strip Global_Role and group-membership UI from user pages

devGregA · devGregA · commit 88f1c3b1371e · 2026-05-07T14:43:35.000-06:00
Remove Global_Role form processing from dojo/user/views.py
(view_profile, add_user, edit_user) and the user-side
add_group_member view + URL (add_group_member_user). Keep the
Global_Role guard inside delete_user since it protects model deletion,
not UI. Strip the matching template scaffolding:

- {% block global_role_form %}{% endblock %} from add_user.html and
  profile.html
- {% block profile_groups_panel %}{% endblock %} from profile.html
- {% block user_groups_panel %}{% endblock %} from view_user.html
- the "Global role" metadata row from view_user.html
- new_group_member_user.html (template for the deleted view)

Both Tailwind and Bootstrap (templates_classic) trees updated.
Add_Group_Member_UserForm dropped from dojo.forms; GlobalRoleForm
stays because Pro's group views (slice 1) still import it.
edit_permissions for users remains as configuration UI.
diff --git a/dojo/forms.py b/dojo/forms.py
@@ -2424,21 +2424,6 @@ def __init__(self, *args, **kwargs):
             del self.fields["exclude_product_types"]
 
 
-class Add_Group_Member_UserForm(forms.ModelForm):
-    groups = forms.ModelMultipleChoiceField(queryset=Dojo_Group.objects.none(), required=True, label="Groups")
-
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        self.fields["user"].disabled = True
-        current_groups = Dojo_Group_Member.objects.filter(user=self.initial["user"]).values_list("group", flat=True)
-        self.fields["groups"].queryset = Dojo_Group.objects.exclude(id__in=current_groups)
-        self.fields["role"].queryset = get_group_member_roles()
-
-    class Meta:
-        model = Dojo_Group_Member
-        fields = ["groups", "user", "role"]
-
-
 class Add_Product_Group_GroupForm(forms.ModelForm):
     products = forms.ModelMultipleChoiceField(queryset=Product.objects.none(), required=True,
                                               label=labels.ASSET_PLURAL_LABEL)
diff --git a/dojo/templates/dojo/add_user.html b/dojo/templates/dojo/add_user.html
@@ -15,7 +15,6 @@ <h3> {{ name }} {% if to_edit %}- {{ to_edit.username }}{% endif %}</h3>
             <legend>{% trans "Additional Contact Information" %}</legend>
             {% include "dojo/form_fields.html" with form=contact_form %}
         </fieldset>
-        {% block global_role_form %}{% endblock %}
         <div class="form-group">
             <div class="col-sm-offset-2 col-sm-10">
                 <input class="btn btn-primary" type="submit" name="add_user" value="{% trans "Submit" %}"/>
diff --git a/dojo/templates/dojo/new_group_member_user.html b/dojo/templates/dojo/new_group_member_user.html
diff --git a/dojo/templates/dojo/profile.html b/dojo/templates/dojo/profile.html
@@ -15,7 +15,6 @@ <h3>{% blocktrans with full_name=user.get_full_name %} User Profile - {{ full_na
                     <legend>{% trans "Additional Contact Information" %}</legend>
                     {% include "dojo/form_fields.html" with form=contact_form %}
                 </fieldset>
-                {% block global_role_form %}{% endblock %}
                 <div class="form-group">
                     <div class="col-sm-offset-2 col-sm-10">
                         <input class="btn btn-primary" type="submit" value="{% trans "Submit" %}"/>
@@ -38,7 +37,6 @@ <h3>{% blocktrans with full_name=user.get_full_name %} User Profile - {{ full_na
                 {% endif %}
                 </div>
             </div>
-            {% block profile_groups_panel %}{% endblock %}
         </div>
     </div>
 {% endblock %}
diff --git a/dojo/templates/dojo/view_user.html b/dojo/templates/dojo/view_user.html
@@ -237,8 +237,6 @@ <h4 class="pull-left">{{ labels.ASSET_USERS_ACCESS_LABEL }}</h4>
             {% endif %}
         </div>
         {% endblock user_products_panel %}
-
-        {% block user_groups_panel %}{% endblock %}
     </div>
     <div class="col-md-4">
         <div class="panel panel-default-secondary">
@@ -290,10 +288,6 @@ <h3 class="panel-title"><span class="fa-solid fa-circle-info fa-fw" aria-hidden=
                                 {% endif %}
                             </td>
                         </tr>
-                        <tr>
-                            <td style="width: 200px;"><strong>{% trans "Global role" %}</strong></td>
-                            <td>{% if user.global_role.role %} {{ user.global_role.role }} {% endif %}</td>
-                        </tr>
                         <tr>
                             <td style="width: 200px;"><strong>{% trans "Date Joined" %}</strong></td>
                             <td>{{ user.date_joined }}</td>
diff --git a/dojo/templates_classic/dojo/add_user.html b/dojo/templates_classic/dojo/add_user.html
@@ -15,7 +15,6 @@ <h3> {{ name }} {% if to_edit %}- {{ to_edit.username }}{% endif %}</h3>
             <legend>{% trans "Additional Contact Information" %}</legend>
             {% include "dojo/form_fields.html" with form=contact_form %}
         </fieldset>
-        {% block global_role_form %}{% endblock %}
         <div class="form-group">
             <div class="col-sm-offset-2 col-sm-10">
                 <input class="btn btn-primary" type="submit" name="add_user" value="{% trans "Submit" %}"/>
diff --git a/dojo/templates_classic/dojo/new_group_member_user.html b/dojo/templates_classic/dojo/new_group_member_user.html
diff --git a/dojo/templates_classic/dojo/profile.html b/dojo/templates_classic/dojo/profile.html
@@ -15,7 +15,6 @@ <h3>{% blocktrans with full_name=user.get_full_name %} User Profile - {{ full_na
                     <legend>{% trans "Additional Contact Information" %}</legend>
                     {% include "dojo/form_fields.html" with form=contact_form %}
                 </fieldset>
-                {% block global_role_form %}{% endblock %}
                 <div class="form-group">
                     <div class="col-sm-offset-2 col-sm-10">
                         <input class="btn btn-primary" type="submit" value="{% trans "Submit" %}"/>
@@ -38,7 +37,6 @@ <h3>{% blocktrans with full_name=user.get_full_name %} User Profile - {{ full_na
                 {% endif %}
                 </div>
             </div>
-            {% block profile_groups_panel %}{% endblock %}
         </div>
     </div>
 {% endblock %}
diff --git a/dojo/templates_classic/dojo/view_user.html b/dojo/templates_classic/dojo/view_user.html
@@ -237,8 +237,6 @@ <h4 class="pull-left">{{ labels.ASSET_USERS_ACCESS_LABEL }}</h4>
             {% endif %}
         </div>
         {% endblock user_products_panel %}
-
-        {% block user_groups_panel %}{% endblock %}
     </div>
     <div class="col-md-4">
         <div class="panel panel-default-secondary">
@@ -290,10 +288,6 @@ <h3 class="panel-title"><span class="fa-solid fa-circle-info fa-fw" aria-hidden=
                                 {% endif %}
                             </td>
                         </tr>
-                        <tr>
-                            <td style="width: 200px;"><strong>{% trans "Global role" %}</strong></td>
-                            <td>{% if user.global_role.role %} {{ user.global_role.role }} {% endif %}</td>
-                        </tr>
                         <tr>
                             <td style="width: 200px;"><strong>{% trans "Date Joined" %}</strong></td>
                             <td>{{ user.date_joined }}</td>
diff --git a/dojo/user/urls.py b/dojo/user/urls.py
@@ -31,7 +31,6 @@
             views.revoke_user_from_product, name="revoke_user_from_product"),
     re_path(r"^user/(?P<uid>\d+)/revoke_product_type/(?P<ptid>\d+)$",
             views.revoke_user_from_product_type, name="revoke_user_from_product_type"),
-    re_path(r"^user/(?P<uid>\d+)/add_group_member$", views.add_group_member, name="add_group_member_user"),
     re_path(r"^user/(?P<uid>\d+)/edit_permissions$", views.edit_permissions, name="edit_user_permissions"),
 ]
 if settings.FORGOT_PASSWORD:
diff --git a/dojo/user/views.py b/dojo/user/views.py
@@ -3,7 +3,6 @@
 from datetime import timedelta
 
 import hyperlink
-from crum import get_current_user
 from django.conf import settings
 from django.contrib import messages
 from django.contrib.admin.utils import NestedObjects
@@ -29,11 +28,10 @@
 from rest_framework.exceptions import ValidationError as RFValidationError
 
 from dojo.authorization.authorization import user_is_superuser_or_global_owner
-from dojo.authorization.models import Dojo_Group_Member, Global_Role, Product_Member, Product_Type_Member
+from dojo.authorization.models import Global_Role, Product_Member, Product_Type_Member
 from dojo.decorators import dojo_ratelimit
 from dojo.filters import UserFilter
 from dojo.forms import (
-    Add_Group_Member_UserForm,
     Add_Product_Member_UserForm,
     Add_Product_Type_Member_UserForm,
     AddDojoUserForm,
@@ -45,10 +43,8 @@
     DeleteUserForm,
     DojoUserForm,
     EditDojoUserForm,
-    GlobalRoleForm,
     UserContactInfoForm,
 )
-from dojo.group.queries import get_authorized_group_members_for_user
 from dojo.labels import get_labels
 from dojo.models import Alerts, Dojo_User, Product, Product_Type, UserContactInfo
 from dojo.product.queries import get_authorized_product_members_for_user
@@ -215,41 +211,18 @@ def alerts_partial(request):
 def view_profile(request):
     user = get_object_or_404(Dojo_User, pk=request.user.id)
     form = DojoUserForm(instance=user)
-    group_members = get_authorized_group_members_for_user(user)
 
     user_contact = user.usercontactinfo if hasattr(user, "usercontactinfo") else None
     contact_form = UserContactInfoForm(user=user) if user_contact is None else UserContactInfoForm(instance=user_contact, user=user)
 
-    # Global_Role.user uses related_name="+", so user.global_role is not a
-    # reverse accessor — look it up via the forward FK so we update the
-    # existing row instead of trying to insert a duplicate.
-    global_role = Global_Role.objects.filter(user=user).first()
-    if global_role is None:
-        previous_global_role = None
-        global_role_form = GlobalRoleForm()
-    else:
-        previous_global_role = global_role.role
-        global_role_form = GlobalRoleForm(instance=global_role)
-
     if request.method == "POST":
         form = DojoUserForm(request.POST, instance=user)
         contact_form = UserContactInfoForm(request.POST, instance=user_contact, user=user)
-        global_role_form = GlobalRoleForm(request.POST, instance=global_role)
-        if form.is_valid() and contact_form.is_valid() and global_role_form.is_valid():
+        if form.is_valid() and contact_form.is_valid():
             form.save()
             contact = contact_form.save(commit=False)
             contact.user = user
             contact.save()
-            request_user = get_current_user()
-            global_role = global_role_form.save(commit=False)
-            if global_role.role != previous_global_role and not request_user.is_superuser:
-                global_role.role = previous_global_role
-                messages.add_message(request,
-                                    messages.WARNING,
-                                    _("Only superusers are allowed to change their global role."),
-                                    extra_tags="alert-warning")
-            global_role.user = user
-            global_role.save()
 
             messages.add_message(request,
                                  messages.SUCCESS,
@@ -265,9 +238,7 @@ def view_profile(request):
     return render(request, "dojo/profile.html", {
         "user": user,
         "form": form,
-        "contact_form": contact_form,
-        "global_role_form": global_role_form,
-        "group_members": group_members})
+        "contact_form": contact_form})
 
 
 def change_password(request):
@@ -318,14 +289,12 @@ def add_user(request):
     page_name = _("Add User")
     form = AddDojoUserForm()
     contact_form = UserContactInfoForm()
-    global_role_form = GlobalRoleForm()
     user = None
 
     if request.method == "POST":
         form = AddDojoUserForm(request.POST)
         contact_form = UserContactInfoForm(request.POST)
-        global_role_form = GlobalRoleForm(request.POST)
-        if form.is_valid() and contact_form.is_valid() and global_role_form.is_valid():
+        if form.is_valid() and contact_form.is_valid():
             if not request.user.is_superuser and form.cleaned_data["is_superuser"]:
                 messages.add_message(request,
                                     messages.ERROR,
@@ -336,11 +305,6 @@ def add_user(request):
                                     messages.ERROR,
                                     _("Only superusers are allowed to grant staff status. User was not saved."),
                                     extra_tags="alert-danger")
-            elif not request.user.is_superuser and global_role_form.cleaned_data["role"]:
-                messages.add_message(request,
-                                    messages.ERROR,
-                                    _("Only superusers are allowed to add users with a global role. User was not saved."),
-                                    extra_tags="alert-danger")
             else:
                 user = form.save(commit=False)
                 password = request.POST["password"]
@@ -353,9 +317,6 @@ def add_user(request):
                 contact = contact_form.save(commit=False)
                 contact.user = user
                 contact.save()
-                global_role = global_role_form.save(commit=False)
-                global_role.user = user
-                global_role.save()
                 messages.add_message(request,
                                     messages.SUCCESS,
                                     _("User added successfully."),
@@ -371,7 +332,6 @@ def add_user(request):
         "name": page_name,
         "form": form,
         "contact_form": contact_form,
-        "global_role_form": global_role_form,
         "to_add": True})
 
 
@@ -389,7 +349,6 @@ def view_user(request, uid):
     # `{% block user_products_panel %}` at pro/templates/dojo/view_user.html
     product_members = get_authorized_product_members_for_user(user, "view")
     product_type_members = get_authorized_product_type_members_for_user(user, "view")
-    group_members = get_authorized_group_members_for_user(user)
     configuration_permission_form = ConfigurationPermissionsForm(user=user)
 
     add_breadcrumb(title=_("View User"), top_level=False, request=request)
@@ -399,7 +358,6 @@ def view_user(request, uid):
         "accessible_products": accessible_products,
         "product_members": product_members,
         "product_type_members": product_type_members,
-        "group_members": group_members,
         "configuration_permission_form": configuration_permission_form})
 
 
@@ -411,24 +369,14 @@ def edit_user(request, uid):
     user_contact = user.usercontactinfo if hasattr(user, "usercontactinfo") else None
     contact_form = UserContactInfoForm(user=user) if user_contact is None else UserContactInfoForm(instance=user_contact, user=user)
 
-    # Look up Global_Role via the forward FK; user.global_role is not a
-    # reverse accessor (related_name="+").
-    global_role = Global_Role.objects.filter(user=user).first()
-    global_role_form = GlobalRoleForm() if global_role is None else GlobalRoleForm(instance=global_role)
-
     if request.method == "POST":
         form = EditDojoUserForm(request.POST, instance=user)
         if user_contact is None:
             contact_form = UserContactInfoForm(request.POST, user=user)
         else:
             contact_form = UserContactInfoForm(request.POST, instance=user_contact, user=user)
 
-        if global_role is None:
-            global_role_form = GlobalRoleForm(request.POST)
-        else:
-            global_role_form = GlobalRoleForm(request.POST, instance=global_role)
-
-        if form.is_valid() and contact_form.is_valid() and global_role_form.is_valid():
+        if form.is_valid() and contact_form.is_valid():
             if not request.user.is_superuser and form.cleaned_data["is_superuser"]:
                 messages.add_message(request,
                                     messages.ERROR,
@@ -439,19 +387,11 @@ def edit_user(request, uid):
                                     messages.ERROR,
                                     _("Only superusers are allowed to change staff status. User was not saved."),
                                     extra_tags="alert-danger")
-            elif not request.user.is_superuser and global_role_form.cleaned_data["role"]:
-                messages.add_message(request,
-                                    messages.ERROR,
-                                    _("Only superusers are allowed to edit users with a global role. User was not saved."),
-                                    extra_tags="alert-danger")
             else:
                 form.save()
                 contact = contact_form.save(commit=False)
                 contact.user = user
                 contact.save()
-                global_role = global_role_form.save(commit=False)
-                global_role.user = user
-                global_role.save()
 
                 # Handle API token reset if checkbox is checked
                 # Only allow superusers or global owners to reset tokens
@@ -493,7 +433,6 @@ def edit_user(request, uid):
         "name": page_name,
         "form": form,
         "contact_form": contact_form,
-        "global_role_form": global_role_form,
         "to_edit": user})
 
 
@@ -701,36 +640,6 @@ def revoke_user_from_product_type(request, uid, ptid):
     return HttpResponseRedirect(reverse("view_user", args=(uid,)))
 
 
-@user_passes_test(lambda u: u.is_superuser)
-def add_group_member(request, uid):
-    user = get_object_or_404(Dojo_User, id=uid)
-    memberform = Add_Group_Member_UserForm(initial={"user": user.id})
-
-    if request.method == "POST":
-        memberform = Add_Group_Member_UserForm(request.POST, initial={"user": user.id})
-        if memberform.is_valid():
-            if "groups" in memberform.cleaned_data and len(memberform.cleaned_data["groups"]) > 0:
-                for group in memberform.cleaned_data["groups"]:
-                    existing_groups = Dojo_Group_Member.objects.filter(user=user, group=group)
-                    if existing_groups.count() == 0:
-                        group_member = Dojo_Group_Member()
-                        group_member.group = group
-                        group_member.user = user
-                        group_member.role = memberform.cleaned_data["role"]
-                        group_member.save()
-            messages.add_message(request,
-                                 messages.SUCCESS,
-                                 _("Groups added successfully."),
-                                 extra_tags="alert-success")
-            return HttpResponseRedirect(reverse("view_user", args=(uid,)))
-
-    add_breadcrumb(title=_("Add Group Member"), top_level=False, request=request)
-    return render(request, "dojo/new_group_member_user.html", {
-        "user": user,
-        "form": memberform,
-    })
-
-
 def edit_permissions(request, uid):
     user = get_object_or_404(Dojo_User, id=uid)
     if request.method == "POST":

Original file line number	Diff line number	Diff line change
`@@ -31,7 +31,6 @@`
`31`	`31`	`views.revoke_user_from_product, name="revoke_user_from_product"),`
`32`	`32`	`re_path(r"^user/(?P<uid>\d+)/revoke_product_type/(?P<ptid>\d+)$",`
`33`	`33`	`views.revoke_user_from_product_type, name="revoke_user_from_product_type"),`
`34`		`- re_path(r"^user/(?P<uid>\d+)/add_group_member$", views.add_group_member, name="add_group_member_user"),`
`35`	`34`	`re_path(r"^user/(?P<uid>\d+)/edit_permissions$", views.edit_permissions, name="edit_user_permissions"),`
`36`	`35`	`]`
`37`	`36`	`if settings.FORGOT_PASSWORD:`