Alec Perkins
b9378b8397
Projects under organizations with fixed URL name and feature ID prefix, three visibility levels, open contribution, per-project roles, settings and typed-confirmation delete. Hidden projects 404. Leaving an org drops its project roles. Project access rules live in intent/access.py alongside org access. Features numbered per project (INT-12) in a tree. Every change is a revision with a required note; history, old revisions, and side-by-side field and line diffs between any two. Cycles and superseded-without-replacement are rejected. Markdown renders safely with source-line attributes for Phase 3 line comments and headings shifted below the page h1. Server-side preview works without JS. Structural accessibility check runs on every page in tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
71 lines
2.3 KiB
Python
71 lines
2.3 KiB
Python
"""Project rules. Same conventions as intent.orgs.services."""
|
|
|
|
from django.core.exceptions import PermissionDenied, ValidationError
|
|
from django.db import transaction
|
|
|
|
from intent.access import org_access, project_access
|
|
from intent.orgs.models import Role
|
|
|
|
from .models import Project, ProjectMembership
|
|
|
|
|
|
def _require_admin(by, project):
|
|
if not project_access(by, project).can_admin:
|
|
raise PermissionDenied
|
|
|
|
|
|
def create_project(org, by, *, slug, name, feature_prefix, visibility, open_contribution):
|
|
if not org_access(by, org).can_create_projects:
|
|
raise PermissionDenied
|
|
project = Project(
|
|
org=org,
|
|
slug=slug,
|
|
name=name,
|
|
feature_prefix=feature_prefix.upper(),
|
|
visibility=visibility,
|
|
open_contribution=open_contribution,
|
|
)
|
|
project.full_clean()
|
|
with transaction.atomic():
|
|
project.save()
|
|
ProjectMembership.objects.create(project=project, user=by, role=Role.OWNER)
|
|
return project
|
|
|
|
|
|
def update_settings(project, by, *, name, visibility, open_contribution) -> None:
|
|
_require_admin(by, project)
|
|
project.name = name
|
|
project.visibility = visibility
|
|
project.open_contribution = open_contribution
|
|
project.full_clean()
|
|
project.save(update_fields=["name", "visibility", "open_contribution", "updated_at"])
|
|
|
|
|
|
def delete_project(project, by) -> None:
|
|
_require_admin(by, project)
|
|
project.delete()
|
|
|
|
|
|
def add_member(project, by, *, user, role=Role.COLLABORATOR) -> ProjectMembership:
|
|
_require_admin(by, project)
|
|
if not org_access(user, project.org).is_member:
|
|
raise ValidationError(f"{user.username} isn't on the {project.org} team.")
|
|
if project.memberships.filter(user=user).exists():
|
|
raise ValidationError(f"{user.username} is already on this project.")
|
|
return ProjectMembership.objects.create(project=project, user=user, role=role)
|
|
|
|
|
|
def update_member(membership, by, *, role) -> None:
|
|
_require_admin(by, membership.project)
|
|
membership.role = role
|
|
membership.save(update_fields=["role", "updated_at"])
|
|
|
|
|
|
def remove_member(membership, by) -> None:
|
|
"""Admins can remove anyone; members can remove themselves.
|
|
|
|
No last-owner guard: org owners can always administer the project.
|
|
"""
|
|
if membership.user_id != by.pk:
|
|
_require_admin(by, membership.project)
|
|
membership.delete()
|