6009: add organizations to invitation querysets, serializer, and sync

Extends organization invitations (Invitation.organization, added in
#6008) end-to-end through the existing channel-invitation permission
model and /sync mechanism, per #6009.

- Organization.filter_edit_queryset/filter_view_queryset - new
  classmethods based on active OrganizationRole membership (admin for
  edit, admin/editor/viewer for view; excludes soft-deleted
  organizations), mirroring the existing Channel pattern.
- Invitation.filter_edit_queryset/filter_view_queryset - extended with
  the same organization-role checks, in a single filter() so the
  multi-valued OrganizationRole join matches one row rather than
  across rows.
- InvitationSerializer - organization is now a field alongside
  channel (via UserFilteredPrimaryKeyRelatedField, scoped by
  Organization.filter_edit_queryset); channel becomes optional and
  validate() requires exactly one of channel/organization.
- get_fields() - match the invitee on email rather than the `invited`
  FK, since `invited` is only ever populated by the channel
  email-invite flow and is never set for invitations created through
  the sync API. Unlock `revoked` for any active org admin of the
  invitation's organization, not just the original sender. Lock
  `share_mode` read-only for anyone but the sender/org-admin, so an
  invitee can't self-escalate (e.g. request "admin" access) before
  accepting.
- update() - read accepted/revoked from validated_data, not
  initial_data, so get_fields' read-only flags can't be bypassed by
  the raw client payload; only trigger accept() on an actual incoming
  toggle rather than re-running it on every later update to an
  already-accepted invitation. Tag user_id on the accept/decline echo
  events (both the sync-based update() and the REST actions) so
  they're routable.
- InvitationFilter/InvitationViewSet - organization filter and
  field_map entry alongside the existing channel ones.
- /sync's handle_changes() is untouched - organization-scoped
  invitation changes route the same way any other self-only change
  does (client tags user_id as its own id), relying entirely on the
  model-layer filter_edit_queryset checks above for authorization
  when the change is actually applied.

Test coverage: OrganizationTestCase/InvitationOrganizationTestCase in
test_models.py exercise the querysets directly.
OrganizationInvitationSyncTestCase in test_invitation.py covers
create/accept/revoke/delete via /sync, non-admin rejection, cross-org
isolation, an org admin unable to force-accept on behalf of the real
invitee, an invitee unable to raise their own share_mode before
accepting, the channel/organization mutual-exclusivity and
"at-least-one" validation, and that org-scoped changes require a
self-tagged user_id (missing or mismatched is rejected, not silently
dropped or re-routed). Also a channel-invitation test locking in that
the "admin" (co-owner) share_mode currently grants the same editor
access as "edit". The REST create route (POST /invitation/) has no
org-specific test, since InvitationViewSet has no create route at all
for either channel or organization invitations - creation is /sync
only, and the existing non-org 405 test already covers that; the
?organization= list filter is exercised directly instead.

Author: yazzylazy

contentcuration/contentcuration/models.py

@@ -1895,6 +1895,40 @@ class Meta:
     def __str__(self):
         return self.name
 
+    @classmethod
+    def filter_edit_queryset(cls, queryset, user):
+        if user.is_anonymous:
+            return queryset.none()
+
+        if user.is_admin:
+            return queryset
+
+        return queryset.filter(
+            user_roles__user=user,
+            user_roles__role=ORGANIZATION_ADMIN,
+            user_roles__status=ORGANIZATION_ROLE_STATUS_ACTIVE,
+            deleted=False,
+        ).distinct()
+
+    @classmethod
+    def filter_view_queryset(cls, queryset, user):
+        if user.is_anonymous:
+            return queryset.none()
+
+        if user.is_admin:
+            return queryset
+
+        return queryset.filter(
+            user_roles__user=user,
+            user_roles__role__in=[
+                ORGANIZATION_ADMIN,
+                ORGANIZATION_EDITOR,
+                ORGANIZATION_VIEWER,
+            ],
+            user_roles__status=ORGANIZATION_ROLE_STATUS_ACTIVE,
+            deleted=False,
+        ).distinct()
+
 
 class OrganizationRole(models.Model):
     """
@@ -3807,7 +3841,14 @@ def filter_edit_queryset(cls, queryset, user):
             return queryset
 
         return queryset.filter(
-            Q(email__iexact=user.email) | Q(sender=user) | Q(channel__editors=user)
+            Q(email__iexact=user.email)
+            | Q(sender=user)
+            | Q(channel__editors=user)
+            | Q(
+                organization__user_roles__user=user,
+                organization__user_roles__role=ORGANIZATION_ADMIN,
+                organization__user_roles__status=ORGANIZATION_ROLE_STATUS_ACTIVE,
+            )
         ).distinct()
 
     @classmethod
@@ -3822,6 +3863,15 @@ def filter_view_queryset(cls, queryset, user):
             | Q(sender=user)
             | Q(channel__editors=user)
             | Q(channel__viewers=user)
+            | Q(
+                organization__user_roles__user=user,
+                organization__user_roles__role__in=[
+                    ORGANIZATION_ADMIN,
+                    ORGANIZATION_EDITOR,
+                    ORGANIZATION_VIEWER,
+                ],
+                organization__user_roles__status=ORGANIZATION_ROLE_STATUS_ACTIVE,
+            )
         ).distinct()
 
 

contentcuration/contentcuration/tests/test_models.py

@@ -16,6 +16,15 @@
 from contentcuration.constants import channel_history
 from contentcuration.constants import community_library_submission
 from contentcuration.constants import user_history
+from contentcuration.constants.organization_roles import ORGANIZATION_ADMIN
+from contentcuration.constants.organization_roles import ORGANIZATION_EDITOR
+from contentcuration.constants.organization_roles import (
+    ORGANIZATION_ROLE_STATUS_ACTIVE,
+)
+from contentcuration.constants.organization_roles import (
+    ORGANIZATION_ROLE_STATUS_PENDING,
+)
+from contentcuration.constants.organization_roles import ORGANIZATION_VIEWER
 from contentcuration.models import AssessmentItem
 from contentcuration.models import AuditedSpecialPermissionsLicense
 from contentcuration.models import Change
@@ -34,6 +43,8 @@
 from contentcuration.models import Language
 from contentcuration.models import License
 from contentcuration.models import object_storage_name
+from contentcuration.models import Organization
+from contentcuration.models import OrganizationRole
 from contentcuration.models import RecommendationsEvent
 from contentcuration.models import RecommendationsInteractionEvent
 from contentcuration.models import User
@@ -309,6 +320,165 @@ def create_change(server_rev, applied):
         self.assertEqual(channel.get_server_rev(), 2)
 
 
+class OrganizationTestCase(PermissionQuerysetTestCase):
+    @property
+    def base_queryset(self):
+        return Organization.objects.all()
+
+    def test_filter_edit_queryset__admin_role(self):
+        organization = testdata.organization()
+        user = testdata.user()
+
+        queryset = Organization.filter_edit_queryset(self.base_queryset, user=user)
+        self.assertQuerysetDoesNotContain(queryset, pk=organization.id)
+
+        OrganizationRole.objects.create(
+            user=user,
+            organization=organization,
+            role=ORGANIZATION_ADMIN,
+            status=ORGANIZATION_ROLE_STATUS_ACTIVE,
+        )
+        queryset = Organization.filter_edit_queryset(self.base_queryset, user=user)
+        self.assertQuerysetContains(queryset, pk=organization.id)
+
+    def test_filter_edit_queryset__editor_role_cannot_edit(self):
+        organization = testdata.organization()
+        user = testdata.user()
+        OrganizationRole.objects.create(
+            user=user,
+            organization=organization,
+            role=ORGANIZATION_EDITOR,
+            status=ORGANIZATION_ROLE_STATUS_ACTIVE,
+        )
+
+        queryset = Organization.filter_edit_queryset(self.base_queryset, user=user)
+        self.assertQuerysetDoesNotContain(queryset, pk=organization.id)
+
+    def test_filter_edit_queryset__pending_admin_cannot_edit(self):
+        organization = testdata.organization()
+        user = testdata.user()
+        OrganizationRole.objects.create(
+            user=user,
+            organization=organization,
+            role=ORGANIZATION_ADMIN,
+            status=ORGANIZATION_ROLE_STATUS_PENDING,
+        )
+
+        queryset = Organization.filter_edit_queryset(self.base_queryset, user=user)
+        self.assertQuerysetDoesNotContain(queryset, pk=organization.id)
+
+    def test_filter_edit_queryset__anonymous(self):
+        organization = testdata.organization()
+
+        queryset = Organization.filter_edit_queryset(
+            self.base_queryset, user=self.anonymous_user
+        )
+        self.assertQuerysetDoesNotContain(queryset, pk=organization.id)
+
+    def test_filter_view_queryset__viewer_role(self):
+        organization = testdata.organization()
+        user = testdata.user()
+
+        queryset = Organization.filter_view_queryset(self.base_queryset, user=user)
+        self.assertQuerysetDoesNotContain(queryset, pk=organization.id)
+
+        OrganizationRole.objects.create(
+            user=user,
+            organization=organization,
+            role=ORGANIZATION_VIEWER,
+            status=ORGANIZATION_ROLE_STATUS_ACTIVE,
+        )
+        queryset = Organization.filter_view_queryset(self.base_queryset, user=user)
+        self.assertQuerysetContains(queryset, pk=organization.id)
+
+    def test_filter_view_queryset__anonymous(self):
+        organization = testdata.organization()
+
+        queryset = Organization.filter_view_queryset(
+            self.base_queryset, user=self.anonymous_user
+        )
+        self.assertQuerysetDoesNotContain(queryset, pk=organization.id)
+
+
+class InvitationOrganizationTestCase(PermissionQuerysetTestCase):
+    @property
+    def base_queryset(self):
+        return Invitation.objects.all()
+
+    def _make_org_invitation(self):
+        organization = testdata.organization()
+        invitee = testdata.user(email="org-invitee@le.com")
+        invitation = Invitation.objects.create(
+            email=invitee.email, organization=organization
+        )
+        return organization, invitation
+
+    def test_filter_edit_queryset__organization_admin(self):
+        organization, invitation = self._make_org_invitation()
+        user = testdata.user()
+
+        queryset = Invitation.filter_edit_queryset(self.base_queryset, user=user)
+        self.assertQuerysetDoesNotContain(queryset, pk=invitation.id)
+
+        OrganizationRole.objects.create(
+            user=user,
+            organization=organization,
+            role=ORGANIZATION_ADMIN,
+            status=ORGANIZATION_ROLE_STATUS_ACTIVE,
+        )
+        queryset = Invitation.filter_edit_queryset(self.base_queryset, user=user)
+        self.assertQuerysetContains(queryset, pk=invitation.id)
+
+    def test_filter_edit_queryset__organization_editor_cannot_edit(self):
+        organization, invitation = self._make_org_invitation()
+        user = testdata.user()
+        OrganizationRole.objects.create(
+            user=user,
+            organization=organization,
+            role=ORGANIZATION_EDITOR,
+            status=ORGANIZATION_ROLE_STATUS_ACTIVE,
+        )
+
+        queryset = Invitation.filter_edit_queryset(self.base_queryset, user=user)
+        self.assertQuerysetDoesNotContain(queryset, pk=invitation.id)
+
+    def test_filter_view_queryset__organization_editor(self):
+        organization, invitation = self._make_org_invitation()
+        user = testdata.user()
+
+        queryset = Invitation.filter_view_queryset(self.base_queryset, user=user)
+        self.assertQuerysetDoesNotContain(queryset, pk=invitation.id)
+
+        OrganizationRole.objects.create(
+            user=user,
+            organization=organization,
+            role=ORGANIZATION_EDITOR,
+            status=ORGANIZATION_ROLE_STATUS_ACTIVE,
+        )
+        queryset = Invitation.filter_view_queryset(self.base_queryset, user=user)
+        self.assertQuerysetContains(queryset, pk=invitation.id)
+
+    def test_filter_view_queryset__organization_viewer(self):
+        organization, invitation = self._make_org_invitation()
+        user = testdata.user()
+        OrganizationRole.objects.create(
+            user=user,
+            organization=organization,
+            role=ORGANIZATION_VIEWER,
+            status=ORGANIZATION_ROLE_STATUS_ACTIVE,
+        )
+
+        queryset = Invitation.filter_view_queryset(self.base_queryset, user=user)
+        self.assertQuerysetContains(queryset, pk=invitation.id)
+
+    def test_filter_view_queryset__unrelated_user(self):
+        organization, invitation = self._make_org_invitation()
+        user = testdata.user()
+
+        queryset = Invitation.filter_view_queryset(self.base_queryset, user=user)
+        self.assertQuerysetDoesNotContain(queryset, pk=invitation.id)
+
+
 class ContentNodeTestCase(PermissionQuerysetTestCase):
     @property
     def base_queryset(self):

contentcuration/contentcuration/tests/testdata.py

@@ -19,6 +19,10 @@
 from contentcuration.constants import (
     community_library_submission as community_library_submission_constants,
 )
+from contentcuration.constants.organization_roles import ORGANIZATION_ADMIN
+from contentcuration.constants.organization_roles import (
+    ORGANIZATION_ROLE_STATUS_ACTIVE,
+)
 from contentcuration.tests.utils import mixer
 
 
@@ -253,6 +257,18 @@ def channel(name="testchannel"):
     return channel
 
 
+def organization(name="Test Organization"):
+    return cc.Organization.objects.create(name=name)
+
+
+def organization_role(
+    user, organization, role=ORGANIZATION_ADMIN, status=ORGANIZATION_ROLE_STATUS_ACTIVE
+):
+    return cc.OrganizationRole.objects.create(
+        user=user, organization=organization, role=role, status=status
+    )
+
+
 def random_string(chars=10):
     """
     Generate a random string