Framework for User Permissions & Roles

ami/main/models.py

@@ -106,18 +106,9 @@ def create_default_research_site(project: "Project") -> "Site":
 class ProjectQuerySet(models.QuerySet):
     def filter_by_user(self, user):
         """
-        Filters projects to include only those where the given user has any role.
+        Filters projects to include only those where the given user is a member.
         """
-
-        # To avoid circular import
-        from ami.users.roles import Role  # noqa: F401
-
-        # @TODO modify once we have the formal relationship between projects and groups
-        return self.filter(
-            id__in=Project.objects.filter(
-                id__in=[project.id for project in Project.objects.all() if Role.user_has_any_role(user, project)]
-            )
-        )
+        return self.filter(members=user)
 
 
 class ProjectManager(models.Manager):

ami/main/tests.py

@@ -1341,11 +1341,7 @@ def _test_role_permissions(self, role_class, user, permissions_map):
         # Step 5: Unassign Role and Verify Permissions are Revoked
         if role_class:
             role_class.unassign_user(user, self.project)
-
-            # if user is the project manager unassign the basic member role as well
-            if role_class == ProjectManager:
-                BasicMember.unassign_user(user, project=self.project)
-
+            BasicMember.unassign_user(user, project=self.project)
             self.client.force_authenticate(user=user)
 
             for entity, actions in permissions_map.items():
@@ -1369,6 +1365,7 @@ def _test_role_permissions(self, role_class, user, permissions_map):
             response = self.client.post(endpoints["capture_star"])
             logger.info(f"star capture response: {response.json()}")
             logger.info(f"Testing {role_class} for star capture permission after role unassignment")
+            logger.info(f"{role_class} {user} user permissions: {get_perms(user, self.project)}")
             self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
 
             response = self.client.post(endpoints["capture_unstar"])

ami/users/signals.py

@@ -1,7 +1,12 @@
 import logging
 
+from django.contrib.auth.models import Group
+from django.db import transaction
+from django.db.models.signals import m2m_changed
+from django.dispatch import receiver
+
 from ami.main.models import Project
-from ami.users.roles import create_roles_for_project
+from ami.users.roles import Role, create_roles_for_project
 
 logger = logging.getLogger(__name__)
 
@@ -12,3 +17,47 @@ def create_roles(sender, **kwargs):
     logger.info("Creating roles")
     for project in Project.objects.all():
         create_roles_for_project(project)
+
+
+@receiver(m2m_changed, sender=Group.user_set.through)
+def manage_project_membership(sender, instance, action, reverse, model, pk_set, **kwargs):
+    """
+    When a user is added/removed from a permissions group, update project members accordingly.
+
+    """
+    if action not in ["post_add", "post_remove"]:
+        return  # Only handle add and remove actions
+
+    # Temporarily disconnect the signal before updating project.members to prevent infinite recursion.
+    m2m_changed.disconnect(manage_project_membership, sender=Group.user_set.through)
+    logger.info("Disconnecting signal to prevent infinite recursion.")
+    try:
+        with transaction.atomic():  # Ensure DB consistency
+            for group in Group.objects.filter(pk__in=pk_set):
+                parts = group.name.split("_")  # Expected format: {project_id}_{project_name}_{Role}
+
+                try:
+                    project_id = int(parts[0])
+                    project = Project.objects.get(id=project_id)
+                except (ValueError, Project.DoesNotExist):
+                    logger.warning(f"Skipping invalid group or missing project: {group.name}")
+                    continue
+
+                user = instance
+                if action == "post_add":
+                    # Add user to project members if not already in
+                    if not project.members.filter(id=user.id).exists():
+                        project.members.add(user)
+                        logger.info(f"Added {user.email} to project {project.name} members.")
+
+                elif action == "post_remove":
+                    # Check if user still has any role in this project and they exist in the project members
+                    has_any_role = Role.user_has_any_role(user, project)
+                    if not has_any_role and project.members.filter(id=user.id).exists():
+                        project.members.remove(user)
+                        logger.info(f"Removed {user.email} from project {project.name} members (no remaining roles).")
+
+    finally:
+        # Reconnect the signal after updating members
+        m2m_changed.connect(manage_project_membership, sender=Group.user_set.through)
+        logger.info("Reconnecting signal after updating project members.")