trueppm-api 0.4.0b2__py3-none-any.whl

trueppm_api/apps/access/migrations/0001_squashed_0012_programmembership_role_title.py

@@ -0,0 +1,167 @@
+# Generated by Django 5.2.14 on 2026-06-23 21:38
+
+import uuid
+
+import django.db.models.deletion
+import django.utils.timezone
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    replaces = [
+        ("access", "0001_initial"),
+        ("access", "0002_alter_projectmembership_id"),
+        ("access", "0003_projectmembership_soft_delete"),
+        ("access", "0004_alter_projectmembership_role"),
+        ("access", "0005_program_entity_and_membership"),
+        ("access", "0006_role_ordinal_spacing"),
+        ("access", "0007_projectmembership_joined_at_and_more"),
+        ("access", "0008_projectmembership_source_group"),
+        ("access", "0009_projectmembership_pm_proj_serverver_idx"),
+        ("access", "0010_programmembership_joined_at_and_more"),
+        ("access", "0011_alter_programmembership_unique_together_and_more"),
+        ("access", "0012_programmembership_role_title"),
+    ]
+
+    initial = True
+
+    dependencies = [
+        ("projects", "0001_initial"),
+        ("projects", "0036_program_entity_and_membership"),
+        ("projects", "0053_dependency_dep_pred_serverver_idx_and_more"),
+        ("projects", "0078_alter_risktask_unique_together_and_more"),
+        ("workspace", "0001_initial"),
+        ("workspace", "0003_workspaceexportjob"),
+        ("workspace", "0006_alter_groupmembership_unique_together_and_more"),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="ProjectMembership",
+            fields=[
+                (
+                    "id",
+                    models.UUIDField(
+                        default=uuid.uuid4, editable=False, primary_key=True, serialize=False
+                    ),
+                ),
+                ("server_version", models.BigIntegerField(default=0, editable=False)),
+                (
+                    "project",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.PROTECT,
+                        related_name="memberships",
+                        to="projects.project",
+                    ),
+                ),
+                (
+                    "user",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="memberships",
+                        to=settings.AUTH_USER_MODEL,
+                    ),
+                ),
+                (
+                    "role",
+                    models.IntegerField(
+                        choices=[
+                            (0, "Viewer"),
+                            (100, "Team Member"),
+                            (200, "Resource Manager"),
+                            (300, "Project Manager"),
+                            (400, "Project Admin"),
+                        ]
+                    ),
+                ),
+                ("is_deleted", models.BooleanField(db_index=True, default=False)),
+                ("deleted_version", models.BigIntegerField(blank=True, editable=False, null=True)),
+                (
+                    "joined_at",
+                    models.DateTimeField(default=django.utils.timezone.now, editable=False),
+                ),
+                ("role_changed_at", models.DateTimeField(blank=True, editable=False, null=True)),
+                (
+                    "source_group",
+                    models.ForeignKey(
+                        blank=True,
+                        null=True,
+                        on_delete=django.db.models.deletion.SET_NULL,
+                        related_name="granted_memberships",
+                        to="workspace.group",
+                    ),
+                ),
+            ],
+            options={
+                "db_table": "access_project_membership",
+                "unique_together": set(),
+                "indexes": [
+                    models.Index(fields=["project", "server_version"], name="pm_proj_serverver_idx")
+                ],
+                "constraints": [
+                    models.UniqueConstraint(
+                        fields=("project", "user"), name="uniq_project_membership_project_user"
+                    )
+                ],
+            },
+        ),
+        migrations.CreateModel(
+            name="ProgramMembership",
+            fields=[
+                (
+                    "id",
+                    models.UUIDField(
+                        default=uuid.uuid4, editable=False, primary_key=True, serialize=False
+                    ),
+                ),
+                ("server_version", models.BigIntegerField(default=0, editable=False)),
+                ("is_deleted", models.BooleanField(db_index=True, default=False)),
+                ("deleted_version", models.BigIntegerField(blank=True, editable=False, null=True)),
+                (
+                    "role",
+                    models.IntegerField(
+                        choices=[
+                            (0, "Viewer"),
+                            (100, "Team Member"),
+                            (200, "Resource Manager"),
+                            (300, "Project Manager"),
+                            (400, "Project Admin"),
+                        ]
+                    ),
+                ),
+                (
+                    "program",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.PROTECT,
+                        related_name="memberships",
+                        to="projects.program",
+                    ),
+                ),
+                (
+                    "user",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="program_memberships",
+                        to=settings.AUTH_USER_MODEL,
+                    ),
+                ),
+                (
+                    "joined_at",
+                    models.DateTimeField(default=django.utils.timezone.now, editable=False),
+                ),
+                ("role_changed_at", models.DateTimeField(blank=True, editable=False, null=True)),
+                ("role_title", models.CharField(blank=True, default="", max_length=50)),
+            ],
+            options={
+                "db_table": "access_program_membership",
+                "unique_together": set(),
+                "constraints": [
+                    models.UniqueConstraint(
+                        fields=("program", "user"), name="uniq_program_membership_program_user"
+                    )
+                ],
+            },
+        ),
+    ]

trueppm_api/apps/access/migrations/0002_alter_projectmembership_id.py

@@ -0,0 +1,29 @@
+"""Add serialize=False to ProjectMembership UUID primary key.
+
+Django 5's migration autodetector expects primary_key=True UUIDs to also
+carry serialize=False in the migration state. Without it, makemigrations
+--check reports spurious "Alter field id" operations on every run.
+No database schema change is made by this operation.
+"""
+
+from __future__ import annotations
+
+import uuid
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("access", "0001_initial"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="projectmembership",
+            name="id",
+            field=models.UUIDField(
+                default=uuid.uuid4, editable=False, primary_key=True, serialize=False
+            ),
+        ),
+    ]

trueppm_api/apps/access/migrations/0003_projectmembership_soft_delete.py

@@ -0,0 +1,24 @@
+"""Add soft-delete fields to ProjectMembership."""
+
+from __future__ import annotations
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("access", "0002_alter_projectmembership_id"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="projectmembership",
+            name="is_deleted",
+            field=models.BooleanField(default=False, db_index=True),
+        ),
+        migrations.AddField(
+            model_name="projectmembership",
+            name="deleted_version",
+            field=models.BigIntegerField(blank=True, editable=False, null=True),
+        ),
+    ]

trueppm_api/apps/access/migrations/0004_alter_projectmembership_role.py

@@ -0,0 +1,34 @@
+"""Update Role choices labels for issue #11.
+
+Ordinal values are unchanged (no data migration); Django stores choice labels
+in the migration state so this AlterField is required to keep makemigrations clean.
+
+Old labels: Member, Scheduler, Admin, Owner
+New labels: Team Member, Resource Manager, Project Manager, Project Admin
+"""
+
+from __future__ import annotations
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("access", "0003_projectmembership_soft_delete"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="projectmembership",
+            name="role",
+            field=models.IntegerField(
+                choices=[
+                    (0, "Viewer"),
+                    (1, "Team Member"),
+                    (2, "Resource Manager"),
+                    (3, "Project Manager"),
+                    (4, "Project Admin"),
+                ]
+            ),
+        ),
+    ]

trueppm_api/apps/access/migrations/0005_program_entity_and_membership.py

@@ -0,0 +1,76 @@
+"""ADR-0070: introduce ProgramMembership for Program entity RBAC.
+
+Migration safety:
+- ``ProgramMembership`` is a NEW model — no existing rows to migrate. Mirrors
+  ``ProjectMembership`` structurally (PROTECT on program FK, CASCADE on user
+  FK, ``unique_together`` on (program, user)).
+- PROTECT on the program FK is intentional — deleting a Program requires
+  clearing memberships first. The access service layer (``delete_program``)
+  enforces this atomically.
+- No destructive operations, no NOT NULL columns without defaults, no data
+  migrations. Depends on ``projects.0036_program_entity_and_membership``
+  (the FK target).
+"""
+
+import uuid
+
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("access", "0004_alter_projectmembership_role"),
+        ("projects", "0036_program_entity_and_membership"),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="ProgramMembership",
+            fields=[
+                (
+                    "id",
+                    models.UUIDField(
+                        default=uuid.uuid4, editable=False, primary_key=True, serialize=False
+                    ),
+                ),
+                ("server_version", models.BigIntegerField(default=0, editable=False)),
+                ("is_deleted", models.BooleanField(db_index=True, default=False)),
+                ("deleted_version", models.BigIntegerField(blank=True, editable=False, null=True)),
+                (
+                    "role",
+                    models.IntegerField(
+                        choices=[
+                            (0, "Viewer"),
+                            (1, "Team Member"),
+                            (2, "Resource Manager"),
+                            (3, "Project Manager"),
+                            (4, "Project Admin"),
+                        ]
+                    ),
+                ),
+                (
+                    "program",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.PROTECT,
+                        related_name="memberships",
+                        to="projects.program",
+                    ),
+                ),
+                (
+                    "user",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="program_memberships",
+                        to=settings.AUTH_USER_MODEL,
+                    ),
+                ),
+            ],
+            options={
+                "db_table": "access_program_membership",
+                "unique_together": {("program", "user")},
+            },
+        ),
+    ]

trueppm_api/apps/access/migrations/0006_role_ordinal_spacing.py

@@ -0,0 +1,113 @@
+"""ADR-0072: re-space role ordinals from (0,1,2,3,4) to (0,100,200,300,400).
+
+The OSS edition continues to ship the same 5 named roles with identical
+user-visible behavior. The re-spacing opens 99-unit slot bands between OSS
+tiers so Enterprise can register custom roles (e.g., a "Senior Scheduler" at
+250) without forcing an OSS renumber.
+
+Migration safety:
+- Forward operation multiplies existing ``ProjectMembership.role`` and
+  ``ProgramMembership.role`` values by 100. Both tables in a single Django
+  transaction (default ``atomic=True`` on RunPython).
+- Reverse operation divides by 100; integer division recovers the original
+  values exactly because the forward multiplies by 100 and OSS only writes
+  the canonical ordinals.
+- Idempotent under retry: the forward RunPython guards on
+  ``max(role) <= 4`` — if the migration is partially applied and re-run, we
+  do not double-multiply.
+- No DB-level CHECK constraint exists on the ``role`` column (confirmed in
+  the audit), so the AlterField choice list change is metadata-only at the
+  DB layer.
+- Breaking API change: external clients consuming the numeric ``my_role``
+  field will see new values. Surfaced in the changelog and release notes.
+
+Coupled migration: both ``ProjectMembership.role`` and ``ProgramMembership.role``
+are re-spaced in one transaction. Splitting them is technically possible but
+adds no value and complicates rollback. ProgramMembership exists from
+0005; both tables share the same ``Role`` enum.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from django.db import migrations, models
+from django.db.models import F
+
+# Choice tuples used in AlterField — must match Role(IntegerChoices) in models.py
+NEW_CHOICES = [
+    (0, "Viewer"),
+    (100, "Team Member"),
+    (200, "Resource Manager"),
+    (300, "Project Manager"),
+    (400, "Project Admin"),
+]
+
+
+def respace_ordinals(apps: Any, schema_editor: Any) -> None:
+    """Forward: multiply existing role values by 100.
+
+    Guarded by ``max(role) <= 4`` per table to be idempotent under retry. If
+    the migration is partially applied and re-run, the guard ensures we never
+    double-multiply (which would produce 10000s instead of 100s).
+    """
+    ProjectMembership = apps.get_model("access", "ProjectMembership")
+    ProgramMembership = apps.get_model("access", "ProgramMembership")
+
+    # Guard: only apply if values are still in the old (0–4) range.
+    # ``role__gt=4`` would only match if the migration already ran.
+    project_already_migrated = ProjectMembership.objects.filter(role__gt=4).exists()
+    program_already_migrated = ProgramMembership.objects.filter(role__gt=4).exists()
+
+    if project_already_migrated or program_already_migrated:
+        # Partial state — refuse to double-apply. Operator must manually reverse
+        # to {0..4} before re-running, or manually finish the half-completed
+        # migration. Loud failure is preferable to silent data corruption.
+        raise RuntimeError(
+            "Refusing to re-apply 0006_role_ordinal_spacing: at least one table "
+            "already contains role values > 4. If the migration is partially "
+            "applied, reverse it first or manually complete the multiplication."
+        )
+
+    # Skip role=0 (VIEWER stays at 0 under both schemes). The filter on
+    # ``role__gt=0`` avoids touching every Viewer row.
+    ProjectMembership.objects.filter(role__gt=0).update(role=F("role") * 100)
+    ProgramMembership.objects.filter(role__gt=0).update(role=F("role") * 100)
+
+
+def reverse_ordinals(apps: Any, schema_editor: Any) -> None:
+    """Reverse: divide existing role values by 100.
+
+    PostgreSQL integer division truncates, so 100/100=1, 200/100=2, etc. The
+    reverse is exact because the forward only multiplies canonical OSS ordinals
+    (0/100/200/300/400). If an Enterprise custom role at 250 existed at reverse
+    time, it would truncate to 2 (silently merging into SCHEDULER). The reverse
+    function is therefore safe only against the same OSS-only data the forward
+    produced — which is the contract: this migration is OSS-only and predates
+    Enterprise custom-role registration.
+    """
+    ProjectMembership = apps.get_model("access", "ProjectMembership")
+    ProgramMembership = apps.get_model("access", "ProgramMembership")
+
+    ProjectMembership.objects.filter(role__gt=0).update(role=F("role") / 100)
+    ProgramMembership.objects.filter(role__gt=0).update(role=F("role") / 100)
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("access", "0005_program_entity_and_membership"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="projectmembership",
+            name="role",
+            field=models.IntegerField(choices=NEW_CHOICES),
+        ),
+        migrations.AlterField(
+            model_name="programmembership",
+            name="role",
+            field=models.IntegerField(choices=NEW_CHOICES),
+        ),
+        migrations.RunPython(respace_ordinals, reverse_ordinals, elidable=True),
+    ]

trueppm_api/apps/access/migrations/0007_projectmembership_joined_at_and_more.py

@@ -0,0 +1,35 @@
+"""Add per-project access-evidence timestamps to ProjectMembership (#590).
+
+joined_at carries a ``default=timezone.now`` so this AddField backfills every
+existing membership row with the migration-run timestamp — the best available
+approximation, since VersionedModel never recorded a creation time. New rows
+get their own insert-time value.
+
+role_changed_at is nullable and is left NULL for existing rows: we have no
+historical role-change record to recover, and NULL is the honest "no role
+change since joining" signal the read serializer and UI key off.
+"""
+
+from __future__ import annotations
+
+import django.utils.timezone
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("access", "0006_role_ordinal_spacing"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="projectmembership",
+            name="joined_at",
+            field=models.DateTimeField(default=django.utils.timezone.now, editable=False),
+        ),
+        migrations.AddField(
+            model_name="projectmembership",
+            name="role_changed_at",
+            field=models.DateTimeField(blank=True, editable=False, null=True),
+        ),
+    ]

trueppm_api/apps/access/migrations/0008_projectmembership_source_group.py

@@ -0,0 +1,25 @@
+# Generated by Django 5.2.14 on 2026-05-25 17:53
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("access", "0007_projectmembership_joined_at_and_more"),
+        ("workspace", "0001_initial"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="projectmembership",
+            name="source_group",
+            field=models.ForeignKey(
+                blank=True,
+                null=True,
+                on_delete=django.db.models.deletion.SET_NULL,
+                related_name="granted_memberships",
+                to="workspace.group",
+            ),
+        ),
+    ]

trueppm_api/apps/access/migrations/0009_projectmembership_pm_proj_serverver_idx.py

@@ -0,0 +1,20 @@
+# Generated by Django 5.2.14 on 2026-05-29 17:01
+
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("access", "0008_projectmembership_source_group"),
+        ("projects", "0053_dependency_dep_pred_serverver_idx_and_more"),
+        ("workspace", "0003_workspaceexportjob"),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.AddIndex(
+            model_name="projectmembership",
+            index=models.Index(fields=["project", "server_version"], name="pm_proj_serverver_idx"),
+        ),
+    ]

trueppm_api/apps/access/migrations/0010_programmembership_joined_at_and_more.py

@@ -0,0 +1,38 @@
+"""Add per-program access-evidence timestamps to ProgramMembership (#878).
+
+Mirrors migration 0007 for ProjectMembership so ADR-0070's "ProgramMembership
+mirrors ProjectMembership exactly" claim holds.
+
+joined_at carries a ``default=timezone.now`` so this AddField backfills every
+existing membership row with the migration-run timestamp — the best available
+approximation, since VersionedModel never recorded a creation time. New rows
+get their own insert-time value.
+
+role_changed_at is nullable and is left NULL for existing rows: we have no
+historical role-change record to recover, and NULL is the honest "no role
+change since joining" signal the read serializer and UI key off.
+"""
+
+from __future__ import annotations
+
+import django.utils.timezone
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("access", "0009_projectmembership_pm_proj_serverver_idx"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="programmembership",
+            name="joined_at",
+            field=models.DateTimeField(default=django.utils.timezone.now, editable=False),
+        ),
+        migrations.AddField(
+            model_name="programmembership",
+            name="role_changed_at",
+            field=models.DateTimeField(blank=True, editable=False, null=True),
+        ),
+    ]

trueppm_api/apps/access/migrations/0011_alter_programmembership_unique_together_and_more.py

@@ -0,0 +1,36 @@
+# Generated by Django 5.2.14 on 2026-06-15 12:05
+
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("access", "0010_programmembership_joined_at_and_more"),
+        ("projects", "0078_alter_risktask_unique_together_and_more"),
+        ("workspace", "0006_alter_groupmembership_unique_together_and_more"),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.AlterUniqueTogether(
+            name="programmembership",
+            unique_together=set(),
+        ),
+        migrations.AlterUniqueTogether(
+            name="projectmembership",
+            unique_together=set(),
+        ),
+        migrations.AddConstraint(
+            model_name="programmembership",
+            constraint=models.UniqueConstraint(
+                fields=("program", "user"), name="uniq_program_membership_program_user"
+            ),
+        ),
+        migrations.AddConstraint(
+            model_name="projectmembership",
+            constraint=models.UniqueConstraint(
+                fields=("project", "user"), name="uniq_project_membership_project_user"
+            ),
+        ),
+    ]

trueppm_api/apps/access/migrations/0012_programmembership_role_title.py

@@ -0,0 +1,17 @@
+# Generated by Django 5.2.14 on 2026-06-21 21:10
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("access", "0011_alter_programmembership_unique_together_and_more"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="programmembership",
+            name="role_title",
+            field=models.CharField(blank=True, default="", max_length=50),
+        ),
+    ]