More docs edits

Move RBAC docs to proper place

Start on views with RoleDefinition first

Fix summary_fields that I broke

ansible_base/rbac/migrations/0002_roledefinition_created_by_roledefinition_created_on_and_more.py

@@ -0,0 +1,50 @@
+# Generated by Django 4.2.8 on 2024-01-23 02:11
+
+import django.db.models.deletion
+import django.utils.timezone
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+        ('dab_rbac', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='roledefinition',
+            name='created_by',
+            field=models.ForeignKey(
+                default=None, editable=False,
+                help_text='The user who created this resource',
+                null=True, on_delete=django.db.models.deletion.DO_NOTHING,
+                related_name='%(app_label)s_%(class)s_created+', to=settings.AUTH_USER_MODEL
+            ),
+        ),
+        migrations.AddField(
+            model_name='roledefinition',
+            name='created_on',
+            field=models.DateTimeField(default=django.utils.timezone.now, editable=False, help_text='The date/time this resource was created'),
+            preserve_default=False
+        ),
+        migrations.AddField(
+            model_name='roledefinition',
+            name='modified_by',
+            field=models.ForeignKey(
+                default=None, editable=False,
+                help_text='The user who last modified this resource', null=True,
+                on_delete=django.db.models.deletion.DO_NOTHING,
+                related_name='%(app_label)s_%(class)s_modified+',
+                to=settings.AUTH_USER_MODEL
+            ),
+        ),
+        migrations.AddField(
+            model_name='roledefinition',
+            name='modified_on',
+            field=models.DateTimeField(default=django.utils.timezone.now, editable=False, help_text='The date/time this resource was created'),
+            preserve_default=False
+        ),
+    ]

ansible_base/rbac/models.py

@@ -8,6 +8,9 @@
 from django.db import models
 from django.utils.translation import gettext_lazy as _
 
+# ansible_base lib functions
+from ansible_base.lib.abstract_models.common import CommonModel
+
 # ansible_base RBAC logic imports
 from ansible_base.rbac.permission_registry import permission_registry
 from ansible_base.rbac.prefetch import TypesPrefetch
@@ -75,7 +78,7 @@ def create_from_permissions(self, permissions=(), **kwargs):
         return rd
 
 
-class RoleDefinition(models.Model):
+class RoleDefinition(CommonModel):
     "Abstract definition of the permissions a role will grant before it is associated to an object"
 
     class Meta:

ansible_base/rbac/router.py

@@ -0,0 +1,7 @@
+from rest_framework.routers import SimpleRouter
+
+from ansible_base.rbac import views
+
+router = SimpleRouter()
+
+router.register(r'role_definitions', views.RoleDefinitionViewSet)

ansible_base/rbac/serializers.py

@@ -0,0 +1,14 @@
+from rest_framework import serializers
+
+from ansible_base.lib.serializers.common import CommonModelSerializer
+from ansible_base.rbac.models import RoleDefinition
+from ansible_base.rbac.permission_registry import permission_registry  # careful for circular imports
+
+
+class RoleDefinitionSerializer(CommonModelSerializer):
+    reverse_url_name = 'roledefinition-detail'
+    permissions = serializers.SlugRelatedField(many=True, slug_field='codename', queryset=permission_registry.permission_model.objects.all())
+
+    class Meta:
+        model = RoleDefinition
+        fields = '__all__'

ansible_base/rbac/urls.py

@@ -0,0 +1,7 @@
+from django.urls import include, path
+
+from ansible_base.rbac.router import router
+
+api_version_urls = [
+    path('', include(router.urls)),
+]

ansible_base/rbac/views.py

@@ -0,0 +1,15 @@
+from rest_framework import permissions
+from rest_framework.viewsets import ModelViewSet
+
+from ansible_base.rbac.models import RoleDefinition
+from ansible_base.rbac.serializers import RoleDefinitionSerializer
+
+
+class RoleDefinitionViewSet(ModelViewSet):
+    """
+    As per docs, RoleDefinition is interacted with like a normal model.
+    """
+
+    queryset = RoleDefinition.objects.all()
+    serializer_class = RoleDefinitionSerializer
+    permission_classes = [permissions.IsAuthenticated]

docs/rbac.md → docs/apps/rbac.md

@@ -1,9 +1,12 @@
 # Role-Based Access Control (RBAC)
 
-This intended for a developer audience, for applying this system to a Django app.
+This is a permission system at the Django model level
+ - you use roles to delegate permissions to users and teams
+ - this system will efficiently filter querysets to a certain permission level for a certain user
 
 ## Using
 
+Usage instructions are intended for someone applying this system to an existing Django app.
 Start with `docs/Installation.md` for the core ansible_base setup.
 The app name is dab_rbac.