Coverage for src/lexigram/admin/resources/roles.py: 100%

1"""Roles management resource for Lexigram Admin.""" 

2 

3from __future__ import annotations 

4 

5from typing import Any, cast 

6 

7from lexigram.admin.config import AdminRbacConfig 

8from lexigram.admin.resources.base import Resource 

9from lexigram.contracts.auth import RoleDefinition 

10 

11 

12class RolesResource(Resource): 

13 """Manage RBAC roles and permissions.""" 

14 

15 model = cast("Any", RoleDefinition) 

16 name = "roles" 

17 label = "Roles" 

18 icon = "shield-check" 

19 category = "system" 

20 

21 # Fields to display in forms 

22 fields = [ 

23 "name", 

24 "description", 

25 "permissions", 

26 "inherits", 

27 "is_system", 

28 ] 

29 

30 # Fields to display in list view 

31 list_display = [ 

32 "name", 

33 "description", 

34 "permissions", 

35 "inherits", 

36 "is_system", 

37 ] 

38 

39 # SearchableProtocol fields 

40 search_fields = ["name", "description"] 

41 

42 # Read-only fields (ensure system roles cannot be renamed easily) 

43 readonly_fields = ["created_at", "updated_at"] 

44 

45 def __init__(self, rbac_config: AdminRbacConfig | None = None) -> None: 

46 """Store the resolved RBAC config for protected-role checks. 

47 

48 Args: 

49 rbac_config: Optional; falls back to a default 

50 ``AdminRbacConfig`` (``super_admin_role="superadmin"``). 

51 """ 

52 self._rbac_config = rbac_config or AdminRbacConfig() 

53 

54 def can_delete(self, item: RoleDefinition) -> bool: 

55 """Prevent deletion of system roles and the super-admin role. 

56 

57 Args: 

58 item: Role being deleted. 

59 

60 Returns: 

61 False when the role is ``is_system`` or matches the 

62 configured ``super_admin_role``. 

63 """ 

64 super_admin_role = self._rbac_config.super_admin_role 

65 return not (item.is_system or item.name == super_admin_role) 

66 

67 def can_update(self, item: RoleDefinition) -> bool: 

68 """Prevent renaming or is_system-flag changes on protected roles. 

69 

70 Args: 

71 item: Role being updated. 

72 

73 Returns: 

74 False when the role is ``is_system`` or matches the 

75 configured ``super_admin_role``. 

76 """ 

77 super_admin_role = self._rbac_config.super_admin_role 

78 return not (item.is_system or item.name == super_admin_role)