feat: add migration to create PA role

CHANGELOG.rst

@@ -17,6 +17,10 @@ Unreleased
 ----------
 * nothing unreleased
 
+[4.21.10]
+----------
+* created migration to create a system-wide enterprise role named `enterprise_provisioning_admin`.
+
 [4.21.9]
 ---------
 * fix: fixed search fetch crashing because of server taking too long for api request logs.

enterprise/constants.py

@@ -143,6 +143,7 @@ class CourseModes:
 ENTERPRISE_ADMIN_ROLE = 'enterprise_admin'
 ENTERPRISE_OPERATOR_ROLE = 'enterprise_openedx_operator'
 SYSTEM_ENTERPRISE_CATALOG_ADMIN_ROLE = 'enterprise_catalog_admin'
+SYSTEM_ENTERPRISE_PROVISIONING_ADMIN_ROLE = 'enterprise_provisioning_admin'
 
 ENTERPRISE_DASHBOARD_ADMIN_ROLE = 'dashboard_admin'
 ENTERPRISE_CATALOG_ADMIN_ROLE = 'catalog_admin'

enterprise/migrations/0218_add_provisioning_admin_role.py

@@ -0,0 +1,38 @@
+# Generated by Django 4.2.13 on 2024-07-24 13:03
+
+from django.db import migrations
+
+
+from enterprise.constants import SYSTEM_ENTERPRISE_PROVISIONING_ADMIN_ROLE
+
+
+def create_enterprise_provisioning_admin_role(apps, schema_editor):  # pylint: disable=unused-argument
+    """Create the `enterprise_provisioining_admin` system-wide role if it does not already exist"""
+    SystemWideEnterpriseRole = apps.get_model(
+        'enterprise', 'SystemWideEnterpriseRole')
+    SystemWideEnterpriseRole.objects.update_or_create(
+        name=SYSTEM_ENTERPRISE_PROVISIONING_ADMIN_ROLE,
+        description='Role for provisioning admins',
+    )
+
+
+def delete_enterprise_provisioning_admin_role(apps, schema_editor):  # pylint: disable=unused-argument
+    """Delete the `enterprise_provisioining_admin` system-wide role"""
+    SystemWideEnterpriseRole = apps.get_model(  # pragma: no cover
+        'enterprise', 'SystemWideEnterpriseRole')
+    SystemWideEnterpriseRole.objects.filter(  # pragma: no cover
+        name=SYSTEM_ENTERPRISE_PROVISIONING_ADMIN_ROLE).delete()
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('enterprise', '0217_alter_enterprisecustomer_disable_expiry_messaging_for_learner_credit_and_more'),
+    ]
+
+    operations = [
+        migrations.RunPython(
+            code=create_enterprise_provisioning_admin_role,
+            reverse_code=delete_enterprise_provisioning_admin_role,
+        ),
+    ]

enterprise/roles_api.py

@@ -8,6 +8,7 @@
     ENTERPRISE_LEARNER_ROLE,
     ENTERPRISE_OPERATOR_ROLE,
     SYSTEM_ENTERPRISE_CATALOG_ADMIN_ROLE,
+    SYSTEM_ENTERPRISE_PROVISIONING_ADMIN_ROLE,
 )
 from enterprise.models import SystemWideEnterpriseRole, SystemWideEnterpriseUserRoleAssignment
 
@@ -46,6 +47,11 @@ def catalog_admin_role():
     return get_or_create_system_wide_role(SYSTEM_ENTERPRISE_CATALOG_ADMIN_ROLE)
 
 
+def provisioning_admin_role():
+    """ Returns the provisioning admin role. """
+    return get_or_create_system_wide_role(SYSTEM_ENTERPRISE_PROVISIONING_ADMIN_ROLE)
+
+
 def roles_by_name():
     """
     Returns a mapping of system wide roles by name.
@@ -55,6 +61,7 @@ def roles_by_name():
         ENTERPRISE_LEARNER_ROLE: learner_role(),
         ENTERPRISE_OPERATOR_ROLE: openedx_operator_role(),
         SYSTEM_ENTERPRISE_CATALOG_ADMIN_ROLE: catalog_admin_role(),
+        SYSTEM_ENTERPRISE_PROVISIONING_ADMIN_ROLE: provisioning_admin_role(),
     }
 
 

tests/test_models.py

@@ -2368,6 +2368,22 @@ def test_get_context_applies_to_all_contexts(self):
 
         assert ['*'] == enterprise_role_assignment.get_context()
 
+    def test_get_context_applies_for_provisioning_admins(self):
+        """
+        Verify that having a PA role assignment with ``applies_to_all_contexts`` set to True gives
+        the user a context of "*".
+        """
+        enterprise_customer = factories.EnterpriseCustomerFactory(uuid='47130371-0b6d-43f5-01de-71942664de2b')
+        user = self._create_and_link_user('edx@example.com', enterprise_customer)
+
+        enterprise_role_assignment, __ = SystemWideEnterpriseUserRoleAssignment.objects.get_or_create(
+            user=user,
+            role=roles_api.provisioning_admin_role(),
+            applies_to_all_contexts=True,
+        )
+
+        assert ['*'] == enterprise_role_assignment.get_context()
+
     @ddt.data(
         {
             'role_name': ENTERPRISE_LEARNER_ROLE,

tests/test_roles_api.py

@@ -9,6 +9,7 @@
     ENTERPRISE_LEARNER_ROLE,
     ENTERPRISE_OPERATOR_ROLE,
     SYSTEM_ENTERPRISE_CATALOG_ADMIN_ROLE,
+    SYSTEM_ENTERPRISE_PROVISIONING_ADMIN_ROLE,
 )
 from enterprise.models import SystemWideEnterpriseRole
 
@@ -22,6 +23,7 @@ class TestUpdateRoleAssignmentsCommand(TestCase):
         ENTERPRISE_LEARNER_ROLE,
         ENTERPRISE_OPERATOR_ROLE,
         SYSTEM_ENTERPRISE_CATALOG_ADMIN_ROLE,
+        SYSTEM_ENTERPRISE_PROVISIONING_ADMIN_ROLE
     )
 
     def setUp(self):