Coverage for src / lexigram / admin / resources / roles.py: 0%

1"""Roles management resource for Lexigram Admin.""" 

2 

3from __future__ import annotations 

4 

5from lexigram.admin.models.auth import AdminRoleEntity # type: ignore[import-untyped] 

6from lexigram.admin.resources.base import Resource 

7 

8 

9class RolesResource(Resource): 

10 """Manage RBAC roles and permissions.""" 

11 

12 model = AdminRoleEntity 

13 name = "roles" 

14 label = "Roles" 

15 icon = "shield-check" 

16 category = "system" 

17 

18 # Fields to display in forms 

19 fields = [ 

20 "name", 

21 "description", 

22 "permissions", 

23 "inherits", 

24 "is_system", 

25 ] 

26 

27 # Fields to display in list view 

28 list_display = [ 

29 "name", 

30 "description", 

31 "permissions", 

32 "inherits", 

33 "is_system", 

34 ] 

35 

36 # SearchableProtocol fields 

37 search_fields = ["name", "description"] 

38 

39 # Read-only fields (ensure system roles cannot be renamed easily) 

40 readonly_fields = ["created_at", "updated_at"] 

41 

42 def can_delete(self, item: AdminRoleEntity) -> bool: 

43 """Prevent deletion of system roles.""" 

44 return not item.is_system 

45 

46 def can_update(self, item: AdminRoleEntity) -> bool: 

47 """Prevent renaming of system roles.""" 

48 # This is a simplification; ideally we'd allow updating permissions but not name 

49 return True