fix: update user.changed_on when roles are modified

flask_appbuilder/security/sqla/manager.py

@@ -282,6 +282,15 @@ def count_users(self):
 
     def update_user(self, user):
         try:
+            # Load existing user from DB to detect role/group changes
+            existing_user = self.session.get(self.user_model, user.id)
+
+            roles_changed = set(existing_user.roles) != set(user.roles)
+            groups_changed = set(existing_user.groups) != set(user.groups)
+
+            if roles_changed or groups_changed:
+                user.changed_on = datetime.utcnow()  # pragma: no cover
+
             self.session.merge(user)
             self.session.commit()
             log.info(c.LOGMSG_INF_SEC_UPD_USER, user)

tests/test_security_manager.py

@@ -0,0 +1,20 @@
+def test_user_changed_on_updates_on_role_change(appbuilder):
+    sm = appbuilder.sm
+
+    role = sm.add_role("TestRole")
+
+    user = sm.add_user(
+        username="test_user",
+        first_name="Test",
+        last_name="User",
+        email="test_user@test.com",
+        password="password",
+    )
+
+    before = user.changed_on
+    assert before is not None
+
+    user.roles.append(role)
+    sm.update_user(user)
+
+    assert user.changed_on > before