feat(authorization): unregister RBAC API endpoints in OS — moved to Pro

Strip the 8 RBAC v2_api.register() calls from dojo/urls.py
(dojo_groups, dojo_group_members, global_roles, product_groups,
product_members, product_type_groups, product_type_members, roles) and
the 4 alias registrations (asset_groups, asset_members,
organization_groups, organization_members) from
dojo/asset/api/urls.py and dojo/organization/api/urls.py. The viewsets
and serializers in dojo/api_v2/{views,serializers}.py stay so Pro can
keep subclassing them.

Pro already registers replacements for dojo_groups, dojo_group_members,
global_roles, product_groups, product_members, product_type_groups,
product_type_members via its add_*_urls hooks; companion Pro commit
adds add_roles_urls so /api/v2/roles/ stays available under Pro.

Delete the 12 RBAC test classes from unittests/test_rest_framework.py
(DojoGroupsTest, DojoGroupsUsersTest, RolesTest, GlobalRolesTest,
ProductTypeMemberTest, OrganizationMemberTest, ProductMemberTest,
AssetMemberTest, ProductTypeGroupTest, OrganiazationGroupTest,
ProductGroupTest, AssetGroupTest) — equivalent coverage exists in
dojo-pro at unit_tests/api/{dojo_groups,dojo_group_members,
global_roles,product_groups,product_members,product_type_groups,
product_type_members}/{test_crud,test_permissions}.py, and the
companion Pro commit adds unit_tests/api/roles/test_crud.py for the
roles endpoint.

Author: devGregA

dojo/asset/api/urls.py

@@ -1,7 +1,5 @@
 from dojo.asset.api.views import (
     AssetAPIScanConfigurationViewSet,
-    AssetGroupViewSet,
-    AssetMemberViewSet,
     AssetViewSet,
 )
 
@@ -10,6 +8,6 @@ def add_asset_urls(router):
     router.register(r"assets", AssetViewSet, basename="asset")
     router.register(r"asset_api_scan_configurations", AssetAPIScanConfigurationViewSet,
                     basename="asset_api_scan_configuration")
-    router.register(r"asset_groups", AssetGroupViewSet, basename="asset_group")
-    router.register(r"asset_members", AssetMemberViewSet, basename="asset_member")
+    # RBAC alias endpoints moved to Pro under legacy authorization:
+    #   asset_groups, asset_members → pro/product_groups, pro/product_members
     return router

dojo/organization/api/urls.py

@@ -1,12 +1,11 @@
 from dojo.organization.api.views import (
-    OrganizationGroupViewSet,
-    OrganizationMemberViewSet,
     OrganizationViewSet,
 )
 
 
 def add_organization_urls(router):
     router.register(r"organizations", OrganizationViewSet, basename="organization")
-    router.register(r"organization_members", OrganizationMemberViewSet, basename="organization_member")
-    router.register(r"organization_groups", OrganizationGroupViewSet, basename="organization_group")
+    # RBAC alias endpoints moved to Pro under legacy authorization:
+    #   organization_members, organization_groups →
+    #   pro/product_type_members, pro/product_type_groups
     return router

dojo/urls.py

@@ -20,8 +20,6 @@
     CredentialsMappingViewSet,
     CredentialsViewSet,
     DevelopmentEnvironmentViewSet,
-    DojoGroupMemberViewSet,
-    DojoGroupViewSet,
     DojoMetaViewSet,
     EndpointMetaImporterView,
     EndpointStatusViewSet,
@@ -30,7 +28,6 @@
     EngagementViewSet,
     FindingTemplatesViewSet,
     FindingViewSet,
-    GlobalRoleViewSet,
     ImportLanguagesView,
     ImportScanView,
     JiraInstanceViewSet,
@@ -44,10 +41,6 @@
     NotificationsViewSet,
     NotificationWebhooksViewSet,
     ProductAPIScanConfigurationViewSet,
-    ProductGroupViewSet,
-    ProductMemberViewSet,
-    ProductTypeGroupViewSet,
-    ProductTypeMemberViewSet,
     ProductTypeViewSet,
     ProductViewSet,
     QuestionnaireAnsweredSurveyViewSet,
@@ -58,7 +51,6 @@
     RegulationsViewSet,
     ReImportScanView,
     RiskAcceptanceViewSet,
-    RoleViewSet,
     SLAConfigurationViewset,
     SonarqubeIssueTransitionViewSet,
     SonarqubeIssueViewSet,
@@ -131,14 +123,14 @@
 v2_api.register(r"credential_mappings", CredentialsMappingViewSet, basename="cred_mapping")
 v2_api.register(r"credentials", CredentialsViewSet, basename="cred_user")
 v2_api.register(r"development_environments", DevelopmentEnvironmentViewSet, basename="development_environment")
-v2_api.register(r"dojo_groups", DojoGroupViewSet, basename="dojo_group")
-v2_api.register(r"dojo_group_members", DojoGroupMemberViewSet, basename="dojo_group_member")
+# RBAC endpoints moved to Pro under legacy authorization:
+#   dojo_groups, dojo_group_members → pro/groups, pro/group_members
 v2_api.register(r"endpoint_meta_import", EndpointMetaImporterView, basename="endpointmetaimport")
 v2_api.register(r"engagements", EngagementViewSet, basename="engagement")
 v2_api.register(r"engagement_presets", EngagementPresetsViewset, basename="engagement_presets")
 v2_api.register(r"finding_templates", FindingTemplatesViewSet, basename="finding_template")
 v2_api.register(r"findings", FindingViewSet, basename="finding")
-v2_api.register(r"global_roles", GlobalRoleViewSet, basename="global_role")
+# RBAC endpoint moved to Pro under legacy authorization: global_roles → pro/global_roles
 v2_api.register(r"import-languages", ImportLanguagesView, basename="importlanguages")
 v2_api.register(r"import-scan", ImportScanView, basename="importscan")
 v2_api.register(r"jira_instances", JiraInstanceViewSet, basename="jira_instance")
@@ -156,16 +148,16 @@
 v2_api.register(r"notification_webhooks", NotificationWebhooksViewSet)
 v2_api.register(r"products", ProductViewSet, basename="product")
 v2_api.register(r"product_api_scan_configurations", ProductAPIScanConfigurationViewSet, basename="product_api_scan_configuration")
-v2_api.register(r"product_groups", ProductGroupViewSet, basename="product_group")
-v2_api.register(r"product_members", ProductMemberViewSet, basename="product_member")
+# RBAC endpoints moved to Pro under legacy authorization:
+#   product_groups, product_members → pro/product_groups, pro/product_members
 v2_api.register(r"product_types", ProductTypeViewSet, basename="product_type")
-v2_api.register(r"product_type_members", ProductTypeMemberViewSet, basename="product_type_member")
-v2_api.register(r"product_type_groups", ProductTypeGroupViewSet, basename="product_type_group")
+# RBAC endpoints moved to Pro under legacy authorization:
+#   product_type_members, product_type_groups → pro/product_type_members, pro/product_type_groups
 v2_api.register(r"regulations", RegulationsViewSet, basename="regulations")
 v2_api.register(r"reimport-scan", ReImportScanView, basename="reimportscan")
 v2_api.register(r"request_response_pairs", BurpRawRequestResponseViewSet, basename="request_response_pairs")
 v2_api.register(r"risk_acceptance", RiskAcceptanceViewSet, basename="risk_acceptance")
-v2_api.register(r"roles", RoleViewSet, basename="role")
+# RBAC endpoint moved to Pro under legacy authorization: roles → pro/roles
 v2_api.register(r"sla_configurations", SLAConfigurationViewset, basename="sla_configurations")
 v2_api.register(r"sonarqube_issues", SonarqubeIssueViewSet, basename="sonarqube_issue")
 v2_api.register(r"sonarqube_transitions", SonarqubeIssueTransitionViewSet, basename="sonarqube_issue_transition")