wbcore 1.59.9__py2.py3-none-any.whl

wbcore/contrib/guardian/tests/test_utils.py

@@ -0,0 +1,196 @@
+import pytest
+from django.contrib.contenttypes.models import ContentType
+from wbcore.contrib.authentication.models.users import Permission
+from wbcore.contrib.guardian.models import UserObjectPermission
+from wbcore.contrib.guardian.models.mixins import PermissionObjectModelMixin
+from wbcore.contrib.guardian.utils import (
+    assign_permissions,
+    get_permission_matrix,
+    get_public_user_or_group,
+    prune_permissions,
+    reload_permissions,
+)
+
+
+@pytest.mark.django_db
+class TestAssignPermissionsMap:
+    def test_assign_permissions(self, user):
+        assign_permissions([("view_user", user, user, True)])
+
+        assert user.has_perm("view_user", user)
+        assert not user.has_perm("change_user", user)
+
+    def test_assign_permissions_editable(self, user):
+        assign_permissions([("view_user", user, user, True), ("change_user", user, user, False)])
+
+        assert user.has_perm("view_user", user)
+        assert user.has_perm("change_user", user)
+
+        assert UserObjectPermission.objects.get(
+            user=user,
+            content_type_id=ContentType.objects.get_for_model(user).pk,
+            object_pk=user.pk,
+            permission__codename="view_user",
+        ).editable
+
+        assert not UserObjectPermission.objects.get(
+            user=user,
+            content_type_id=ContentType.objects.get_for_model(user).pk,
+            object_pk=user.pk,
+            permission__codename="change_user",
+        ).editable
+
+    def test_assign_permission_with_non_perm(self, mocker):
+        assign_perm = mocker.patch("wbcore.contrib.guardian.utils.assign_perm")
+        assign_perm.return_value = None
+
+        assign_permissions([("view_user", mocker.Mock(), mocker.Mock(), True)])
+
+        assign_perm.assert_called_once()
+
+
+@pytest.mark.django_db
+class TestGetPublicUserOrGroup:
+    def test_get_public_user_or_group(self, user):
+        public_user = get_public_user_or_group()
+
+        assert public_user.count() == 1
+        public_user = public_user.first()
+        assert public_user
+        assert public_user == user
+        assert public_user.is_active
+
+    def test_get_public_user_or_group_only_internal(self, internal_user):
+        users = get_public_user_or_group(only_internal=True)
+        assert users.count() == 1
+
+    def test_get_public_user_or_group_only_internal_with_external_user(self, user):
+        users = get_public_user_or_group(only_internal=True)
+        assert users.count() == 0
+
+
+@pytest.mark.django_db
+class TestGetPermissionMatrix:
+    def test_get_permission_matrix(self, user, mocker):
+        def get_permission_for_user(self, created=None):
+            return {"view_user": True, "change_user": False}
+
+        queryset = mocker.Mock()
+        instance = mocker.Mock()
+        queryset.__iter__ = lambda _: iter([instance])
+        queryset.all.return_value = iter([instance])
+        instance.get_permissions_for_user = get_permission_for_user
+        instance.permission_type = PermissionObjectModelMixin.PermissionType.PUBLIC
+        instance.PermissionType = PermissionObjectModelMixin.PermissionType
+
+        matrix = get_permission_matrix(queryset, None, None)
+        assert list(matrix) == [("view_user", instance, user, True), ("change_user", instance, user, False)]
+
+    def test_get_permission_matrix_with_instance(self, user, mocker):
+        def get_permission_for_user(self, created=None):
+            return {"view_user": True, "change_user": False}
+
+        queryset = mocker.Mock()
+        queryset.filter.return_value = queryset
+        instance = mocker.Mock()
+        queryset.__iter__ = lambda _: iter([instance])
+        queryset.all.return_value = iter([instance])
+        instance.get_permissions_for_user = get_permission_for_user
+        instance.permission_type = PermissionObjectModelMixin.PermissionType.PUBLIC
+        instance.PermissionType = PermissionObjectModelMixin.PermissionType
+
+        matrix = get_permission_matrix(queryset, None, instance)
+        next(matrix)
+        queryset.filter.assert_called_once_with(id=instance.id)
+
+    def test_get_permission_matrix_private(self, internal_user, mocker):
+        def get_permission_for_user(self, created=None):
+            return {"view_user": True, "change_user": False}
+
+        queryset = mocker.Mock()
+        queryset.filter.return_value = queryset
+        instance = mocker.Mock()
+        queryset.__iter__ = lambda _: iter([instance])
+        queryset.all.return_value = iter([instance])
+        instance.get_permissions_for_user = get_permission_for_user
+        instance.permission_type = PermissionObjectModelMixin.PermissionType.PRIVATE
+        instance.PermissionType = PermissionObjectModelMixin.PermissionType
+
+        matrix = get_permission_matrix(queryset, None, None)
+        assert list(matrix) == [
+            ("view_user", instance, internal_user, True),
+            ("change_user", instance, internal_user, False),
+        ]
+
+
+@pytest.mark.django_db
+class TestPrunePermissions:
+    def test_prune_permissions(self, user):
+        ct = ContentType.objects.get_for_model(user)
+        permission = Permission.objects.filter(content_type=ct).first()
+        UserObjectPermission.objects.create(
+            permission=permission, user=user, content_type=ct, object_pk=user.id, editable=False
+        )
+        assert UserObjectPermission.objects.filter(permission=permission, content_type=ct, object_pk=user.id).exists()
+        prune_permissions(user)
+        assert not UserObjectPermission.objects.filter(
+            permission=permission, content_type=ct, object_pk=user.id
+        ).exists()
+
+    def test_prune_permissions_editable(self, user):
+        ct = ContentType.objects.get_for_model(user)
+        permission = Permission.objects.filter(content_type=ct).first()
+        UserObjectPermission.objects.create(
+            permission=permission, user=user, content_type=ct, object_pk=user.id, editable=True
+        )
+        assert UserObjectPermission.objects.filter(permission=permission, content_type=ct, object_pk=user.id).exists()
+        prune_permissions(user)
+        assert UserObjectPermission.objects.filter(permission=permission, content_type=ct, object_pk=user.id).exists()
+
+    def test_prune_permissions_editable_with_force(self, user):
+        ct = ContentType.objects.get_for_model(user)
+        permission = Permission.objects.filter(content_type=ct).first()
+        UserObjectPermission.objects.create(
+            permission=permission, user=user, content_type=ct, object_pk=user.id, editable=True
+        )
+        assert UserObjectPermission.objects.filter(permission=permission, content_type=ct, object_pk=user.id).exists()
+        prune_permissions(user, True)
+        assert not UserObjectPermission.objects.filter(
+            permission=permission, content_type=ct, object_pk=user.id
+        ).exists()
+
+
+class TestReloadPermissions:
+    def test_reload_permissions(self, mocker):
+        get_permission_matrix = mocker.patch("wbcore.contrib.guardian.utils.get_permission_matrix")
+        assign_permissions = mocker.patch("wbcore.contrib.guardian.utils.assign_permissions")
+
+        queryset = mocker.Mock()
+
+        reload_permissions(queryset)
+
+        get_permission_matrix.assert_called_once()
+        assign_permissions.assert_called_once()
+
+    def test_reload_permissions_with_prune(self, mocker):
+        prune_permissions = mocker.patch("wbcore.contrib.guardian.utils.prune_permissions")
+        mocker.patch("wbcore.contrib.guardian.utils.get_permission_matrix")
+        mocker.patch("wbcore.contrib.guardian.utils.assign_permissions")
+
+        queryset = mocker.Mock()
+
+        reload_permissions(queryset)
+
+        prune_permissions.assert_not_called()
+
+    def test_reload_permissions_with_prune_and_instance(self, mocker):
+        prune_permissions = mocker.patch("wbcore.contrib.guardian.utils.prune_permissions")
+        mocker.patch("wbcore.contrib.guardian.utils.get_permission_matrix")
+        mocker.patch("wbcore.contrib.guardian.utils.assign_permissions")
+
+        queryset = mocker.Mock()
+        instance = mocker.Mock()
+
+        reload_permissions(queryset, instance=instance)
+
+        prune_permissions.assert_called_once()

wbcore/contrib/guardian/tests/test_viewsets.py

@@ -0,0 +1,48 @@
+import pytest
+from django.contrib.contenttypes.models import ContentType
+from django.db.models import Q
+from guardian.shortcuts import assign_perm
+from wbcore.contrib.authentication.models.users import Permission
+from wbcore.contrib.guardian.viewsets import PivotUserObjectPermissionModelViewSet
+
+
+class TestPivotUserObjectPermissionModelViewSet:
+    def test_cached_property_permissions(self, mocker, request):
+        mocked_filter = mocker.patch("wbcore.contrib.guardian.viewsets.viewsets.Permission.objects.filter")
+        view = PivotUserObjectPermissionModelViewSet(request=request, kwargs={"content_type_id": 1})
+        assert view.permissions
+
+        mocked_filter.assert_called_once_with(
+            Q(content_type=1)
+            & ~Q(codename__icontains="administrate")
+            & ~Q(codename__icontains="import")
+            & ~Q(codename__icontains="export")
+        )
+
+    def test_linked_object(self, mocker, request):
+        mocked_contrib_type = mocker.patch("wbcore.contrib.guardian.viewsets.viewsets.ContentType.objects")
+        mocked_get_object_for_this_type = mocker.Mock()
+        mocked_contrib_type.get.return_value = mocked_get_object_for_this_type
+        view = PivotUserObjectPermissionModelViewSet(request=request, kwargs={"content_type_id": 1, "object_pk": 1})
+        assert view.linked_object
+
+        mocked_get_object_for_this_type.get_object_for_this_type.assert_called_once()
+
+    @pytest.mark.django_db
+    def test_queryset(self, user, request):
+        assign_perm("view_user", user, user)
+        view = PivotUserObjectPermissionModelViewSet(
+            request=request, kwargs={"content_type_id": ContentType.objects.get_for_model(user), "object_pk": user.id}
+        )
+
+        permissions = view.permissions
+        instance = view.get_queryset().order_by("id").first()
+
+        for permission in permissions:
+            assert permission.codename in instance.keys()
+
+    def test_serializer_class(self, request, mocker):
+        view = PivotUserObjectPermissionModelViewSet(request=request, kwargs={"content_type_id": 1, "object_pk": 1})
+        mocker.patch.object(view, "permissions", [Permission(codename="view_user")])
+        serializer_class = view.get_serializer_class()
+        assert "view_user" in serializer_class.Meta.fields  # type: ignore

wbcore/contrib/guardian/urls.py

@@ -0,0 +1,12 @@
+from django.urls import include, path
+from wbcore.contrib.guardian.viewsets import PivotUserObjectPermissionModelViewSet
+from wbcore.routers import WBCoreRouter
+
+router = WBCoreRouter()
+router.register(
+    r"pivoteduserobjectpermission", PivotUserObjectPermissionModelViewSet, basename="pivoteduserobjectpermission"
+)
+
+urlpatterns = [
+    path("<int:content_type_id>/<int:object_pk>/", include(router.urls)),
+]

wbcore/contrib/guardian/utils.py

@@ -0,0 +1,124 @@
+from contextlib import suppress
+from datetime import datetime
+from typing import TYPE_CHECKING, Iterable, Iterator
+
+from django.contrib.contenttypes.models import ContentType
+from django.db import ProgrammingError
+from django.db.models import Model, Q, QuerySet
+from django.utils import timezone
+from guardian.shortcuts import assign_perm, get_anonymous_user
+from psycopg.errors import InvalidCursorName
+from wbcore.contrib.authentication.models import User
+from wbcore.contrib.guardian.models import UserObjectPermission
+from wbcore.permissions.shortcuts import get_internal_users
+
+if TYPE_CHECKING:
+    from wbcore.contrib.guardian.models.mixins import PermissionObjectModelMixin
+
+
+def assign_permissions(permissions_map: Iterable[tuple[str, Model, User, bool]]):
+    """
+    Assigns object-level permissions to users based on the provided permissions map.
+
+    This method iterates through the permissions_map, assigns the specified permission
+    to the user for the model instance, sets the 'editable' flag for the permission,
+    and saves the object permission.
+    """
+    for permission, instance, user, editable in permissions_map:
+        object_permissions = assign_perm(permission, user, instance)
+
+        if object_permissions is None:
+            continue
+
+        if isinstance(object_permissions, Model):
+            object_permissions = [object_permissions]
+
+        for object_permission in object_permissions:
+            object_permission.editable = editable  # type: ignore -- We have our custom Permission class here
+            object_permission.save()
+
+
+def get_public_user_or_group(only_internal: bool = False) -> QuerySet[User]:
+    """
+    Retrieves a queryset of active users, optionally filtering to internal users only.
+
+    This method fetches users based on the `only_internal` flag.
+    If set, it filters for internal users, otherwise returns all users.
+    The queryset includes active users or the anonymous user and excludes superusers
+    from the main set, while later ensuring their inclusion through a union operation.
+    """
+    users = User.objects.filter(is_active=True)
+    if only_internal:
+        users = users.filter(
+            Q(is_superuser=True) | Q(id=get_anonymous_user().pk) | Q(id__in=get_internal_users().values("id"))
+        )
+    return users
+
+
+def get_permission_matrix(
+    queryset: QuerySet,
+    created: datetime | None = None,
+    instance: Model | None = None,
+    user: User | None = None,
+) -> Iterator[tuple[str, Model, User, bool]]:
+    """
+    Retrieves the permission matrix for all (user, object) pairs
+
+    If an instance is provided, the queryset is filtered to that specific object. The method determines the
+    appropriate set of users based on the permission type of the object (private or public).
+
+    For each user, the function yields a tuple containing the permission string, the object instance,
+    the user, and whether the permission is editable.
+    """
+
+    if instance:
+        queryset = queryset.filter(id=instance.id)  # type: ignore
+
+    for _instance in queryset.all():
+        if _instance.permission_type is _instance.PermissionType.PUBLIC:
+            users = get_public_user_or_group()
+        else:
+            users = get_public_user_or_group(only_internal=True)
+        if user:
+            users = users.filter(id=user.id)
+        for user in users:
+            for permission, editable in _instance.get_permissions_for_user(user, created=created).items():
+                yield permission, _instance, user, editable
+
+
+def prune_permissions(instance: "PermissionObjectModelMixin", force: bool | None = False):
+    queryset = UserObjectPermission.objects.filter(
+        content_type=ContentType.objects.get_for_model(instance), object_pk=instance.id
+    )
+    if not force:
+        queryset = queryset.exclude(editable=True)
+    for permission in queryset:
+        permission.delete()
+
+
+def reload_permissions(
+    queryset: QuerySet,
+    created: datetime | None = None,
+    user: User | None = None,
+    instance: "PermissionObjectModelMixin | None" = None,
+    prune_existing: bool = True,
+    force_pruning: bool = False,
+):
+    """
+    Assigns permissions based on a given queryset, with options to prune existing permissions and
+    specify the creation timestamp. If no creation time is provided, the current time is used.
+
+    The function first checks if existing permissions should be pruned, which happens if both
+    `prune_existing` and `instance` are provided. It then retrieves the permission matrix
+    using `get_permission_matrix()` and assigns the appropriate permissions.
+
+    Error handling is in place to suppress database-related errors, such as `ProgrammingError`
+    and `InvalidCursorName`, which can occur due to unmanaged tables.
+    """
+    if not created:
+        created = timezone.now()
+    with suppress(ProgrammingError, InvalidCursorName):  # We check this to catch error trigger by unmanaged table
+        if prune_existing and instance:
+            prune_permissions(instance, force=force_pruning)
+        permission_matrix = get_permission_matrix(queryset, created=created, instance=instance, user=user)
+        assign_permissions(permission_matrix)

wbcore/contrib/guardian/viewsets/__init__.py

@@ -0,0 +1 @@
+from .viewsets import PivotUserObjectPermissionModelViewSet

wbcore/contrib/guardian/viewsets/configs/__init__.py

@@ -0,0 +1,4 @@
+from .buttons import add_object_permission_button, PivotUserObjectPermissionButtonViewConfig
+from .displays import PivotUserObjectPermissionDisplayViewConfig
+from .endpoints import PivotUserObjectPermissionEndpointViewConfig
+from .titles import PivotUserObjectPermissionTitleViewConfig

wbcore/contrib/guardian/viewsets/configs/buttons.py

@@ -0,0 +1,36 @@
+from contextlib import suppress
+
+from django.dispatch import receiver
+from rest_framework.reverse import reverse
+from wbcore.contrib.guardian.models.mixins import PermissionObjectModelMixin
+from wbcore.contrib.icons.icons import WBIcon
+from wbcore.metadata.configs.buttons import ButtonViewConfig
+from wbcore.metadata.configs.buttons.buttons import WidgetButton
+from wbcore.metadata.configs.buttons.enums import Button
+from wbcore.signals.instance_buttons import add_extra_button
+
+
+class PivotUserObjectPermissionButtonViewConfig(ButtonViewConfig):
+    def get_create_buttons(self):
+        return {
+            Button.SAVE_AND_CLOSE.value,
+        }
+
+
+@receiver(add_extra_button)
+def add_object_permission_button(sender, instance, request, view, pk=None, **kwargs):
+    with suppress(AttributeError):
+        if (
+            (
+                request.user.has_perm(f"administrate_{view.queryset.model._meta.model_name}")
+                or request.user.is_superuser
+            )
+            and issubclass(view.queryset.model, PermissionObjectModelMixin)
+            and pk is not None
+        ):
+            endpoint = reverse(
+                "wbcore:guardian:pivoteduserobjectpermission-list",
+                args=[view.get_content_type().id, pk],
+                request=request,
+            )
+            return WidgetButton(endpoint=endpoint, label="Permissions", icon=WBIcon.LOCK.icon)

wbcore/contrib/guardian/viewsets/configs/displays.py

@@ -0,0 +1,43 @@
+from typing import TYPE_CHECKING
+
+from wbcore.metadata.configs import display as dp
+
+if TYPE_CHECKING:
+    from wbcore.contrib.guardian.viewsets import PivotUserObjectPermissionModelViewSet
+
+
+class PivotUserObjectPermissionDisplayViewConfig(dp.DisplayViewConfig):
+    view: "PivotUserObjectPermissionModelViewSet"
+
+    def get_list_display(self) -> dp.ListDisplay:
+        return dp.ListDisplay(
+            fields=[
+                dp.Field(key="userref", label="User", width=250),
+                *[
+                    dp.Field(
+                        key=permission.codename,
+                        label=permission.name,
+                        width=150,
+                        formatting_rules=[
+                            dp.FormattingRule(style={"backgroundColor": "#FF6961"}, condition=("==", False)),
+                            dp.FormattingRule(style={"backgroundColor": "#77DD77"}, condition=("==", True)),
+                        ],
+                    )
+                    for permission in self.view.permissions
+                ],
+            ],
+            formatting=[
+                dp.Formatting(
+                    column="non_editable",
+                    formatting_rules=[dp.FormattingRule(style={"color": "gray"}, condition=("==", True))],
+                )
+            ],
+        )
+
+    def get_instance_display(self) -> dp.Display:
+        gta = [["userref"]]
+
+        for permission in self.view.permissions:
+            gta.append([permission.codename])
+
+        return dp.create_simple_display(grid_template_areas=gta)

wbcore/contrib/guardian/viewsets/configs/endpoints.py

@@ -0,0 +1,25 @@
+from rest_framework.reverse import reverse
+from wbcore.metadata.configs.endpoints import EndpointViewConfig
+
+
+class PivotUserObjectPermissionEndpointViewConfig(EndpointViewConfig):
+    def get_instance_endpoint(self, **kwargs):
+        return reverse(
+            "wbcore:guardian:pivoteduserobjectpermission-list",
+            args=[self.view.kwargs.get("content_type_id", None), self.view.kwargs.get("object_pk", None)],
+            request=self.request,
+        )
+
+    def get_update_endpoint(self, **kwargs):
+        return reverse(
+            "wbcore:guardian:pivoteduserobjectpermission-list",
+            args=[self.view.kwargs.get("content_type_id", None), self.view.kwargs.get("object_pk", None)],
+            request=self.request,
+        )
+
+    def get_create_endpoint(self, **kwargs):
+        return reverse(
+            "wbcore:guardian:pivoteduserobjectpermission-list",
+            args=[self.view.kwargs.get("content_type_id", None), self.view.kwargs.get("object_pk", None)],
+            request=self.request,
+        )

wbcore/contrib/guardian/viewsets/configs/titles.py

@@ -0,0 +1,16 @@
+from typing import TYPE_CHECKING
+
+from wbcore.metadata.configs.titles import TitleViewConfig
+
+if TYPE_CHECKING:
+    from wbcore.contrib.guardian.viewsets import PivotUserObjectPermissionModelViewSet
+
+
+class PivotUserObjectPermissionTitleViewConfig(TitleViewConfig):
+    view: "PivotUserObjectPermissionModelViewSet"
+
+    def get_list_title(self) -> str:
+        return f"Permissions for {self.view.linked_object}"
+
+    def get_create_title(self) -> str:
+        return f"Add permissions for {self.view.linked_object}"

wbcore/contrib/guardian/viewsets/mixins.py

@@ -0,0 +1,6 @@
+from wbcore.contrib.guardian.filters import ObjectPermissionsFilter
+from wbcore.viewsets.mixins import FilterMixin
+
+
+class GuardianFilterMixin(FilterMixin):
+    filter_backends = (ObjectPermissionsFilter, *FilterMixin.filter_backends)

wbcore/contrib/guardian/viewsets/viewsets.py

@@ -0,0 +1,141 @@
+from django.contrib.contenttypes.models import ContentType
+from django.db.models import Count, Exists, F, Model, OuterRef, Q, QuerySet
+from django.utils.functional import cached_property
+from guardian.shortcuts import assign_perm, remove_perm
+from rest_framework.exceptions import ValidationError
+from wbcore import serializers, viewsets
+from wbcore.contrib.authentication.models.users import Permission, User
+from wbcore.contrib.authentication.serializers import UserRepresentationSerializer
+from wbcore.contrib.guardian.models import UserObjectPermission
+from wbcore.contrib.guardian.viewsets.configs import (
+    PivotUserObjectPermissionButtonViewConfig,
+    PivotUserObjectPermissionDisplayViewConfig,
+    PivotUserObjectPermissionEndpointViewConfig,
+    PivotUserObjectPermissionTitleViewConfig,
+)
+
+
+class PivotUserObjectPermissionModelViewSet(viewsets.ModelViewSet):
+    queryset = UserObjectPermission.objects.all()
+
+    button_config_class = PivotUserObjectPermissionButtonViewConfig
+    display_config_class = PivotUserObjectPermissionDisplayViewConfig
+    endpoint_config_class = PivotUserObjectPermissionEndpointViewConfig
+    title_config_class = PivotUserObjectPermissionTitleViewConfig
+
+    lookup_field = "user_id"
+
+    @cached_property
+    def permissions(self):
+        return Permission.objects.filter(
+            Q(content_type=self.kwargs.get("content_type_id"))
+            & ~Q(codename__icontains="administrate")
+            & ~Q(codename__icontains="import")
+            & ~Q(codename__icontains="export")
+        )
+
+    @cached_property
+    def linked_object(self):
+        return ContentType.objects.get(id=self.kwargs.get("content_type_id")).get_object_for_this_type(
+            id=self.kwargs.get("object_pk")
+        )
+
+    def get_queryset(self):
+        queryset = super().get_queryset()
+
+        if (content_type_id := self.kwargs.get("content_type_id")) and (object_pk := self.kwargs.get("object_pk")):
+            queryset = queryset.filter(content_type_id=content_type_id, object_pk=object_pk)
+
+        queryset = queryset.values("user").annotate(
+            id=F("user__id"),
+            userref=F("user__id"),
+            count=Count("id"),  # This is needed as we need at least 1 aggregation function to have a group by
+            non_editable=Exists(queryset.filter(user=OuterRef("user"), editable=False)),
+            **{
+                permission.codename: Exists(queryset.filter(user=OuterRef("user"), permission_id=permission.pk))
+                for permission in self.permissions
+            },
+        )
+
+        return queryset
+
+    def get_serializer_class(self):
+        def assign_and_remove_perms(
+            self,
+            perms: dict[str, bool],
+            permissions: QuerySet[Permission],
+            user: User,
+            linked_object: Model,
+            remove: bool = True,
+        ):
+            for codename, perm in perms.items():
+                if UserObjectPermission.objects.filter(
+                    user=user,
+                    content_type_id=self.context["view"].kwargs.get("content_type_id"),
+                    object_pk=linked_object.pk,
+                    editable=False,
+                ).exists():
+                    raise ValidationError(
+                        {
+                            "non_field_errors": "This user permission is not editable as it was created through the system"
+                        }
+                    )
+                if perm:
+                    assign_perm(
+                        permissions.get(codename=codename),
+                        user,
+                        linked_object,
+                    )
+                elif remove:
+                    remove_perm(
+                        permissions.get(codename=codename),
+                        user,
+                        linked_object,
+                    )
+
+        def create(self, validated_data):
+            user = validated_data.pop("userref")
+            view = self.context["view"]
+            self.assign_and_remove_perms(validated_data, view.permissions, user, view.linked_object, remove=False)
+            self.context["view"].kwargs["user_id"] = user.id
+            return self.context["view"].get_object()
+
+        def update(self, instance, validated_data):
+            view = self.context["view"]
+            self.assign_and_remove_perms(
+                validated_data, view.permissions, User.objects.get(id=instance.get("user")), view.linked_object
+            )
+            return instance
+
+        attributes = {
+            "id": serializers.PrimaryKeyField(),
+            "count": serializers.IntegerField(required=False, read_only=True),
+            "userref": serializers.PrimaryKeyRelatedField(queryset=User.objects.all(), label="User"),
+            "_userref": UserRepresentationSerializer(source="userref"),
+            "non_editable": serializers.BooleanField(default=False),
+            **{permission.codename: serializers.BooleanField(default=False) for permission in self.permissions},
+            "Meta": type(
+                "Meta",
+                (),
+                {
+                    "model": User,
+                    "fields": (
+                        "id",
+                        "count",
+                        "userref",
+                        "_userref",
+                        "non_editable",
+                        *[perm.codename for perm in self.permissions],
+                    ),
+                },
+            ),
+            "update": update,
+            "create": create,
+            "assign_and_remove_perms": assign_and_remove_perms,
+        }
+
+        return type(
+            "PivotedUserObjectPermissionModelSerializer",
+            (serializers.ModelSerializer,),
+            attributes,
+        )

wbcore/contrib/i18n/__init__.py

@@ -0,0 +1,2 @@
+from .buttons import add_auto_translate_action_button
+from .viewsets import ModelTranslateMixin