refactor(rbac): rename SYSTEM_ROLE to PRESET_ROLE

Author: jordan-umusu

alembic/versions/4bb7e59026f3_drop_role_from_membership_and_.py

@@ -1,7 +1,7 @@
 """drop_role_from_membership_and_invitation_tables
 
 Revision ID: 4bb7e59026f3
-Revises: 8b630b0a094e
+Revises: 55c5d2499eee
 Create Date: 2026-01-29 14:55:11.408522
 
 """
@@ -15,7 +15,7 @@
 
 # revision identifiers, used by Alembic.
 revision: str = "4bb7e59026f3"
-down_revision: str | None = "8b630b0a094e"
+down_revision: str | None = "55c5d2499eee"
 branch_labels: str | Sequence[str] | None = None
 depends_on: str | Sequence[str] | None = None
 

tests/unit/api/test_api_workspaces.py

@@ -10,7 +10,6 @@
 from sqlalchemy.exc import IntegrityError
 
 from tracecat.auth.types import Role
-from tracecat.authz.enums import WorkspaceRole
 from tracecat.authz.service import MembershipWithOrg
 from tracecat.db.models import Workspace
 from tracecat.logger import logger
@@ -175,7 +174,6 @@ async def test_get_workspace_success(
         mock_membership = AsyncMock()
         mock_membership.user_id = test_admin_role.user_id
         mock_membership.workspace_id = mock_workspace_data.id
-        mock_membership.role = WorkspaceRole.ADMIN
         mock_membership_svc.get_membership.return_value = MembershipWithOrg(
             membership=mock_membership, org_id=mock_workspace_data.organization_id
         )

tests/unit/test_auth_middleware.py

@@ -222,7 +222,6 @@ async def test_performance_improvement(mocker):
     # Mock membership
     mock_membership = MagicMock(spec=Membership)
     mock_membership.workspace_id = workspace_id
-    mock_membership.role = WorkspaceRole.EDITOR
 
     # Track timing for database calls
     db_delay_ms = 10  # Simulate 10ms database query
@@ -458,7 +457,6 @@ async def test_cache_size_limit():
             spec=Membership,
             user_id=user.id,
             workspace_id=uuid.uuid4(),
-            role=WorkspaceRole.EDITOR,
         )
         for _ in range(1500)
     ]
@@ -625,7 +623,6 @@ async def test_role_dependency_infers_org_from_single_membership(
     membership = Membership(
         user_id=user.id,
         workspace_id=workspace.id,
-        role=WorkspaceRole.EDITOR,
     )
     # Also create organization membership - required for org context resolution
     org_membership = OrganizationMembership(
@@ -703,12 +700,10 @@ async def test_role_dependency_requires_workspace_for_multi_org(
         Membership(
             user_id=user.id,
             workspace_id=workspace_a.id,
-            role=WorkspaceRole.EDITOR,
         ),
         Membership(
             user_id=user.id,
             workspace_id=workspace_b.id,
-            role=WorkspaceRole.EDITOR,
         ),
     ]
     # Also create organization memberships for both orgs

tests/unit/test_invitation.py

@@ -9,7 +9,6 @@
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from tracecat.auth.schemas import UserRole
-from tracecat.authz.enums import OrgRole, WorkspaceRole
 from tracecat.db.models import (
     Invitation,
     Organization,
@@ -48,13 +47,25 @@ async def test_create_organization_invitation(self, session: AsyncSession):
         session.add(inviter)
         await session.flush()
 
+        # Create role for invitation
+        from tracecat.db.models import Role
+
+        member_role = Role(
+            id=uuid.uuid4(),
+            name="Member",
+            slug="member",
+            organization_id=org.id,
+        )
+        session.add(member_role)
+        await session.flush()
+
         # Create invitation
         token = uuid.uuid4().hex + uuid.uuid4().hex[:32]
         expires_at = datetime.now(UTC) + timedelta(days=7)
         invitation = OrganizationInvitation(
             organization_id=org.id,
             email="[email protected]",
-            role=OrgRole.MEMBER,
+            role_id=member_role.id,
             status=InvitationStatus.PENDING,
             invited_by=inviter.id,
             token=token,
@@ -67,7 +78,7 @@ async def test_create_organization_invitation(self, session: AsyncSession):
         assert invitation.id is not None
         assert invitation.organization_id == org.id
         assert invitation.email == "[email protected]"
-        assert invitation.role == OrgRole.MEMBER
+        assert invitation.role.slug == "member"
         assert invitation.status == InvitationStatus.PENDING
         assert invitation.invited_by == inviter.id
         assert invitation.token == token
@@ -86,11 +97,23 @@ async def test_organization_invitation_admin_role(self, session: AsyncSession):
         session.add(org)
         await session.flush()
 
+        # Create admin role for invitation
+        from tracecat.db.models import Role
+
+        admin_role = Role(
+            id=uuid.uuid4(),
+            name="Admin",
+            slug="admin",
+            organization_id=org.id,
+        )
+        session.add(admin_role)
+        await session.flush()
+
         token = uuid.uuid4().hex + uuid.uuid4().hex[:32]
         invitation = OrganizationInvitation(
             organization_id=org.id,
             email="[email protected]",
-            role=OrgRole.ADMIN,
+            role_id=admin_role.id,
             status=InvitationStatus.PENDING,
             invited_by=None,
             token=token,
@@ -100,7 +123,7 @@ async def test_organization_invitation_admin_role(self, session: AsyncSession):
         await session.commit()
         await session.refresh(invitation)
 
-        assert invitation.role == OrgRole.ADMIN
+        assert invitation.role.slug == "admin"
 
     @pytest.mark.anyio
     async def test_organization_invitation_status_transition(
@@ -116,11 +139,23 @@ async def test_organization_invitation_status_transition(
         session.add(org)
         await session.flush()
 
+        # Create role for invitation
+        from tracecat.db.models import Role
+
+        member_role = Role(
+            id=uuid.uuid4(),
+            name="Member",
+            slug="member",
+            organization_id=org.id,
+        )
+        session.add(member_role)
+        await session.flush()
+
         token = uuid.uuid4().hex + uuid.uuid4().hex[:32]
         invitation = OrganizationInvitation(
             organization_id=org.id,
             email="[email protected]",
-            role=OrgRole.MEMBER,
+            role_id=member_role.id,
             status=InvitationStatus.PENDING,
             invited_by=None,
             token=token,
@@ -150,11 +185,23 @@ async def test_organization_invitation_cascade_delete(self, session: AsyncSessio
         session.add(org)
         await session.flush()
 
+        # Create role for invitation
+        from tracecat.db.models import Role
+
+        member_role = Role(
+            id=uuid.uuid4(),
+            name="Member",
+            slug="member",
+            organization_id=org.id,
+        )
+        session.add(member_role)
+        await session.flush()
+
         token = uuid.uuid4().hex + uuid.uuid4().hex[:32]
         invitation = OrganizationInvitation(
             organization_id=org.id,
             email="[email protected]",
-            role=OrgRole.MEMBER,
+            role_id=member_role.id,
             status=InvitationStatus.PENDING,
             invited_by=None,
             token=token,
@@ -188,11 +235,23 @@ async def test_organization_invitation_unique_token(self, session: AsyncSession)
         session.add(org)
         await session.flush()
 
+        # Create role for invitation
+        from tracecat.db.models import Role
+
+        member_role = Role(
+            id=uuid.uuid4(),
+            name="Member",
+            slug="member",
+            organization_id=org.id,
+        )
+        session.add(member_role)
+        await session.flush()
+
         token = uuid.uuid4().hex + uuid.uuid4().hex[:32]
         invitation1 = OrganizationInvitation(
             organization_id=org.id,
             email="[email protected]",
-            role=OrgRole.MEMBER,
+            role_id=member_role.id,
             status=InvitationStatus.PENDING,
             invited_by=None,
             token=token,
@@ -205,7 +264,7 @@ async def test_organization_invitation_unique_token(self, session: AsyncSession)
         invitation2 = OrganizationInvitation(
             organization_id=org.id,
             email="[email protected]",
-            role=OrgRole.MEMBER,
+            role_id=member_role.id,
             status=InvitationStatus.PENDING,
             invited_by=None,
             token=token,  # Same token
@@ -254,13 +313,25 @@ async def test_create_workspace_invitation(self, session: AsyncSession):
         session.add(inviter)
         await session.flush()
 
+        # Create role for invitation
+        from tracecat.db.models import Role
+
+        editor_role = Role(
+            id=uuid.uuid4(),
+            name="Editor",
+            slug="editor",
+            organization_id=org.id,
+        )
+        session.add(editor_role)
+        await session.flush()
+
         # Create invitation
         token = uuid.uuid4().hex + uuid.uuid4().hex[:32]
         expires_at = datetime.now(UTC) + timedelta(days=7)
         invitation = Invitation(
             workspace_id=workspace.id,
             email="[email protected]",
-            role=WorkspaceRole.EDITOR,
+            role_id=editor_role.id,
             status=InvitationStatus.PENDING,
             invited_by=inviter.id,
             token=token,
@@ -273,7 +344,7 @@ async def test_create_workspace_invitation(self, session: AsyncSession):
         assert invitation.id is not None
         assert invitation.workspace_id == workspace.id
         assert invitation.email == "[email protected]"
-        assert invitation.role == WorkspaceRole.EDITOR
+        assert invitation.role.slug == "editor"
         assert invitation.status == InvitationStatus.PENDING
         assert invitation.invited_by == inviter.id
         assert invitation.token == token
@@ -300,11 +371,23 @@ async def test_workspace_invitation_admin_role(self, session: AsyncSession):
         session.add(workspace)
         await session.flush()
 
+        # Create admin role for invitation
+        from tracecat.db.models import Role
+
+        admin_role = Role(
+            id=uuid.uuid4(),
+            name="Admin",
+            slug="admin",
+            organization_id=org.id,
+        )
+        session.add(admin_role)
+        await session.flush()
+
         token = uuid.uuid4().hex + uuid.uuid4().hex[:32]
         invitation = Invitation(
             workspace_id=workspace.id,
             email="[email protected]",
-            role=WorkspaceRole.ADMIN,
+            role_id=admin_role.id,
             status=InvitationStatus.PENDING,
             invited_by=None,
             token=token,
@@ -314,7 +397,7 @@ async def test_workspace_invitation_admin_role(self, session: AsyncSession):
         await session.commit()
         await session.refresh(invitation)
 
-        assert invitation.role == WorkspaceRole.ADMIN
+        assert invitation.role.slug == "admin"
 
     @pytest.mark.anyio
     async def test_workspace_invitation_status_transition(self, session: AsyncSession):
@@ -336,11 +419,23 @@ async def test_workspace_invitation_status_transition(self, session: AsyncSessio
         session.add(workspace)
         await session.flush()
 
+        # Create role for invitation
+        from tracecat.db.models import Role
+
+        editor_role = Role(
+            id=uuid.uuid4(),
+            name="Editor",
+            slug="editor",
+            organization_id=org.id,
+        )
+        session.add(editor_role)
+        await session.flush()
+
         token = uuid.uuid4().hex + uuid.uuid4().hex[:32]
         invitation = Invitation(
             workspace_id=workspace.id,
             email="[email protected]",
-            role=WorkspaceRole.EDITOR,
+            role_id=editor_role.id,
             status=InvitationStatus.PENDING,
             invited_by=None,
             token=token,
@@ -376,11 +471,23 @@ async def test_workspace_invitation_cascade_delete(self, session: AsyncSession):
         session.add(workspace)
         await session.flush()
 
+        # Create role for invitation
+        from tracecat.db.models import Role
+
+        editor_role = Role(
+            id=uuid.uuid4(),
+            name="Editor",
+            slug="editor",
+            organization_id=org.id,
+        )
+        session.add(editor_role)
+        await session.flush()
+
         token = uuid.uuid4().hex + uuid.uuid4().hex[:32]
         invitation = Invitation(
             workspace_id=workspace.id,
             email="[email protected]",
-            role=WorkspaceRole.EDITOR,
+            role_id=editor_role.id,
             status=InvitationStatus.PENDING,
             invited_by=None,
             token=token,
@@ -420,11 +527,23 @@ async def test_workspace_invitation_unique_token(self, session: AsyncSession):
         session.add(workspace)
         await session.flush()
 
+        # Create role for invitation
+        from tracecat.db.models import Role
+
+        editor_role = Role(
+            id=uuid.uuid4(),
+            name="Editor",
+            slug="editor",
+            organization_id=org.id,
+        )
+        session.add(editor_role)
+        await session.flush()
+
         token = uuid.uuid4().hex + uuid.uuid4().hex[:32]
         invitation1 = Invitation(
             workspace_id=workspace.id,
             email="[email protected]",
-            role=WorkspaceRole.EDITOR,
+            role_id=editor_role.id,
             status=InvitationStatus.PENDING,
             invited_by=None,
             token=token,
@@ -437,7 +556,7 @@ async def test_workspace_invitation_unique_token(self, session: AsyncSession):
         invitation2 = Invitation(
             workspace_id=workspace.id,
             email="[email protected]",
-            role=WorkspaceRole.EDITOR,
+            role_id=editor_role.id,
             status=InvitationStatus.PENDING,
             invited_by=None,
             token=token,  # Same token