Bind Farm Calendar entitlement actions to per-farm/parcel scopes

.gitignore

@@ -33,4 +33,5 @@ media/
 generate_folder_structure.py
 
 testing/
-docs/
+docs/
+scripts/

aegis/migrations/0015_servicescopeassignment_optional_scope.py

@@ -0,0 +1,26 @@
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('aegis', '0014_alter_servicerole_options_and_more'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='servicescopeassignment',
+            name='scope_type',
+            field=models.CharField(
+                blank=True,
+                null=True,
+                max_length=20,
+                choices=[('farm', 'farm'), ('parcel', 'parcel')],
+            ),
+        ),
+        migrations.AlterField(
+            model_name='servicescopeassignment',
+            name='scope_id',
+            field=models.UUIDField(blank=True, null=True, db_index=True),
+        ),
+    ]

aegis/models.py

@@ -62,6 +62,20 @@ class Meta:
     def __str__(self):
         return f"{self.code} - {self.name}"
 
+    def soft_delete(self):
+        if self.status == 2 and str(self.code).startswith("deleted__"):
+            return
+        prefix = f"deleted__{self.id.hex[:12]}__"
+        code_budget = max(1, 32 - len(prefix))
+        slug_budget = max(1, 64 - len(prefix))
+        name_budget = max(1, 255 - len(prefix))
+        self.code = f"{prefix}{(self.code or '')[:code_budget]}"
+        self.slug = f"{prefix}{(self.slug or '')[:slug_budget]}"
+        self.name = f"{prefix}{(self.name or '')[:name_budget]}"
+        self.status = 2
+        self.deleted_at = timezone.now()
+        self.save()
+
 
 class RequestLog(models.Model):
     user = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.SET_NULL, null=True, blank=True)
@@ -327,6 +341,19 @@ class Meta:
     def __str__(self):
         return f"{self.service_name} ({self.service_code})"
 
+    def soft_delete(self):
+        if self.status == 2 and str(self.service_code).startswith("deleted__"):
+            return
+        code_prefix = f"deleted__{self.pk}__"
+        name_prefix = f"deleted__{self.pk}__"
+        code_budget = max(1, 50 - len(code_prefix))
+        name_budget = max(1, 100 - len(name_prefix))
+        self.service_code = f"{code_prefix}{(self.service_code or '')[:code_budget]}"
+        self.service_name = f"{name_prefix}{(self.service_name or '')[:name_budget]}"
+        self.status = 2
+        self.deleted_at = timezone.now()
+        self.save()
+
 
 class GroupServiceAccess(BaseModel):
     """
@@ -409,8 +436,8 @@ class ServiceScopeAssignment(BaseModel):
     )
     role = models.CharField(max_length=50, default="viewer")
     actions = models.JSONField(default=list, blank=True)
-    scope_type = models.CharField(max_length=20, choices=SCOPE_TYPE_CHOICES)
-    scope_id = models.UUIDField(db_index=True)
+    scope_type = models.CharField(max_length=20, choices=SCOPE_TYPE_CHOICES, blank=True, null=True)
+    scope_id = models.UUIDField(db_index=True, blank=True, null=True)
 
     class Meta:
         db_table = "service_scope_assignments"

aegis/services/entitlement_service.py

@@ -3,9 +3,7 @@
 from django.db.models import Q
 
 from aegis.models import (
-    CustomPermissions,
     FarmCalendarResourceCache,
-    GroupCustomPermissions,
     PermissionMaster,
     ServiceMaster,
     ServiceScopeAssignment,
@@ -27,6 +25,18 @@ def _is_fc_service(service_code, service_name):
     )
 
 
+def fc_service_queryset(base_qs=None):
+    """Filter a ServiceMaster queryset (default: all rows) down to FC."""
+    if base_qs is None:
+        base_qs = ServiceMaster.objects.all()
+    return base_qs.filter(
+        Q(service_code__iexact="FC")
+        | Q(service_code__iexact="farmcalendar")
+        | Q(service_name__iexact="Farm Calendar")
+        | Q(service_name__iexact="FarmCalendar")
+    )
+
+
 def _empty_service_entry(service_code, service_name):
     return {
         "code": service_code,
@@ -105,18 +115,30 @@ def _apply_superuser_entitlements():
     return services
 
 
-def _apply_tenant_admin_fc_entitlements(user, services):
+def _apply_tenant_user_entitlements(user, services):
+    """Policy:
+    - Every user that belongs to a tenant gets all non-FC services tenant-wide
+      (unrestricted, all actions).
+    - Tenant admins additionally get FC enumerated to every farm/parcel in
+      their tenant. Non-admin users get FC only via explicit Role Grants.
+    """
     tenant_id = getattr(user, "tenant_id", None)
-    if not getattr(user, "is_tenant_admin", False) or not tenant_id:
+    if not tenant_id:
+        return services
+    if getattr(user, "is_superuser", False):
         return services
 
-    active_fc_services = ServiceMaster.objects.filter(status=1).values_list("service_code", "service_name")
-    for service_code, service_name in active_fc_services:
-        if not _is_fc_service(service_code, service_name):
+    is_tenant_admin = bool(getattr(user, "is_tenant_admin", False))
+
+    active_services = ServiceMaster.objects.filter(status=1).values_list("service_code", "service_name")
+    for service_code, service_name in active_services:
+        is_fc = _is_fc_service(service_code, service_name)
+        if is_fc and not is_tenant_admin:
             continue
 
         entry = _ensure_service_entry(services, service_code, service_name)
-        entry["roles"].add("tenant_admin")
+        if is_tenant_admin:
+            entry["roles"].add("tenant_admin")
 
         permission_actions = PermissionMaster.objects.filter(
             status=1,
@@ -127,29 +149,32 @@ def _apply_tenant_admin_fc_entitlements(user, services):
             if action:
                 entry["actions"].add(action)
 
-        fc_rows = FarmCalendarResourceCache.objects.filter(
-            status=1,
-            tenant_id=tenant_id,
-            resource_type__in=("farm", "parcel"),
-        ).values_list("resource_type", "resource_id")
-        for scope_type, scope_id in fc_rows:
-            _append_assignment(
-                entry,
-                role="tenant_admin",
-                actions=sorted(entry["actions"]),
-                scope_type=scope_type,
-                scope_id=scope_id,
-                source="tenant_admin",
-            )
+        if is_fc:
+            fc_rows = FarmCalendarResourceCache.objects.filter(
+                status=1,
+                tenant_id=tenant_id,
+                resource_type__in=("farm", "parcel"),
+            ).values_list("resource_type", "resource_id")
+            for scope_type, scope_id in fc_rows:
+                _append_assignment(
+                    entry,
+                    role="tenant_admin",
+                    actions=sorted(entry["actions"]),
+                    scope_type=scope_type,
+                    scope_id=scope_id,
+                    source="tenant_admin",
+                )
+        else:
+            entry["unrestricted"] = True
 
     return services
 
 
 def resolve_service_entitlements_for_user(user):
     """
     Build normalized per-service entitlements for a user by combining:
-    1) Legacy action grants (CustomPermissions + GroupCustomPermissions)
-    2) Scoped assignments (ServiceScopeAssignment)
+    1) Tenant-wide auto-grants (non-FC) + tenant-admin FC scope
+    2) Scoped assignments (ServiceScopeAssignment / Role Grants)
 
     Output keeps both:
     - flattened compatibility fields (`roles`, `actions`, `scopes`)
@@ -160,48 +185,10 @@ def resolve_service_entitlements_for_user(user):
     else:
         services = {}
 
-    services = _apply_tenant_admin_fc_entitlements(user, services)
+    services = _apply_tenant_user_entitlements(user, services)
 
     group_ids = list(user.groups.values_list("id", flat=True))
 
-    # Legacy action grants via groups.
-    group_rows = (
-        GroupCustomPermissions.objects
-        .filter(
-            group_id__in=group_ids, status=1,
-            permission_names__status=1,
-            permission_names__service__status=1,
-        )
-        .values_list(
-            "permission_names__service__service_code",
-            "permission_names__service__service_name",
-            "permission_names__action",
-        )
-    )
-    for service_code, service_name, action in group_rows:
-        if service_code and action:
-            entry = _ensure_service_entry(services, service_code, service_name)
-            entry["actions"].add(action)
-
-    # Legacy action grants via direct user permissions.
-    user_rows = (
-        CustomPermissions.objects
-        .filter(
-            user=user, status=1,
-            permission_name__status=1,
-            permission_name__service__status=1,
-        )
-        .values_list(
-            "permission_name__service__service_code",
-            "permission_name__service__service_name",
-            "permission_name__action",
-        )
-    )
-    for service_code, service_name, action in user_rows:
-        if service_code and action:
-            entry = _ensure_service_entry(services, service_code, service_name)
-            entry["actions"].add(action)
-
     # Scoped assignments via group or user.
     scope_assignments = (
         ServiceScopeAssignment.objects

aegis/signals.py

@@ -0,0 +1,18 @@
+# aegis/signals.py
+
+from django.db.models.signals import post_save
+from django.dispatch import receiver
+
+from aegis.models import PermissionMaster, ServiceMaster
+
+
+@receiver(post_save, sender=ServiceMaster)
+def seed_standard_permissions(sender, instance, created, **kwargs):
+    if not created:
+        return
+    for action, _ in PermissionMaster.ACTION_CHOICES:
+        PermissionMaster.objects.get_or_create(
+            service=instance,
+            action=action,
+            defaults={"status": 1},
+        )

aegis/static/aegis/admin/service_scope_assignment.js

@@ -11,24 +11,10 @@
 
   function setRowVisibility(fieldName, visible) {
     var row = findRow(fieldName);
-    var input = findInput(fieldName);
     if (!row) {
       return;
     }
     row.style.display = visible ? "" : "none";
-    if (input) {
-      input.disabled = !visible;
-    }
-  }
-
-  function syncSubjectFields() {
-    var subjectType = findInput("subject_type");
-    if (!subjectType) {
-      return;
-    }
-    var isGroup = subjectType.value === "group";
-    setRowVisibility("subject_group", isGroup);
-    setRowVisibility("subject_user", !isGroup);
   }
 
   function syncScopeFields() {
@@ -38,20 +24,13 @@
     }
     var isFarm = scopeType.value === "farm";
     var isParcel = scopeType.value === "parcel";
-    setRowVisibility("scope_farm", isFarm);
-    setRowVisibility("scope_parcel", isParcel);
+    setRowVisibility("scope_farms", isFarm);
+    setRowVisibility("scope_parcels", isParcel);
   }
 
   function init() {
-    var subjectType = findInput("subject_type");
     var scopeType = findInput("scope_type");
-
-    syncSubjectFields();
     syncScopeFields();
-
-    if (subjectType) {
-      subjectType.addEventListener("change", syncSubjectFields);
-    }
     if (scopeType) {
       scopeType.addEventListener("change", syncScopeFields);
     }

aegis/tests.py

@@ -0,0 +1,25 @@
+from django.test import SimpleTestCase
+
+from aegis.views.api.service_registry_views import _has_fc_service_wide_action
+
+
+class FarmCalendarServiceWideActionTests(SimpleTestCase):
+    def test_tenant_admin_can_use_flattened_service_action_without_scope_assignments(self):
+        entitlement = {
+            "roles": ["tenant_admin"],
+            "actions": ["add", "delete", "edit", "view"],
+            "assignments": [],
+            "unrestricted": False,
+        }
+
+        self.assertTrue(_has_fc_service_wide_action(entitlement, "add"))
+
+    def test_scoped_role_does_not_get_service_wide_action_from_flattened_actions(self):
+        entitlement = {
+            "roles": ["Viewer"],
+            "actions": ["view"],
+            "assignments": [],
+            "unrestricted": False,
+        }
+
+        self.assertFalse(_has_fc_service_wide_action(entitlement, "view"))