merge

.idea/Rasaddam_Backend.iml

@@ -14,7 +14,7 @@
   </component>
   <component name="NewModuleRootManager">
     <content url="file://$MODULE_DIR$" />
-    <orderEntry type="jdk" jdkName="Python 3.10 (env)" jdkType="Python SDK" />
+    <orderEntry type="jdk" jdkName="Python 3.10 (bazrasienv)" jdkType="Python SDK" />
     <orderEntry type="sourceFolder" forTests="false" />
   </component>
   <component name="PyDocumentationSettings">

.idea/misc.xml

@@ -1,4 +1,4 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <project version="4">
-  <component name="ProjectRootManager" version="2" project-jdk-name="Python 3.10 (env)" project-jdk-type="Python SDK" />
+  <component name="ProjectRootManager" version="2" project-jdk-name="Python 3.10 (bazrasienv)" project-jdk-type="Python SDK" />
 </project>

apps/authorization/api/v1/serializers.py

@@ -8,7 +8,6 @@ from apps.authorization.models import (
     Page
 )
 from apps.authentication.api.v1.serializers import serializer as auth_serializer
-from apps.authentication.models import Organization
 import itertools
 
 
@@ -146,9 +145,16 @@ class UserRelationSerializer(serializers.ModelSerializer):
     def update(self, instance, validated_data):
         """ update user relation object """
 
-        instance.role = validated_data.get('role', instance.role)
+        # if role of user changed, clear all permissions and set new role permissions for user
+        if not instance.role == validated_data.get('role', instance.role):
+            instance.role = validated_data.get('role', instance.role)
+            instance.permissions.clear()
+            instance.permissions.add(*instance.role.permissions.all())
+
         instance.organization = validated_data.get('organization', instance.organization)
         instance.save()
-        instance.permissions.clear()
-        instance.permissions.add(*(validated_data.get('permissions', instance.permissions)))
+
+        if validated_data.get('permissions'):
+            instance.permissions.clear()
+            instance.permissions.add(*(validated_data.get('permissions', instance.permissions)))
         return instance