Skip to content

Perm cleanup#21

Open
Maffooch wants to merge 10 commits intodevfrom
perm-cleanup
Open

Perm cleanup#21
Maffooch wants to merge 10 commits intodevfrom
perm-cleanup

Conversation

@Maffooch
Copy link
Copy Markdown
Owner

⚠️ Pre-Approval check ⚠️

We don't want to waste your time, so if you're unsure whether your hypothetical enhancement meets the criteria for approval, please file an issue to get pre-approval before beginning work on a PR.
Learn more here: https://github.com/DefectDojo/django-DefectDojo/blob/master/readme-docs/CONTRIBUTING.md#submission-pre-approval

Description

Describe the feature / bug fix implemented by this PR.
If this is a new parser, the parser guide may be worth (re)reading.

Test results

Ideally you extend the test suite in tests/ and dojo/unittests to cover the changed in this PR.
Alternatively, describe what you have and haven't tested.

Documentation

Please update any documentation when needed in the documentation folder)

Checklist

This checklist is for your information.

  • Make sure to rebase your PR against the very latest dev.
  • Features/Changes should be submitted against the dev.
  • Bugfixes should be submitted against the bugfix branch.
  • Give a meaningful name to your PR, as it may end up being used in the release notes.
  • Your code is Ruff compliant (see ruff.toml).
  • Your code is python 3.13 compliant.
  • If this is a new feature and not a bug fix, you've included the proper documentation in the docs at https://github.com/DefectDojo/django-DefectDojo/tree/dev/docs as part of this PR.
  • Model changes must include the necessary migrations in the dojo/db_migrations folder.
  • Add applicable tests to the unit tests.
  • Add the proper label to categorize your PR.

Extra information

Please clear everything below when submitting your pull request, it's here purely for your information.

Moderators: Labels currently accepted for PRs:

  • Import Scans (for new scanners/importers)
  • enhancement
  • performance
  • feature
  • bugfix
  • maintenance (a.k.a chores)
  • dependencies
  • New Migration (when the PR introduces a DB migration)
  • settings_changes (when the PR introduces changes or new settings in settings.dist.py)

Contributors: Git Tips

Rebase on dev branch

If the dev branch has changed since you started working on it, please rebase your work after the current dev.

On your working branch mybranch:

git rebase dev mybranch

In case of conflict:

 git mergetool
 git rebase --continue

When everything's fine on your local branch, force push to your myOrigin remote:

git push myOrigin --force-with-lease

To cancel everything:

git rebase --abort

Squashing commits

git rebase -i origin/dev
  • Replace pick by fixup on the commits you want squashed out
  • Replace pick by reword on the first commit if you want to change the commit message
  • Save the file and quit your editor

Force push to your myOrigin remote:

git push myOrigin --force-with-lease

Maffooch and others added 8 commits March 30, 2026 22:09
Move 7 RBAC models (Role, Global_Role, Dojo_Group_Member,
Product_Member, Product_Group, Product_Type_Member,
Product_Type_Group) from dojo/models.py into
dojo/authorization/models.py with app_label='dojo' to maintain
migration compatibility. Update all imports across 47 files.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Move dojo/api_v2/permissions.py and dojo/location/api/permissions.py
into dojo/authorization/api_permissions.py. Delete the original files
and update all imports across consumers and tests.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…rs.py

Extract filter functions from dojo/templatetags/authorization_tags.py
into dojo/authorization/template_filters.py. The templatetags file
becomes a thin registration proxy that imports and registers the
filters with Django's template library.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Create dojo/authorization/query_filters.py with a registry pattern and
dojo/authorization/query_registrations.py with all RBAC filter logic
extracted from 14 queries.py files. Each get_authorized_* function
becomes a thin wrapper that checks the registry and falls back to
returning unfiltered querysets when RBAC is not present.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…tors

Create dojo/authorization/url_permissions.py mapping ~198 URL names to
their permission checks, and dojo/authorization/middleware.py with
AuthorizationMiddleware using process_view to enforce permissions.
Add middleware to settings after crum.CurrentRequestUserMiddleware.
Remove all @user_is_authorized, @user_has_global_permission, and
@user_is_configuration_authorized decorators from 26 view files.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Export public API surface (user_has_permission, Permissions, etc.) and
import query_registrations to trigger RBAC filter registration at
startup.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Fix import sorting (I001), unused imports (F401), explicit return None
(RET501), and add noqa comments for intentional lazy imports (PLC0415)
used to avoid circular dependencies.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Replace lambda fallbacks with def (E731)
- Rename _impl to impl (RUF052)
- Fix undefined name references in models.py (F821) by using string FK
  reference and adding late import for admin registrations
- Auto-fix import sorting and formatting (I001)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Maffooch and others added 2 commits March 30, 2026 23:54
Update @patch targets in test files to point to new module locations:
- queries.get_current_user → query_registrations.get_current_user
- authorization_tags.user_has_permission → template_filters.user_has_permission
Convert test_apply_finding_template tests from direct view calls to
Django test client requests so middleware authorization runs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add inline permission checks to 4 view functions that are called
directly by unit tests (bypassing middleware): mktemplate,
apply_template_to_finding, choose_finding_template_options, and
add_finding_from_template. Revert test changes to keep original
test pattern using impersonate + direct view calls.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant