trueppm-api 0.4.0__py3-none-any.whl

trueppm_api/apps/teams/migrations/0001_squashed_0002_default_teams.py

@@ -0,0 +1,159 @@
+# Generated by Django 5.2.14 on 2026-06-23 21:38
+
+import importlib
+import uuid
+from typing import Any
+
+import django.db.models.deletion
+import django.utils.timezone
+from django.conf import settings
+from django.db import migrations, models
+
+
+def _original(app: str, module: str, name: str) -> Any:
+    """Return a callable from a retained original migration module.
+
+    The original migrations stay on disk (migration rule 6), so the callable is
+    resolved from there rather than copied into this file.
+    """
+    # Every call site passes a constant app/module/name from this file, never user input.
+    # nosemgrep: python.lang.security.audit.non-literal-import.non-literal-import
+    return getattr(importlib.import_module(f"trueppm_api.apps.{app}.migrations.{module}"), name)
+
+
+class Migration(migrations.Migration):
+    replaces = [("teams", "0001_initial"), ("teams", "0002_default_teams")]
+
+    initial = True
+
+    dependencies = [
+        ("access", "0001_initial"),
+        ("projects", "0057_historicalsprint_binding_committed_snapshot_and_more"),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="Team",
+            fields=[
+                (
+                    "id",
+                    models.UUIDField(
+                        default=uuid.uuid4, editable=False, primary_key=True, serialize=False
+                    ),
+                ),
+                ("server_version", models.BigIntegerField(default=0, editable=False)),
+                ("is_deleted", models.BooleanField(db_index=True, default=False)),
+                ("deleted_version", models.BigIntegerField(blank=True, editable=False, null=True)),
+                ("name", models.CharField(max_length=255)),
+                ("short_id", models.CharField(max_length=8)),
+                ("description", models.TextField(blank=True, default="")),
+                ("is_default", models.BooleanField(db_index=True, default=False)),
+                (
+                    "created_at",
+                    models.DateTimeField(default=django.utils.timezone.now, editable=False),
+                ),
+                ("updated_at", models.DateTimeField(auto_now=True)),
+                (
+                    "created_by",
+                    models.ForeignKey(
+                        blank=True,
+                        null=True,
+                        on_delete=django.db.models.deletion.SET_NULL,
+                        related_name="created_teams",
+                        to=settings.AUTH_USER_MODEL,
+                    ),
+                ),
+                (
+                    "project",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="teams",
+                        to="projects.project",
+                    ),
+                ),
+            ],
+            options={
+                "db_table": "teams_team",
+            },
+        ),
+        migrations.CreateModel(
+            name="TeamMembership",
+            fields=[
+                (
+                    "id",
+                    models.UUIDField(
+                        default=uuid.uuid4, editable=False, primary_key=True, serialize=False
+                    ),
+                ),
+                ("server_version", models.BigIntegerField(default=0, editable=False)),
+                ("is_deleted", models.BooleanField(db_index=True, default=False)),
+                ("deleted_version", models.BigIntegerField(blank=True, editable=False, null=True)),
+                (
+                    "role",
+                    models.CharField(
+                        choices=[("member", "Member"), ("admin", "Admin")],
+                        default="member",
+                        max_length=16,
+                    ),
+                ),
+                ("is_scrum_master", models.BooleanField(default=False)),
+                ("is_product_owner", models.BooleanField(default=False)),
+                (
+                    "created_at",
+                    models.DateTimeField(default=django.utils.timezone.now, editable=False),
+                ),
+                (
+                    "team",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="memberships",
+                        to="teams.team",
+                    ),
+                ),
+                (
+                    "user",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="team_memberships",
+                        to=settings.AUTH_USER_MODEL,
+                    ),
+                ),
+            ],
+            options={
+                "db_table": "teams_team_membership",
+            },
+        ),
+        migrations.AddConstraint(
+            model_name="team",
+            constraint=models.UniqueConstraint(
+                condition=models.Q(("is_deleted", False)),
+                fields=("project", "name"),
+                name="team_name_per_project_unique",
+            ),
+        ),
+        migrations.AddConstraint(
+            model_name="team",
+            constraint=models.UniqueConstraint(
+                condition=models.Q(("is_default", True), ("is_deleted", False)),
+                fields=("project",),
+                name="team_one_default_per_project",
+            ),
+        ),
+        migrations.AddIndex(
+            model_name="teammembership",
+            index=models.Index(fields=["team", "user"], name="tm_team_user_idx"),
+        ),
+        migrations.AddConstraint(
+            model_name="teammembership",
+            constraint=models.UniqueConstraint(
+                condition=models.Q(("is_deleted", False)),
+                fields=("team", "user"),
+                name="team_member_unique",
+            ),
+        ),
+        migrations.RunPython(
+            code=_original("teams", "0002_default_teams", "create_default_teams"),
+            reverse_code=migrations.RunPython.noop,
+        ),
+    ]

trueppm_api/apps/teams/migrations/0002_default_teams.py

@@ -0,0 +1,62 @@
+"""Data migration: create one default Team per existing project and mirror
+ProjectMembership rows onto it (ADR-0078 §C).
+
+One-way and idempotent (get_or_create-shaped) so a re-run is a no-op. Forward
+only: the reverse is RunPython.noop because dropping migration-created teams
+would also strand any facets assigned afterward.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from django.db import migrations
+
+# Project Role.ADMIN ordinal (ADR-0072). Project Admin (300) and Owner (400)
+# become team Admin; everyone else is a team Member. Pinned as a literal here —
+# a data migration must stay frozen against the model-time enum, and the band
+# boundary is a stable contract — with the symbolic source named for the reader.
+_TEAM_ADMIN_ROLE_THRESHOLD = 300  # Role.ADMIN
+
+
+def create_default_teams(apps: Any, schema_editor: Any) -> None:
+    Project = apps.get_model("projects", "Project")
+    ProjectMembership = apps.get_model("access", "ProjectMembership")
+    Team = apps.get_model("teams", "Team")
+    TeamMembership = apps.get_model("teams", "TeamMembership")
+
+    for project in Project.objects.filter(is_deleted=False).iterator():
+        team, _created = Team.objects.get_or_create(
+            project=project,
+            is_default=True,
+            is_deleted=False,
+            defaults={
+                "name": "Default Team",
+                "short_id": "T01",
+                # Historical models bypass VersionedModel.save(), so stamp the
+                # initial server_version explicitly rather than leaving it 0.
+                "server_version": 1,
+            },
+        )
+
+        for pm in ProjectMembership.objects.filter(project=project, is_deleted=False).iterator():
+            team_role = "admin" if pm.role >= _TEAM_ADMIN_ROLE_THRESHOLD else "member"
+            TeamMembership.objects.get_or_create(
+                team=team,
+                user_id=pm.user_id,
+                is_deleted=False,
+                # Facets are never inferred (ADR-0078 §C step 3): both default
+                # False, explicit assignment required afterward.
+                defaults={"role": team_role, "server_version": 1},
+            )
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("teams", "0001_initial"),
+        ("access", "0001_initial"),
+    ]
+
+    operations = [
+        migrations.RunPython(create_default_teams, migrations.RunPython.noop, elidable=True),
+    ]

trueppm_api/apps/teams/migrations/0003_team_sync_seq_teammembership_sync_seq.py

@@ -0,0 +1,22 @@
+# Generated by Django 5.2.16 on 2026-07-28 12:47
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("teams", "0001_squashed_0002_default_teams"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="team",
+            name="sync_seq",
+            field=models.BigIntegerField(default=0, editable=False),
+        ),
+        migrations.AddField(
+            model_name="teammembership",
+            name="sync_seq",
+            field=models.BigIntegerField(default=0, editable=False),
+        ),
+    ]

trueppm_api/apps/teams/migrations/0004_backfill_default_teams_on_upgrade.py

@@ -0,0 +1,49 @@
+"""Re-run ``create_default_teams`` as a real forward step on an upgrading database.
+
+The ``teams`` app has no unsquashed released history: ``0001_initial`` and
+``0002_default_teams`` both first shipped already combined into
+``0001_squashed_0002_default_teams`` (v0.3.0-alpha.1). So, unlike every other app's
+restored elidable data op (#4320), there has never been a released state that an
+upgrading database could pass through where the original, elidable
+``create_default_teams`` op was guaranteed to run from the originals rather than the
+squash. An install upgrading from before teams existed (pre-0.3, with real ``Project``
+and ``ProjectMembership`` rows already present) applies *only* the squash for this
+app — and until this branch's commit restoring the op to the squash, that squash
+carried no data step at all, so ``create_default_teams`` never ran for it and never
+will on its own (the squash is recorded as applied; Django will not re-run it).
+
+This migration closes that gap directly instead of relying on the squash restoration,
+which only helps installs that have not yet applied the squash. It is intentionally
+NOT elidable, so a future squash spanning this migration cannot silently drop it
+again the way the optimizer dropped the original. ``create_default_teams`` is
+``get_or_create``-shaped (see its docstring in ``0002_default_teams.py``), so re-running
+it here is a safe no-op on every install that already has default teams — whether
+because the squash's restored op already created them on a fresh install, or because
+``teams.signals``' membership-signal healing filled the gap already.
+"""
+
+from __future__ import annotations
+
+import importlib
+
+from django.db import migrations
+
+# The source module's file name starts with a digit, so it cannot be named in a
+# normal `from ... import ...` statement; resolve it the same way the squash's
+# `_original` helper does (0001_squashed_0002_default_teams.py).
+# nosemgrep: python.lang.security.audit.non-literal-import.non-literal-import
+_default_teams_module = importlib.import_module(
+    "trueppm_api.apps.teams.migrations.0002_default_teams"
+)
+_create_default_teams = _default_teams_module.create_default_teams
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("teams", "0003_team_sync_seq_teammembership_sync_seq"),
+        ("access", "0001_initial"),
+    ]
+
+    operations = [
+        migrations.RunPython(_create_default_teams, migrations.RunPython.noop),
+    ]

trueppm_api/apps/teams/models.py

@@ -0,0 +1,145 @@
+"""Team and TeamMembership models (ADR-0078, OSS).
+
+Two axes of authority live here and are deliberately independent:
+
+* **Access role** (``TeamMembership.role``) — Member or Admin — is coordination
+  authority: who can manage the team's membership and facets.
+* **Facets** (``is_scrum_master``, ``is_product_owner``) — facilitation and
+  ownership — are orthogonal markers. A user can be an Admin who is also Scrum
+  Master, or a Member who is also Product Owner.
+
+Keeping the facets off ``ProjectMembership`` is a hard ADR-0078 constraint: hanging
+the booleans on the project membership made project-admin implicitly team-admin and
+routed around the per-team consent model (Morgan 🔴). The Team entity exists so the
+facet axis has a real, per-team home.
+"""
+
+from __future__ import annotations
+
+from django.conf import settings
+from django.db import models
+from django.utils import timezone
+
+from trueppm_api.apps.projects.models import VersionedModel
+
+
+class TeamRole(models.TextChoices):
+    """Team-scoped coordination role.
+
+    Intentionally only two tiers — the team's own membership management axis is
+    coarse (you either manage the team or you don't). This is distinct from the
+    5-tier project ``Role`` ordinal (ADR-0072): a project Admin inherits team-admin
+    authority for low-consent actions (ADR-0078 §D) without holding this role.
+    """
+
+    MEMBER = "member", "Member"
+    ADMIN = "admin", "Admin"
+
+
+class Team(VersionedModel):
+    """A Scrum team that owns a sprint commitment, scoped to one project (ADR-0078 §A).
+
+    Every project has exactly one ``is_default=True`` team, auto-created by the
+    initial data migration and kept populated by the auto-membership signal. The
+    0.3 slice never creates a second team — multi-team UX lands in #599 (0.6) —
+    so ``is_default`` is always True in practice today; the field and the
+    one-default-per-project constraint exist so that work can land without a
+    schema change.
+    """
+
+    project = models.ForeignKey(
+        "projects.Project",
+        on_delete=models.CASCADE,
+        related_name="teams",
+    )
+    name = models.CharField(max_length=255)
+    short_id = models.CharField(max_length=8)
+    description = models.TextField(blank=True, default="")
+    # Auto-created at migration; exactly one per project. db_index because the
+    # default-team resolution path (resolve_default_team) filters on it per request.
+    is_default = models.BooleanField(default=False, db_index=True)
+    created_by = models.ForeignKey(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.SET_NULL,
+        null=True,
+        blank=True,
+        related_name="created_teams",
+    )
+    # VersionedModel omits created_at/updated_at (sync uses server_version), so
+    # these are explicit. default=timezone.now (not auto_now_add) lets the data
+    # migration create rows with an explicit timestamp non-interactively.
+    created_at = models.DateTimeField(default=timezone.now, editable=False)
+    updated_at = models.DateTimeField(auto_now=True)
+
+    class Meta:
+        db_table = "teams_team"
+        constraints = [
+            models.UniqueConstraint(
+                fields=["project", "name"],
+                condition=models.Q(is_deleted=False),
+                name="team_name_per_project_unique",
+            ),
+            models.UniqueConstraint(
+                fields=["project"],
+                condition=models.Q(is_default=True, is_deleted=False),
+                name="team_one_default_per_project",
+            ),
+        ]
+
+    def __str__(self) -> str:
+        return f"{self.name} ({self.project_id})"
+
+
+class TeamMembership(VersionedModel):
+    """A user's membership of a team: an access role plus two independent facets.
+
+    The facets are soft-singletons — at most one Scrum Master and one Product
+    Owner per team — enforced at the serializer/service layer rather than by a DB
+    constraint, so a facet can move between members in a single write (reassign)
+    without a transient double-holder rejection.
+    """
+
+    team = models.ForeignKey(
+        Team,
+        on_delete=models.CASCADE,
+        related_name="memberships",
+    )
+    user = models.ForeignKey(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.CASCADE,
+        related_name="team_memberships",
+    )
+    role = models.CharField(
+        max_length=16,
+        choices=TeamRole.choices,
+        default=TeamRole.MEMBER,
+    )
+    is_scrum_master = models.BooleanField(default=False)
+    is_product_owner = models.BooleanField(default=False)
+    created_at = models.DateTimeField(default=timezone.now, editable=False)
+
+    class Meta:
+        db_table = "teams_team_membership"
+        constraints = [
+            models.UniqueConstraint(
+                fields=["team", "user"],
+                condition=models.Q(is_deleted=False),
+                name="team_member_unique",
+            ),
+        ]
+        indexes = [
+            # Facet resolution for gates: WHERE team_id = X AND user_id = Y.
+            models.Index(fields=["team", "user"], name="tm_team_user_idx"),
+        ]
+
+    def __str__(self) -> str:
+        return f"{self.user} — {self.team} ({self.role})"
+
+    @property
+    def project_id(self) -> object:
+        """Expose the owning project's id without a join, mirroring the access models.
+
+        Permission helpers resolve a facet from a (user, project) pair; exposing
+        project_id here keeps those call sites off a ``team.project_id`` chain.
+        """
+        return self.team.project_id

trueppm_api/apps/teams/permissions.py

@@ -0,0 +1,149 @@
+"""DRF permission classes for the teams app (ADR-0078 §D).
+
+The 0.3 slice exposes only read and facet/role assignment, so it needs two gates:
+
+* :class:`IsTeamMember` — any member of the team's project may read the roster.
+* :class:`IsTeamFacetEditor` — role and facet assignment. Per the §D split this is
+  a *low-consent* action, so it is the inheriting bucket: a project Admin (role ≥
+  ADMIN) **or** an explicit ``TeamMembership(role='admin')`` may edit. The
+  consent-sensitive actions (TeamInternalsOptIn, sprint rebind, bulk replace) that
+  require explicit team-admin with no inheritance are out of scope until #599.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from rest_framework.permissions import SAFE_METHODS, BasePermission
+from rest_framework.request import Request
+from rest_framework.views import APIView
+
+from trueppm_api.apps.access.models import Role
+from trueppm_api.apps.access.permissions import _membership_role
+from trueppm_api.apps.teams.models import Team, TeamMembership, TeamRole
+
+
+def _team_pk_from_view(view: APIView) -> Any | None:
+    """Extract the team pk, which every team-scoped route carries as ``team_pk``.
+
+    There is deliberately no ``pk`` fallback: on the surviving member-detail route
+    ``pk`` names a :class:`TeamMembership`, so falling back to it would resolve the
+    wrong object. Returns None when the route names no team, and callers fail closed.
+    """
+    return getattr(view, "kwargs", {}).get("team_pk")
+
+
+def _project_id_for_team(request: Request, team_id: Any) -> Any | None:
+    """Resolve (and per-request cache) the project a team belongs to."""
+    cache: dict[Any, Any | None] | None = getattr(request, "_team_project_cache", None)
+    if cache is None:
+        cache = {}
+        request._team_project_cache = cache  # type: ignore[attr-defined]
+    if team_id in cache:
+        return cache[team_id]
+    project_id = (
+        Team.objects.filter(pk=team_id, is_deleted=False)
+        .values_list("project_id", flat=True)
+        .first()
+    )
+    cache[team_id] = project_id
+    return project_id
+
+
+def _team_role(request: Request, team_id: Any) -> str | None:
+    """Return the requester's explicit team role on ``team_id``, or None."""
+    if not (request.user and request.user.is_authenticated):
+        return None
+    return (
+        TeamMembership.objects.filter(team_id=team_id, user=request.user, is_deleted=False)
+        .values_list("role", flat=True)
+        .first()
+    )
+
+
+def _route_project_id(request: Request, view: APIView) -> Any | None:
+    """Resolve the project a request targets, from either route shape.
+
+    The project-scoped list route carries ``project_pk`` directly; a team-scoped
+    route carries ``team_pk`` and resolves the project through the team. Returns None
+    when neither is present or the team does not exist — callers fail closed on None
+    so an unrecognized route never default-allows.
+    """
+    project_pk = getattr(view, "kwargs", {}).get("project_pk")
+    if project_pk is not None:
+        return project_pk
+    team_id = _team_pk_from_view(view)
+    if team_id is None:
+        return None
+    return _project_id_for_team(request, team_id)
+
+
+def _can_edit_facets(request: Request, team_id: Any) -> bool:
+    """Project Admin (inheritance) OR explicit team Admin (ADR-0078 §D low-consent)."""
+    project_id = _project_id_for_team(request, team_id)
+    if project_id is None:
+        return False
+    project_role = _membership_role(request, project_id)
+    if project_role is not None and project_role >= Role.ADMIN:
+        return True
+    return _team_role(request, team_id) == TeamRole.ADMIN
+
+
+class IsTeamMember(BasePermission):
+    """Any member of the team's project may read the team and its roster.
+
+    Fails closed: the project-scoped list route (``project_pk``, no ``team_pk``)
+    must still require project membership, so the queryset filter is never the
+    sole scoping (prevents the cross-project enumeration IDOR class of #887).
+    """
+
+    message = "You must be a member of this team's project."
+
+    def has_permission(self, request: Request, view: APIView) -> bool:
+        if not (request.user and request.user.is_authenticated):
+            return False
+        project_id = _route_project_id(request, view)
+        if project_id is None:
+            return False
+        return _membership_role(request, project_id) is not None
+
+    def has_object_permission(self, request: Request, view: APIView, obj: Any) -> bool:
+        # No route reaches this today — the surviving team route is the project-scoped
+        # list, which never calls get_object(). Kept, and unit-tested directly, because
+        # #599 restores the team detail/PATCH/DELETE routes onto this same class; a gate
+        # nothing has exercised is how a restored route ships unguarded.
+        project_id = getattr(obj, "project_id", None)
+        if project_id is None:
+            return False
+        return _membership_role(request, project_id) is not None
+
+
+class IsTeamFacetEditor(BasePermission):
+    """Read for any project member; role/facet writes for project Admin or team Admin."""
+
+    message = "You need Project Manager or team Admin to change team roles or facets."
+
+    def has_permission(self, request: Request, view: APIView) -> bool:
+        if not (request.user and request.user.is_authenticated):
+            return False
+        project_id = _route_project_id(request, view)
+        if project_id is None:
+            return False
+        if _membership_role(request, project_id) is None:
+            return False
+        if request.method in SAFE_METHODS:
+            return True
+        team_id = _team_pk_from_view(view)
+        return team_id is not None and _can_edit_facets(request, team_id)
+
+    def has_object_permission(self, request: Request, view: APIView, obj: Any) -> bool:
+        """Defense-in-depth: re-derive edit rights from the object's own team.
+
+        The roster queryset already scopes to ``team_pk``, but checking the
+        object's team directly means a future non-nested route cannot become a
+        cross-team write IDOR by relying on the route param alone.
+        """
+        if request.method in SAFE_METHODS:
+            project_id = getattr(obj, "project_id", None)
+            return project_id is not None and _membership_role(request, project_id) is not None
+        return _can_edit_facets(request, obj.team_id)

trueppm_api/apps/teams/serializers.py

@@ -0,0 +1,95 @@
+"""Serializers for the teams app (ADR-0078 §E)."""
+
+from __future__ import annotations
+
+from django.contrib.auth import get_user_model
+from rest_framework import serializers
+
+from trueppm_api.apps.teams.models import Team, TeamMembership, TeamRole
+from trueppm_api.apps.teams.services import live_project_membership_exists
+
+User = get_user_model()
+
+
+class _TeamUserSummarySerializer(serializers.ModelSerializer):  # type: ignore[type-arg]
+    class Meta:
+        model = User
+        fields = ["id", "username", "email"]
+
+
+class TeamSerializer(serializers.ModelSerializer[Team]):
+    """Read serializer for a team. ``member_count`` drives the roster header."""
+
+    member_count = serializers.SerializerMethodField()
+
+    class Meta:
+        model = Team
+        fields = [
+            "id",
+            "project",
+            "name",
+            "short_id",
+            "description",
+            "is_default",
+            "member_count",
+            "server_version",
+        ]
+        read_only_fields = fields
+
+    def get_member_count(self, obj: Team) -> int:
+        # Prefer a prefetched/annotated count when present to avoid an N+1 on lists.
+        annotated = getattr(obj, "member_count_annotated", None)
+        if annotated is not None:
+            return int(annotated)
+        # Unreachable from any route today (TeamViewSet.list() always sets the
+        # annotation above), but flooring here too (#3511) means a future caller
+        # that serializes a bare Team instance can't silently reintroduce the
+        # revoked-member-counts-toward-the-total defect this fallback used to
+        # carry — the same floor as TeamViewSet.get_queryset() and the facet /
+        # voter-roster seams in services.py, restated once rather than per caller.
+        return (
+            obj.memberships.filter(is_deleted=False)
+            .filter(live_project_membership_exists())
+            .count()
+        )
+
+
+class TeamMembershipReadSerializer(serializers.ModelSerializer[TeamMembership]):
+    """Roster row: identity plus the role and the two facet flags."""
+
+    user_detail = _TeamUserSummarySerializer(source="user", read_only=True)
+    role_label = serializers.CharField(source="get_role_display", read_only=True)
+
+    class Meta:
+        model = TeamMembership
+        fields = [
+            "id",
+            "team",
+            "user",
+            "user_detail",
+            "role",
+            "role_label",
+            "is_scrum_master",
+            "is_product_owner",
+            "created_at",
+            "server_version",
+        ]
+        read_only_fields = fields
+
+
+class TeamMembershipWriteSerializer(serializers.ModelSerializer[TeamMembership]):
+    """Write serializer for role and facet assignment (PATCH only in 0.3).
+
+    All three fields are optional so a partial update can flip a single facet
+    without re-sending the role. The single-holder reassignment for the facets is
+    applied in the viewset inside the write transaction, not here, because it
+    mutates *other* rows.
+    """
+
+    role = serializers.ChoiceField(choices=TeamRole.choices, required=False)
+    is_scrum_master = serializers.BooleanField(required=False)
+    is_product_owner = serializers.BooleanField(required=False)
+
+    class Meta:
+        model = TeamMembership
+        fields = ["role", "is_scrum_master", "is_product_owner"]