Release v0.1.5

src/govoplan_access/backend/auth/roles.py

@@ -2,7 +2,16 @@ from __future__ import annotations
 
 from sqlalchemy.orm import Session
 
-from govoplan_access.backend.db.models import Account, Group, GroupMembership, Membership, Role, RoleBinding
+from govoplan_access.backend.db.models import (
+    Account,
+    Group,
+    GroupRoleAssignment,
+    Role,
+    SystemRoleAssignment,
+    User,
+    UserGroupMembership,
+    UserRoleAssignment,
+)
 from govoplan_access.backend.permissions.evaluator import expand_scopes
 from govoplan_core.core.modules import PermissionDefinition, SubjectType
 
@@ -10,10 +19,10 @@ from govoplan_core.core.modules import PermissionDefinition, SubjectType
 def membership_group_ids(session: Session, *, tenant_id: str, membership_id: str) -> frozenset[str]:
     rows = (
         session.query(Group.id)
-        .join(GroupMembership, GroupMembership.group_id == Group.id)
+        .join(UserGroupMembership, UserGroupMembership.group_id == Group.id)
         .filter(
-            GroupMembership.tenant_id == tenant_id,
-            GroupMembership.membership_id == membership_id,
+            UserGroupMembership.tenant_id == tenant_id,
+            UserGroupMembership.user_id == membership_id,
             Group.is_active.is_(True),
         )
         .all()
@@ -28,22 +37,44 @@ def roles_for_subject(
     subject_id: str,
     tenant_id: str | None,
 ) -> list[Role]:
-    query = (
-        session.query(Role)
-        .join(RoleBinding, RoleBinding.role_id == Role.id)
-        .filter(
-            RoleBinding.subject_type == subject_type,
-            RoleBinding.subject_id == subject_id,
+    if tenant_id is None and subject_type == "account":
+        return (
+            session.query(Role)
+            .join(SystemRoleAssignment, SystemRoleAssignment.role_id == Role.id)
+            .filter(SystemRoleAssignment.account_id == subject_id, Role.tenant_id.is_(None))
+            .order_by(Role.name.asc())
+            .all()
         )
-    )
     if tenant_id is None:
-        query = query.filter(RoleBinding.tenant_id.is_(None), Role.tenant_id.is_(None))
-    else:
-        query = query.filter(RoleBinding.tenant_id == tenant_id, Role.tenant_id == tenant_id)
-    return query.order_by(Role.name.asc()).all()
+        return []
+    if subject_type == "membership":
+        return (
+            session.query(Role)
+            .join(UserRoleAssignment, UserRoleAssignment.role_id == Role.id)
+            .filter(
+                UserRoleAssignment.tenant_id == tenant_id,
+                UserRoleAssignment.user_id == subject_id,
+                Role.tenant_id == tenant_id,
+            )
+            .order_by(Role.name.asc())
+            .all()
+        )
+    if subject_type == "group":
+        return (
+            session.query(Role)
+            .join(GroupRoleAssignment, GroupRoleAssignment.role_id == Role.id)
+            .filter(
+                GroupRoleAssignment.tenant_id == tenant_id,
+                GroupRoleAssignment.group_id == subject_id,
+                Role.tenant_id == tenant_id,
+            )
+            .order_by(Role.name.asc())
+            .all()
+        )
+    return []
 
 
-def membership_roles(session: Session, membership: Membership) -> list[Role]:
+def membership_roles(session: Session, membership: User) -> list[Role]:
     roles_by_id = {
         role.id: role
         for role in roles_for_subject(
@@ -67,7 +98,7 @@ def principal_scopes(
     session: Session,
     *,
     account: Account,
-    membership: Membership | None,
+    membership: User | None,
     include_system: bool,
     catalog: dict[str, PermissionDefinition],
 ) -> list[str]: