[RBAC Phase 3] Integrate RBAC with SQLAdmin Panel

[zayed95]

Overview

Add SQLAdmin views for role and permission management, allowing administrators to manage roles and assign permissions through the web-based admin interface using the permission tree hierarchy.

Files to Create/Update

1. SQLAdmin Views

File: backend/src/interfaces/admin/views/roles.py (new)

Create SQLAdmin views for Role and RolePermission models:

from sqladmin import ModelView

class RoleAdmin(ModelView, model=Role):
    name = "Role"
    name_plural = "Roles"
    
    column_list = [Role.id, Role.name, Role.description, Role.created_at]
    column_labels = {"is_deleted": "Deleted"}
    column_searchable_list = [Role.name, Role.description]
    column_sortable_list = [Role.id, Role.created_at, Role.name]
    column_default_sort = [(Role.created_at, True)]
    
    form_columns = [Role.name, Role.description]
    form_create_rules = ["name", "description"]
    form_edit_rules = ["name", "description"]
    
    # Custom fields or actions for permission assignment...

File: backend/src/interfaces/admin/views/role_permissions.py (new)

Create views for permission assignment with permission tree rendering:

class RolePermissionAdmin(ModelView, model=RolePermission):
    name = "Role Permission"
    name_plural = "Role Permissions"
    
    column_list = [RolePermission.id, RolePermission.role_id, RolePermission.permission_name]
    column_labels = {"role_id": "Role", "permission_name": "Permission"}
    column_searchable_list = [RolePermission.permission_name]
    
    form_columns = [RolePermission.role_id, RolePermission.permission_name]
    
    # Optionally: custom form rendering to use permission tree dropdown...

2. Permission Tree Widget

File: backend/src/interfaces/admin/widgets.py (new, optional)

For advanced UI, create a custom SQLAdmin converter to render the permission tree as a hierarchical checkbox/select widget in the role admin form.

# Pseudocode: custom form field that renders PERMISSION_TREE

3. User Roles Admin View

File: backend/src/interfaces/admin/views/user_roles.py (new)

Manage user-role assignments:

class UserRoleAdmin(ModelView, model=UserRole):
    name = "User Role"
    name_plural = "User Roles"
    
    column_list = [UserRole.id, UserRole.user_id, UserRole.role_id, UserRole.created_at]
    column_labels = {"user_id": "User", "role_id": "Role"}
    column_sortable_list = [UserRole.created_at]
    column_default_sort = [(UserRole.created_at, True)]
    
    form_columns = [UserRole.user_id, UserRole.role_id]

4. Enhance Existing UserAdmin

File: backend/src/interfaces/admin/views/users.py (update)

Add a read-only section displaying the user's assigned roles and effective permissions:

class UserAdmin(ModelView, model=User):
    # Existing fields...
    
    # Add a custom column or section showing:
    # - Assigned roles
    # - Effective permissions (flattened from all roles)
    # - Option to assign/remove roles

5. Register Views

File: backend/src/interfaces/admin/views/__init__.py (update)

from .roles import RoleAdmin
from .role_permissions import RolePermissionAdmin
from .user_roles import UserRoleAdmin

def register_admin_views(admin: Admin) -> None:
    admin.add_view(UserAdmin)
    admin.add_view(RoleAdmin)
    admin.add_view(RolePermissionAdmin)
    admin.add_view(UserRoleAdmin)
    admin.add_view(TierAdmin)

UI/UX Enhancements

1. Permission Checkboxes: When editing a role, show all available permissions as checkboxes organized by the permission tree hierarchy.
2. Permission Tree Rendering: Collapse/expand tree sections in the admin UI.
3. User Role Assignment: On the User edit form, show a multi-select for assigning roles.
4. Effective Permissions View: Display all effective permissions for a user (read-only).

Schema Updates

Update backend/src/modules/role/schemas.py to support admin panel serialization:

• Include relationship fields for role->permissions and user->roles
• Add admin-only schemas if needed

Testing

Write tests in backend/tests/integration/admin/test_rbac_admin.py:

• Access admin role view (with admin auth)
• Create role via admin
• Assign permissions via admin
• Update role via admin
• Delete role via admin (soft-delete)
• Assign role to user via admin
• Verify permission tree structure displayed

Documentation

Add to docs/user-guide/admin-panel/:

• New file: rbac-management.md – Guide for managing roles and permissions in the admin panel
• Update adding-models.md to mention the new Role, RolePermission, UserRole models

Acceptance Criteria

• RoleAdmin view created and registered
• RolePermissionAdmin view for permission assignment
• UserRoleAdmin view for user-role assignments
• Permission tree organized hierarchically in admin UI
• UserAdmin enhanced to show assigned roles and permissions
• All views properly authenticated (admin login required)
• Create, update, delete operations working via admin
• Integration tests passing
• Admin documentation written