this point, it needs to be filled in
+    mod_ct = 0
     permission_cls = apps.get_model('dab_rbac', 'DABPermission')
     for permission in permission_cls.objects.all():
         permission.api_slug = f'{permission.new_content_type.service}.{permission.codename}'
         permission.save()
+        mod_ct += 1
+    if mod_ct:
+        logger.info(f'Set new field DABPermission.api_slug for {mod_ct} existing permissions')
 
 
 class Migration(migrations.Migration):

ansible_base/rbac/migrations/0006_remote_data_reverse.py

@@ -1,8 +1,13 @@
 # Generated by Django 4.2.23 on 2025-06-30 12:48
 
+import logging
+
 from django.db import migrations
 
 
+logger = logging.getLogger(__name__)
+
+
 def migrate_content_type_forward_noop(apps, schema_editor):
     """Forward no-op: data migration already happened in 0005."""
     pass
@@ -19,19 +24,23 @@ def migrate_content_type_reverse(apps, schema_editor):
 
     for model_name in ('dabpermission', 'objectrole', 'roledefinition', 'roleuserassignment', 'roleteamassignment'):
         cls = apps.get_model('dab_rbac', model_name)
+        update_ct = 0
         for obj in cls.objects.all():
             new_ct = obj.new_content_type
             if new_ct:
                 try:
                     # Find the corresponding Django ContentType by app_label and model
                     django_ct = django_ct_cls.objects.get(app_label=new_ct.app_label, model=new_ct.model)
-                    obj.content_type = django_ct
-                    obj.save()
                 except Exception as e:
                     raise RuntimeError(
                         f"Failed to get Django content type for a {model_name} pk={obj.pk}, "
                         f"DABContentType app_label='{new_ct.app_label}', model='{new_ct.model}'"
                     ) from e
+                obj.content_type = django_ct
+                obj.save()
+                update_ct += 1
+        if update_ct:
+            logger.info(f'Reverse-migrated content_type reference to old model for {model_name} for {update_ct} entries')
 
 
 class Migration(migrations.Migration):

ansible_base/rbac/triggers.py

@@ -276,7 +276,7 @@ def rbac_post_user_delete(instance, *args, **kwargs):
 
 def post_migration_rbac_setup(sender, *args, **kwargs):
     if not migrations_are_complete():
-        logger.info('Not running DAB RBAC post_migrate logic because of suspected reverse migration')
+        logger.info('Not running DAB RBAC post_migrate logic because of incomplete migration')
         return
 
     dab_post_migrate.send(sender=sender)