Skip to content

Commit f6bb273

Browse files
danh91danh91
committed
feat: remove poorly implemented permissions layer
1 parent 9df1763 commit f6bb273

File tree

18 files changed

+235
-325
lines changed

18 files changed

+235
-325
lines changed

‎community‎

‎ee/insiders‎

‎modules/core/karrio/server/core/tests/base.py‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,8 @@
44
from karrio.server.core.logging import logger
55

66
from karrio.server.user.models import Token
7-
import karrio.server.iam.permissions as iam
87
import karrio.server.providers.models as providers
98

10-
iam.setup_groups()
11-
129

1310
class APITestCase(BaseAPITestCase):
1411
def setUp(self) -> None:

‎modules/core/karrio/server/iam/apps.py‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,10 @@ class IamConfig(AppConfig):
99

1010
def ready(self):
1111
from karrio.server.core import utils
12-
from karrio.server.iam import signals, permissions
12+
from karrio.server.iam import signals
1313

1414
@utils.skip_on_commands()
1515
def _init():
1616
signals.register_all()
1717

18-
# Setup default permission groups and apply to existing orgs on start up
19-
utils.run_on_all_tenants(permissions.setup_groups)()
20-
2118
_init()

‎modules/core/karrio/server/iam/migrations/0003_remove_permission_groups.py‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
# Generated migration to remove permission groups
2+
3+
from django.db import migrations
4+
5+
6+
def remove_permission_groups(apps, schema_editor):
7+
"""
8+
Remove all permission groups that were created by setup_groups().
9+
10+
This migration removes the following groups:
11+
- manage_apps
12+
- manage_carriers (deprecated)
13+
- read_carriers
14+
- write_carriers
15+
- manage_orders
16+
- manage_team
17+
- manage_org_owner
18+
- manage_webhooks
19+
- manage_data
20+
- manage_shipments
21+
- manage_system
22+
"""
23+
Group = apps.get_model("user", "Group")
24+
ContextPermission = apps.get_model("iam", "ContextPermission")
25+
26+
# List of groups to remove
27+
groups_to_remove = [
28+
"manage_apps",
29+
"manage_carriers",
30+
"read_carriers",
31+
"write_carriers",
32+
"manage_orders",
33+
"manage_team",
34+
"manage_org_owner",
35+
"manage_webhooks",
36+
"manage_data",
37+
"manage_shipments",
38+
"manage_system",
39+
"manage_pickups",
40+
"manage_trackers",
41+
]
42+
43+
# First, remove the groups from all ContextPermissions
44+
for group_name in groups_to_remove:
45+
group = Group.objects.filter(name=group_name).first()
46+
if group:
47+
# Remove this group from all context permissions
48+
for ctx_perm in ContextPermission.objects.filter(groups=group):
49+
ctx_perm.groups.remove(group)
50+
51+
# Then delete the groups themselves
52+
Group.objects.filter(name__in=groups_to_remove).delete()
53+
54+
55+
def reverse_migration(apps, schema_editor):
56+
"""
57+
Reverse migration - recreate groups (without permissions, which were set dynamically).
58+
Note: This won't restore the full permission setup, only creates empty groups.
59+
"""
60+
Group = apps.get_model("user", "Group")
61+
62+
groups_to_create = [
63+
"manage_apps",
64+
"manage_carriers",
65+
"read_carriers",
66+
"write_carriers",
67+
"manage_orders",
68+
"manage_team",
69+
"manage_org_owner",
70+
"manage_webhooks",
71+
"manage_data",
72+
"manage_shipments",
73+
"manage_system",
74+
"manage_pickups",
75+
"manage_trackers",
76+
]
77+
78+
for group_name in groups_to_create:
79+
Group.objects.get_or_create(name=group_name)
80+
81+
82+
class Migration(migrations.Migration):
83+
84+
dependencies = [
85+
("iam", "0002_setup_carrier_permission_groups"),
86+
("user", "0004_group"),
87+
]
88+
89+
operations = [
90+
migrations.RunPython(remove_permission_groups, reverse_migration),
91+
]

‎modules/core/karrio/server/iam/permissions.py‎

Lines changed: 7 additions & 155 deletions
Original file line numberDiff line numberDiff line change
@@ -1,155 +1,7 @@
1-
import typing
2-
from django.db import models
3-
from django.contrib.auth import get_user_model
4-
from django.contrib.auth.models import Permission
5-
from karrio.server.core.logging import logger
6-
7-
import karrio.server.core.utils as utils
8-
import karrio.server.user.models as users
9-
import karrio.server.iam.serializers as serializers
10-
11-
User = get_user_model()
12-
13-
14-
@utils.skip_on_loadata
15-
@utils.async_wrapper
16-
@utils.tenant_aware
17-
def setup_groups(**_):
18-
"""This function create all standard group permissions if they don't exsist."""
19-
logger.info("Setting up permissions")
20-
21-
# manage_apps
22-
setup_group(
23-
serializers.PermissionGroup.manage_apps.name,
24-
permissions=Permission.objects.filter(content_type__app_label="apps"),
25-
)
26-
27-
# manage_carriers (deprecated - kept for backward compatibility)
28-
setup_group(
29-
serializers.PermissionGroup.manage_carriers.name,
30-
permissions=[
31-
*Permission.objects.filter(content_type__app_label="providers"),
32-
*Permission.objects.filter(
33-
models.Q(content_type__app_label="orgs")
34-
& models.Q(name__icontains="carrier")
35-
),
36-
],
37-
override=True,
38-
)
39-
40-
# read_carriers (view permissions only)
41-
setup_group(
42-
serializers.PermissionGroup.read_carriers.name,
43-
permissions=Permission.objects.filter(
44-
content_type__app_label="providers", name__icontains="view"
45-
),
46-
override=True,
47-
)
48-
49-
# write_carriers (create, update, delete permissions)
50-
setup_group(
51-
serializers.PermissionGroup.write_carriers.name,
52-
permissions=[
53-
*Permission.objects.filter(content_type__app_label="providers"),
54-
*Permission.objects.filter(
55-
models.Q(content_type__app_label="orgs")
56-
& models.Q(name__icontains="carrier")
57-
),
58-
],
59-
override=True,
60-
)
61-
62-
# manage_orders
63-
setup_group(
64-
serializers.PermissionGroup.manage_orders.name,
65-
permissions=Permission.objects.filter(content_type__app_label="orders"),
66-
)
67-
68-
# manage_team
69-
setup_group(
70-
serializers.PermissionGroup.manage_team.name,
71-
permissions=(
72-
Permission.objects.filter(
73-
content_type__app_label="orgs", name__icontains="organization"
74-
).exclude(name__icontains="owner")
75-
),
76-
override=True,
77-
)
78-
79-
# manage_org_owner
80-
setup_group(
81-
serializers.PermissionGroup.manage_org_owner.name,
82-
permissions=Permission.objects.filter(
83-
content_type__model="OrganizationOwner".lower()
84-
),
85-
)
86-
87-
# manage_webhooks
88-
setup_group(
89-
serializers.PermissionGroup.manage_webhooks.name,
90-
permissions=Permission.objects.filter(content_type__model="Webhook".lower()),
91-
)
92-
93-
# manage_data
94-
setup_group(
95-
serializers.PermissionGroup.manage_data.name,
96-
permissions=[
97-
*Permission.objects.filter(
98-
content_type__app_label__in=["data", "graph", "documents"]
99-
),
100-
*Permission.objects.filter(
101-
content_type__app_label="audit", name__icontains="view"
102-
),
103-
*Permission.objects.filter(
104-
content_type__app_label="rest_framework_tracking",
105-
name__icontains="view",
106-
),
107-
],
108-
override=True,
109-
)
110-
111-
# manage_shipments
112-
setup_group(
113-
serializers.PermissionGroup.manage_shipments.name,
114-
permissions=[
115-
*Permission.objects.filter(content_type__app_label="manager"),
116-
*Permission.objects.filter(
117-
models.Q(content_type__app_label="orgs")
118-
& (
119-
models.Q(name__icontains="address")
120-
| models.Q(name__icontains="parcel")
121-
| models.Q(name__icontains="commodity")
122-
| models.Q(name__icontains="customs")
123-
| models.Q(name__icontains="pickup")
124-
| models.Q(name__icontains="tracker")
125-
| models.Q(name__icontains="shipment")
126-
)
127-
),
128-
],
129-
)
130-
131-
# manage_system
132-
setup_group(
133-
serializers.PermissionGroup.manage_system.name,
134-
permissions=Permission.objects.filter(
135-
content_type__app_label__in=[
136-
"admin",
137-
"user",
138-
"pricing",
139-
"providers",
140-
"audit",
141-
"database",
142-
"rest_framework_tracking",
143-
]
144-
),
145-
)
146-
147-
148-
def setup_group(
149-
name: str, permissions: typing.List[Permission], override: bool = False
150-
):
151-
group, created = users.Group.objects.get_or_create(name=name)
152-
153-
if created or override:
154-
group.permissions.set(permissions)
155-
group.save()
1+
# This module previously contained permission group setup logic.
2+
# The setup_groups() function has been removed to:
3+
# 1. Fix Django warning about database access during app initialization
4+
# 2. Prepare for a better RBAC implementation in the future
5+
#
6+
# The PermissionGroup enum and ROLES_GROUPS mapping are preserved in
7+
# karrio.server.iam.serializers for organization role management.

‎modules/data/karrio/server/graph/schemas/data/mutations.py‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@ class CreateDataTemplateMutation(utils.BaseMutation):
1515

1616
@staticmethod
1717
@utils.authentication_required
18-
@utils.authorization_required(["DATA_IMPORT_EXPORT"])
1918
def mutate(
2019
info: Info, **input: inputs.CreateDataTemplateMutationInput
2120
) -> "CreateDataTemplateMutation":
@@ -34,7 +33,6 @@ class UpdateDataTemplateMutation(utils.BaseMutation):
3433

3534
@staticmethod
3635
@utils.authentication_required
37-
@utils.authorization_required(["DATA_IMPORT_EXPORT"])
3836
def mutate(
3937
info: Info, **input: inputs.UpdateDataTemplateMutationInput
4038
) -> "UpdateDataTemplateMutation":

‎modules/data/karrio/server/graph/schemas/data/types.py‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -60,13 +60,11 @@ class BatchOperationType:
6060

6161
@staticmethod
6262
@utils.authentication_required
63-
@utils.authorization_required(["DATA_IMPORT_EXPORT"])
6463
def resolve(info, id: str) -> typing.Optional["BatchOperationType"]:
6564
return models.BatchOperation.access_by(info.context.request).filter(id=id).first()
6665

6766
@staticmethod
6867
@utils.authentication_required
69-
@utils.authorization_required(["DATA_IMPORT_EXPORT"])
7068
def resolve_list(
7169
info,
7270
filter: typing.Optional[inputs.BatchOperationFilter] = strawberry.UNSET,

0 commit comments

Comments
 (0)