fairdm.portal_roles

The four roles FairDM ships, declared once, and their installation into every portal.

The module is named portal_roles, not roles, because the bare word “role” already names a :class:~fairdm.contrib.contributors.models.Contribution’s role (see CONTEXT.md).

Module Contents

Classes

PortalRole	One shipped role: its stored name, its display label, and the exact permissions it holds.
PortalRoles	The roles FairDM ships, and the methods that read and install them.

API

class PortalRole

Bases: typing.NamedTuple

One shipped role: its stored name, its display label, and the exact permissions it holds.

Attributes: name: The stored name of the role’s group. label: The role’s display label. permissions: The permissions the role holds, each an explicit app_label.codename.

name: str

None

label: str | django.utils.functional.Promise

None

permissions: tuple[str, ...]

()

class PortalRoles

The roles FairDM ships, and the methods that read and install them.

PORTAL_ADMINISTRATOR

‘PortalRole(…)’

DATA_CURATOR

‘PortalRole(…)’

COMMUNITY_MANAGER

‘PortalRole(…)’

DEVELOPER

‘PortalRole(…)’

ROLES: tuple[fairdm.portal_roles.PortalRole, ...]

()

LEGACY_NAMES

None

classmethod shipped_names() → list[str]

Return the stored name of every role FairDM ships, in declaration order.

Returns: The role names.

classmethod is_held_by(user, role: fairdm.portal_roles.PortalRole) → bool

Say whether a user is an active member of a role’s group.

The check reads the group, never a Django permission: a Portal Administrator holds contributors.change_person and does not hold the Community Manager role. A superuser in no group holds no role.

Args: user: The user, or an anonymous user for a visitor. role: The role to look for.

Returns: True when the user is authenticated, active and in the group named role.name.

classmethod rights_carrying() → list[str]

Return the stored names of the roles that hold at least one permission.

Holding any of these gives access to the administration interface. Holding only a role absent from this list does not.

Returns: The names of the roles with at least one permission.

classmethod reconcile() → None

Install the four roles into the database.

Renames the legacy rows first, so their membership carries across, then creates whatever role is still missing and sets each role’s permissions to exactly its declaration, restoring a permission removed by hand and removing one added by hand. Membership is never touched, and a group this method did not create or rename is never looked at.