✨ update permission script - admin: delete "owns" groups when non relevent

2 files changed, 74 insertions, 1 deletions

diff --git a/ishtar_common/migrations/0254_permissionrequests.py b/ishtar_common/migrations/0254_permissionrequests.py
index 68c4891b0..6d3435ddb 100644
--- a/ishtar_common/migrations/0254_permissionrequests.py
+++ b/ishtar_common/migrations/0254_permissionrequests.py
@@ -169,5 +169,35 @@ class Migration(migrations.Migration):
             model_name='userprofile',
             name='profile_type',
             field=models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='user_profiles', to='ishtar_common.ProfileType', verbose_name='Profile type')
-        )
+        ),
+        migrations.AddField(
+            model_name='ishtaruser',
+            name='need_permission_update',
+            field=models.BooleanField(default=True, verbose_name='Need permission update'),
+        ),
+        migrations.AlterField(
+            model_name='biographicalnote',
+            name='ishtar_users',
+            field=models.ManyToManyField(blank=True, related_name='biographicalnote_associated', to='ishtar_common.IshtarUser'),
+        ),
+        migrations.AlterField(
+            model_name='document',
+            name='ishtar_users',
+            field=models.ManyToManyField(blank=True, related_name='document_associated', to='ishtar_common.IshtarUser'),
+        ),
+        migrations.AlterField(
+            model_name='organization',
+            name='ishtar_users',
+            field=models.ManyToManyField(blank=True, related_name='organization_associated', to='ishtar_common.IshtarUser'),
+        ),
+        migrations.AlterField(
+            model_name='person',
+            name='ishtar_users',
+            field=models.ManyToManyField(blank=True, related_name='person_associated', to='ishtar_common.IshtarUser'),
+        ),
+        migrations.AlterField(
+            model_name='profiletype',
+            name='groups',
+            field=models.ManyToManyField(blank=True, related_name='profile_types', to='auth.Group', verbose_name='Groups'),
+        ),
     ]
diff --git a/ishtar_common/migrations/0255_migrate_delete_permissions.py b/ishtar_common/migrations/0255_migrate_delete_perm_clean_groups.py
index 61b63c0df..d9aa4cd32 100644
--- a/ishtar_common/migrations/0255_migrate_delete_permissions.py
+++ b/ishtar_common/migrations/0255_migrate_delete_perm_clean_groups.py
@@ -3,7 +3,46 @@
 from django.db import migrations
 
 
+def clean_groups(profile_type):
+    # raw copy of the admin code
+    owns, full = {}, []
+    # get all permissions
+    for group in profile_type.groups.all():
+        permissions = []
+        own, gen = False, False
+        q = group.permissions
+        if not q.count():
+            continue
+        for permission in q.all():
+            if "_own_" in permission.codename:
+                own = True
+            else:
+                gen = True
+            parts = permission.codename.split("_")
+            permissions.append(f"{parts[0]}_{parts[-1]}")
+        if own and gen:
+            # group has "own" and "generic" permissions: do nothing
+            continue
+        permissions = tuple(sorted(permissions))
+        if own:
+            owns[permissions] = group
+        else:
+            full.append(permissions)
+    # clean
+        for permissions in owns.keys():
+            if len(permissions) == 1:
+                for full_permissions in full:
+                    for full_permission in full_permissions:
+                        if full_permission == permissions[0]:
+                            profile_type.groups.remove(owns[permissions])
+                            break
+            else:
+                if permissions in full:
+                    profile_type.groups.remove(owns[permissions])
+
+
 def migrate_permission(apps, __):
+    # clean delete permissions
     Permission = apps.get_model("auth", "permission")
     Group = apps.get_model("auth", "group")
     ProfileType = apps.get_model("ishtar_common", "profiletype")
@@ -39,6 +78,10 @@ def migrate_permission(apps, __):
         for profile_type in ProfileType.objects.filter(groups__pk=modif_group.pk).all():
             profile_type.groups.add(delete_group)
             print(f"\t- profile type {profile_type.label} updated")
+    # clean groups
+    ProfileType = apps.get_model("ishtar_common", "ProfileType")
+    for pt in ProfileType.objects.all():
+        clean_groups(pt)
 
 
 class Migration(migrations.Migration):