akvo / akvo-mis / #870

89%

main: 89%

Pull #320

coveralls-python

[#306] Expose the dashboard accesses on each role

The web client builds its CASL ability by reading can_* booleans off
every role in the profile payload. VIZ-004, already on
epic/dashboard-visualization, reads can_dashboard_view, _create, _edit
and _delete that way. Nothing produced them, so each resolved to
undefined, the Dashboards menu never rendered for a non-superuser, and
no dashboard ability was ever granted.

Add the five UserRole.can_dashboard_* methods mirroring the
can_form_builder block, and list them on UserRoleListSerializer. The
method names are the API contract the client depends on, not internal
helpers, which is why they are spelled out rather than generated.

All five ship, including can_dashboard_publish, which no client reads
yet. The alternative was a role block asymmetric with the form-builder
one for the sake of a single method.

These were deliberately left out when this branch targeted main, where
nothing read them. Retargeting to the epic made that judgement wrong:
the consumer was merged there in #318.

Five near-identical methods invite a copy-paste slip that would grant
the wrong access silently, so the test grants exactly one access at a
time and asserts the other four stay False.

The profile field-list assertion in tests_user_profile is updated in
step, since it pins the serialized shape.

6130 of 7056 branches covered (86.88%)

Branch coverage included in aggregate %.

11708 of 12877 relevant lines covered (90.92%)

0.91 hits per line