remove orphaned API ViewSets, serializers, and permissions for groups/roles

The dojo_groups, dojo_group_members, global_roles, product_groups,
product_type_groups, and roles routes were unregistered from v2_api in
0519010 (or earlier merge); their ViewSet/Serializer/Permission
classes have lived on as dead code that Pro extends. Pro now owns
standalone implementations under pro/{groups,group_members,
global_roles,product_groups,product_type_groups,roles}/api so these
OS classes are safe to drop.

- dojo/api_v2/views.py: drop RoleViewSet, DojoGroupViewSet,
  DojoGroupMemberViewSet, GlobalRoleViewSet, ProductGroupViewSet,
  ProductTypeGroupViewSet; clean unused imports (get_authorized_groups,
  get_authorized_group_members, get_authorized_product_groups,
  get_authorized_product_type_groups, Dojo_Group_Member, Global_Role,
  Product_Group, Product_Type_Group). Strip global_role and
  dojo_group_member sections from UserProfileView (matches slice 4
  user-page strip).
- dojo/api_v2/serializers.py: drop RoleSerializer, DojoGroupSerializer,
  DojoGroupMemberSerializer, GlobalRoleSerializer, ProductGroupSerializer,
  ProductTypeGroupSerializer; remove the same nested fields from
  UserProfileSerializer; clean unused imports.
- dojo/authorization/api_permissions.py: drop UserHasDojoGroupPermission,
  UserHasDojoGroupMemberPermission, UserHasProductGroupPermission,
  UserHasProductTypeGroupPermission. IsSuperUserOrGlobalOwner stays
  because UsersViewSet.reset_api_token still uses it.

Author: devGregA

dojo/api_v2/serializers.py

@@ -9,7 +9,7 @@
 import six
 import tagulous
 from django.conf import settings
-from django.contrib.auth.models import Group, Permission
+from django.contrib.auth.models import Permission
 from django.contrib.auth.password_validation import validate_password
 from django.core.exceptions import PermissionDenied, ValidationError
 from django.db import transaction
@@ -27,13 +27,8 @@
 import dojo.risk_acceptance.helper as ra_helper
 from dojo.authorization.authorization import user_has_permission
 from dojo.authorization.models import (
-    Dojo_Group_Member,
-    Global_Role,
-    Product_Group,
     Product_Member,
-    Product_Type_Group,
     Product_Type_Member,
-    Role,
 )
 from dojo.celery_dispatch import dojo_dispatch_task
 from dojo.endpoint.utils import endpoint_filter, endpoint_meta_import
@@ -43,7 +38,6 @@
     save_vulnerability_ids_template,
 )
 from dojo.finding.queries import get_authorized_findings
-from dojo.group.utils import get_auth_group_name
 from dojo.importers.auto_create_context import AutoCreateContextManager
 from dojo.importers.base_importer import BaseImporter
 from dojo.importers.default_importer import DefaultImporter
@@ -66,7 +60,6 @@
     Cred_Mapping,
     Cred_User,
     Development_Environment,
-    Dojo_Group,
     Dojo_User,
     DojoMeta,
     Endpoint,
@@ -666,187 +659,6 @@ class Meta:
         fields = ("id", "username", "first_name", "last_name")
 
 
-class RoleSerializer(serializers.ModelSerializer):
-    class Meta:
-        model = Role
-        fields = "__all__"
-
-
-class DojoGroupSerializer(serializers.ModelSerializer):
-    configuration_permissions = serializers.PrimaryKeyRelatedField(
-        allow_null=True,
-        queryset=Permission.objects.filter(
-            codename__in=get_configuration_permissions_codenames(),
-        ),
-        many=True,
-        required=False,
-        source="auth_group.permissions",
-    )
-
-    class Meta:
-        model = Dojo_Group
-        exclude = ("auth_group",)
-
-    def to_representation(self, instance):
-        if not instance.auth_group:
-            auth_group = Group(name=get_auth_group_name(instance))
-            auth_group.save()
-            instance.auth_group = auth_group
-            members = instance.users.all()
-            for member in members:
-                auth_group.user_set.add(member)
-            instance.save()
-        ret = super().to_representation(instance)
-        # This will show only "configuration_permissions" even if user has also
-        # other permissions
-        all_permissions = set(ret["configuration_permissions"])
-        allowed_configuration_permissions = set(
-            self.fields[
-                "configuration_permissions"
-            ].child_relation.queryset.values_list("id", flat=True),
-        )
-        ret["configuration_permissions"] = list(
-            all_permissions.intersection(allowed_configuration_permissions),
-        )
-
-        return ret
-
-    def create(self, validated_data):
-        new_configuration_permissions = None
-        if (
-            "auth_group" in validated_data
-            and "permissions" in validated_data["auth_group"]
-        ):  # This field was renamed from "configuration_permissions" in the meantime
-            new_configuration_permissions = set(
-                validated_data.pop("auth_group")["permissions"],
-            )
-
-        instance = super().create(validated_data)
-
-        # This will update only Permissions from category
-        # "configuration_permissions". There are no other Permissions.
-        if new_configuration_permissions:
-            instance.auth_group.permissions.set(new_configuration_permissions)
-
-        return instance
-
-    def update(self, instance, validated_data):
-        permissions_in_payload = None
-        new_configuration_permissions = None
-        if (
-            "auth_group" in validated_data
-            and "permissions" in validated_data["auth_group"]
-        ):  # This field was renamed from "configuration_permissions" in the meantime
-            permissions_in_payload = validated_data.pop("auth_group")["permissions"]
-            new_configuration_permissions = set(permissions_in_payload)
-
-        instance = super().update(instance, validated_data)
-
-        # This will update only Permissions from category
-        # "configuration_permissions". Others will be untouched
-        if new_configuration_permissions:
-            allowed_configuration_permissions = set(
-                self.fields[
-                    "configuration_permissions"
-                ].child_relation.queryset.all(),
-            )
-            non_configuration_permissions = (
-                set(instance.auth_group.permissions.all())
-                - allowed_configuration_permissions
-            )
-            new_permissions = non_configuration_permissions.union(
-                new_configuration_permissions,
-            )
-            instance.auth_group.permissions.set(new_permissions)
-
-        # Clear all configuration permissions if an empty list is provided
-        if isinstance(permissions_in_payload, list) and len(permissions_in_payload) == 0:
-            instance.auth_group.permissions.clear()
-
-        return instance
-
-
-class DojoGroupMemberSerializer(serializers.ModelSerializer):
-    class Meta:
-        model = Dojo_Group_Member
-        fields = "__all__"
-
-    def validate(self, data):
-        if (
-            self.instance is not None
-            and data.get("group") != self.instance.group
-            and not user_has_permission(
-                self.context["request"].user,
-                data.get("group"),
-                "staff_only",
-            )
-        ):
-            msg = "You are not permitted to add a user to this group"
-            raise PermissionDenied(msg)
-
-        if (
-            self.instance is None
-            or data.get("group") != self.instance.group
-            or data.get("user") != self.instance.user
-        ):
-            members = Dojo_Group_Member.objects.filter(
-                group=data.get("group"), user=data.get("user"),
-            )
-            if members.count() > 0:
-                msg = "Dojo_Group_Member already exists"
-                raise ValidationError(msg)
-
-        if self.instance is not None and not data.get("role").is_owner:
-            owners = (
-                Dojo_Group_Member.objects.filter(
-                    group=data.get("group"), role__is_owner=True,
-                )
-                .exclude(id=self.instance.id)
-                .count()
-            )
-            if owners < 1:
-                msg = "There must be at least one owner"
-                raise ValidationError(msg)
-
-        if data.get("role").is_owner and not user_has_permission(
-            self.context["request"].user,
-            data.get("group"),
-            "staff_only",
-        ):
-            msg = "You are not permitted to add a user as Owner to this group"
-            raise PermissionDenied(msg)
-
-        return data
-
-
-class GlobalRoleSerializer(serializers.ModelSerializer):
-    class Meta:
-        model = Global_Role
-        fields = "__all__"
-
-    def validate(self, data):
-        user = None
-        group = None
-
-        if self.instance is not None:
-            user = self.instance.user
-            group = self.instance.group
-
-        if "user" in data:
-            user = data.get("user")
-        if "group" in data:
-            group = data.get("group")
-
-        if user is None and group is None:
-            msg = "Global_Role must have either user or group"
-            raise ValidationError(msg)
-        if user is not None and group is not None:
-            msg = "Global_Role cannot have both user and group"
-            raise ValidationError(msg)
-
-        return data
-
-
 class AddUserSerializer(serializers.ModelSerializer):
     class Meta:
         model = User
@@ -966,47 +778,6 @@ def validate(self, data):
         return data
 
 
-class ProductGroupSerializer(serializers.ModelSerializer):
-    class Meta:
-        model = Product_Group
-        fields = "__all__"
-
-    def validate(self, data):
-        if (
-            self.instance is not None
-            and data.get("product") != self.instance.product
-            and not user_has_permission(
-                self.context["request"].user,
-                data.get("product"),
-                "add",
-            )
-        ):
-            msg = "You are not permitted to add a group to this product"
-            raise PermissionDenied(msg)
-
-        if (
-            self.instance is None
-            or data.get("product") != self.instance.product
-            or data.get("group") != self.instance.group
-        ):
-            members = Product_Group.objects.filter(
-                product=data.get("product"), group=data.get("group"),
-            )
-            if members.count() > 0:
-                msg = "Product_Group already exists"
-                raise ValidationError(msg)
-
-        if data.get("role").is_owner and not user_has_permission(
-            self.context["request"].user,
-            data.get("product"),
-            "staff_only",
-        ):
-            msg = "You are not permitted to add a group as Owner to this product"
-            raise PermissionDenied(msg)
-
-        return data
-
-
 class ProductTypeMemberSerializer(serializers.ModelSerializer):
     class Meta:
         model = Product_Type_Member
@@ -1060,47 +831,6 @@ def validate(self, data):
         return data
 
 
-class ProductTypeGroupSerializer(serializers.ModelSerializer):
-    class Meta:
-        model = Product_Type_Group
-        fields = "__all__"
-
-    def validate(self, data):
-        if (
-            self.instance is not None
-            and data.get("product_type") != self.instance.product_type
-            and not user_has_permission(
-                self.context["request"].user,
-                data.get("product_type"),
-                "add",
-            )
-        ):
-            msg = "You are not permitted to add a group to this product type"
-            raise PermissionDenied(msg)
-
-        if (
-            self.instance is None
-            or data.get("product_type") != self.instance.product_type
-            or data.get("group") != self.instance.group
-        ):
-            members = Product_Type_Group.objects.filter(
-                product_type=data.get("product_type"), group=data.get("group"),
-            )
-            if members.count() > 0:
-                msg = "Product_Type_Group already exists"
-                raise ValidationError(msg)
-
-        if data.get("role").is_owner and not user_has_permission(
-            self.context["request"].user,
-            data.get("product_type"),
-            "staff_only",
-        ):
-            msg = "You are not permitted to add a group as Owner to this product type"
-            raise PermissionDenied(msg)
-
-        return data
-
-
 class ProductTypeSerializer(serializers.ModelSerializer):
     class Meta:
         model = Product_Type
@@ -3089,8 +2819,6 @@ def validate(self, data):
 class UserProfileSerializer(serializers.Serializer):
     user = UserSerializer(many=False)
     user_contact_info = UserContactInfoSerializer(many=False, required=False)
-    global_role = GlobalRoleSerializer(many=False, required=False)
-    dojo_group_member = DojoGroupMemberSerializer(many=True)
     product_type_member = ProductTypeMemberSerializer(many=True)
     product_member = ProductMemberSerializer(many=True)