🐛 [#738] use local objecttypes endpoint in permission form

.github/workflows/ci.yml

@@ -59,12 +59,13 @@ jobs:
         with:
           apt-packages: 'gdal-bin'
           python-version: '3.12'
-          setup-node: true
+          setup-node:  'yes'
 
-      - name: Run tests
+      - name: Run Django tests (without Playwright)
         run: |
+          rm -rf static
           python src/manage.py collectstatic --noinput --link
-          coverage run src/manage.py test src
+          coverage run src/manage.py test src --exclude-tag=playwright
         env:
           DJANGO_SETTINGS_MODULE: objects.conf.ci
           DEBUG: 'true'
@@ -76,6 +77,23 @@ jobs:
           CELERY_BROKER_URL: 'redis://localhost:6379/0'
           CELERY_ONCE_REDIS_URL: 'redis://localhost:6379/0'
 
+      - name: Install Playwright browsers
+        if: ${{ matrix.postgres == '17' && matrix.postgis == '3.5' && matrix.use_pooling == false }}
+        run: playwright install --with-deps chromium
+
+      - name: Run Playwright tests
+        if: ${{ matrix.postgres == '17' && matrix.postgis == '3.5' && matrix.use_pooling == false }}
+        run: coverage run -a src/manage.py test src --tag=playwright
+        env:
+          DJANGO_SETTINGS_MODULE: objects.conf.ci
+          DEBUG: 'true'
+          SECRET_KEY: dummy
+          DB_USER: postgres
+          DB_PASSWORD: ''
+          DB_POOL_ENABLED: ${{ matrix.use_pooling }}
+          CELERY_BROKER_URL: 'redis://localhost:6379/0'
+          CELERY_ONCE_REDIS_URL: 'redis://localhost:6379/0'
+
       - name: Publish coverage report
         uses: codecov/codecov-action@v4
         with:

pyproject.toml

@@ -157,4 +157,7 @@ line-ending = "lf"
 [tool.coverage.run]
 branch = true
 source = ["src"]
-omit = ["*/test_*.py"]
+omit = [
+    "*/test_*.py",
+    "src/objects/tests/playwright.py",
+]

requirements/ci.txt

@@ -408,6 +408,8 @@ googleapis-common-protos==1.72.0
     #   -r requirements/base.txt
     #   opentelemetry-exporter-otlp-proto-grpc
     #   opentelemetry-exporter-otlp-proto-http
+greenlet==3.3.2
+    # via playwright
 grpcio==1.74.0
     # via
     #   -c requirements/base.txt
@@ -596,6 +598,8 @@ phonenumberslite==8.13.30
     #   -c requirements/base.txt
     #   -r requirements/base.txt
     #   django-two-factor-auth
+playwright==1.58.0
+    # via -r requirements/test-tools.in
 pluggy==1.5.0
     # via pytest
 prometheus-client==0.20.0
@@ -651,6 +655,8 @@ pydantic-settings==2.6.1
     #   -c requirements/base.txt
     #   -r requirements/base.txt
     #   django-setup-configuration
+pyee==13.0.1
+    # via playwright
 pygments==2.18.0
     # via
     #   sphinx
@@ -852,6 +858,7 @@ typing-extensions==4.9.0
     #   psycopg-pool
     #   pydantic
     #   pydantic-core
+    #   pyee
     #   pyopenssl
     #   zgw-consumers
 tzdata==2025.2

requirements/dev.txt

@@ -466,6 +466,11 @@ googleapis-common-protos==1.72.0
     #   opentelemetry-exporter-otlp-proto-http
 gprof2dot==2024.6.6
     # via django-silk
+greenlet==3.3.2
+    # via
+    #   -c requirements/ci.txt
+    #   -r requirements/ci.txt
+    #   playwright
 grpcio==1.74.0
     # via
     #   -c requirements/ci.txt
@@ -696,6 +701,10 @@ pip-tools==7.4.1
     # via -r requirements/dev.in
 platformdirs==4.3.8
     # via virtualenv
+playwright==1.58.0
+    # via
+    #   -c requirements/ci.txt
+    #   -r requirements/ci.txt
 pluggy==1.5.0
     # via
     #   -c requirements/ci.txt
@@ -764,6 +773,11 @@ pydantic-settings==2.6.1
     #   -r requirements/ci.txt
     #   bump-my-version
     #   django-setup-configuration
+pyee==13.0.1
+    # via
+    #   -c requirements/ci.txt
+    #   -r requirements/ci.txt
+    #   playwright
 pygments==2.18.0
     # via
     #   -c requirements/ci.txt
@@ -1040,6 +1054,7 @@ typing-extensions==4.9.0
     #   psycopg-pool
     #   pydantic
     #   pydantic-core
+    #   pyee
     #   pyopenssl
     #   rich-click
     #   zgw-consumers

requirements/test-tools.in

@@ -16,3 +16,7 @@ vcrpy
 
 # Code formatting
 ruff
+
+
+# user interface testing
+playwright

src/objects/api/v2/openapi.yaml

@@ -850,7 +850,7 @@
                 $ref: '#/components/schemas/PaginatedObjectList'
           description: OK
   /objecttypes:
     get:
       operationId: objecttype_list
       parameters:
       - in: query
@@ -899,7 +899,7 @@
               schema:
                 $ref: '#/components/schemas/PaginatedObjectTypeList'
           description: OK
     post:
       operationId: objecttype_create
       parameters:
       - in: header
@@ -961,6 +961,7 @@
       tags:
       - objecttypes
       security:
+      - cookieAuth: []
       - tokenAuth: []
       responses:
         '200':
@@ -1039,6 +1040,7 @@
       tags:
       - objecttypes
       security:
+      - cookieAuth: []
       - tokenAuth: []
       responses:
         '200':
@@ -1184,7 +1186,7 @@
                 een specifieke aanroep. Voorbeeld: 1.2.1.'
           description: No response body
   /objecttypes/{uuid}:
     get:
       operationId: objecttype_read
       parameters:
       - in: path
@@ -1211,7 +1213,7 @@
               schema:
                 $ref: '#/components/schemas/ObjectType'
           description: OK
     put:
       operationId: objecttype_update
       parameters:
       - in: header
@@ -1252,7 +1254,7 @@
               schema:
                 $ref: '#/components/schemas/ObjectType'
           description: OK
     patch:
       operationId: objecttype_partial_update
       parameters:
       - in: header
@@ -1292,7 +1294,7 @@
               schema:
                 $ref: '#/components/schemas/ObjectType'
           description: OK
     delete:
       operationId: objecttype_delete
       parameters:
       - in: path
@@ -1376,7 +1378,7 @@
         * `intern` - Intern
         * `confidential` - Confidential
         * `strictly_confidential` - Strictly confidential
     GeoJSONGeometry:
       title: GeoJSONGeometry
       type: object
       oneOf:
@@ -2266,13 +2268,17 @@
         * `yearly` - Yearly
         * `unknown` - Unknown
   securitySchemes:
+    cookieAuth:
+      type: apiKey
+      in: cookie
+      name: objects_sessionid
     tokenAuth:
       type: apiKey
       in: header
       name: Authorization
       description: Token-based authentication with required prefix "Token"
 servers:
 - url: /api/v2
 tags:
 - name: objects
 - name: objecttypes

src/objects/api/v2/views.py

@@ -17,9 +17,11 @@
 )
 from notifications_api_common.cloudevents import process_cloudevent
 from rest_framework import mixins, serializers, status, viewsets
+from rest_framework.authentication import SessionAuthentication
 from rest_framework.decorators import action
 from rest_framework.exceptions import ValidationError
 from rest_framework.generics import get_object_or_404
+from rest_framework.permissions import IsAuthenticated
 from rest_framework.response import Response
 from rest_framework.settings import api_settings
 from vng_api_common.filters_backend import Backend as FilterBackend
@@ -35,6 +37,7 @@
 from objects.cloud_events.tasks import send_zaak_events
 from objects.core.constants import ObjectTypeVersionStatus, ReferenceType
 from objects.core.models import Object, ObjectRecord, ObjectType, ObjectTypeVersion
+from objects.token.authentication import TokenAuthentication
 from objects.token.models import Permission, TokenAuth
 from objects.token.permissions import IsTokenAuthenticated, ObjectTypeBasedPermission
 
@@ -179,7 +182,27 @@ class ObjectTypeVersionViewSet(NestedViewSetMixin, viewsets.ModelViewSet):
     serializer_class = ObjectTypeVersionSerializer
     lookup_field = "version"
     pagination_class = DynamicPageSizePagination
-    permission_classes = [IsTokenAuthenticated]
+
+    def get_authenticators(self):
+        request = getattr(self, "request", None)
+
+        if request and request.method in ("GET", "HEAD", "OPTIONS"):
+            return [
+                SessionAuthentication(),
+                TokenAuthentication(),
+            ]
+
+        return [TokenAuthentication()]
+
+    def get_permissions(self):
+        request = self.request
+
+        if request and request.method in ("GET", "HEAD", "OPTIONS"):
+            permission_class = IsAuthenticated | IsTokenAuthenticated
+        else:
+            permission_class = IsTokenAuthenticated
+
+        return [permission_class()]
 
     def perform_create(self, serializer):
         super().perform_create(serializer)

src/objects/conf/api.py

@@ -6,7 +6,7 @@
     "DEFAULT_PARSER_CLASSES": ["rest_framework.parsers.JSONParser"],
     "DEFAULT_FILTER_BACKENDS": ["vng_api_common.filters_backend.Backend"],
     "DEFAULT_AUTHENTICATION_CLASSES": [
-        "objects.token.authentication.TokenAuthentication"
+        "objects.token.authentication.TokenAuthentication",
     ],
     "DEFAULT_SCHEMA_CLASS": "objects.utils.autoschema.AutoSchema",
     "PAGINATION_CLASS": "vng_api_common.pagination.DynamicPageSizePagination",

src/objects/js/components/admin/permissions/permission-form.js

@@ -17,14 +17,25 @@ const PermissionForm = ({objectFields, tokenChoices, objecttypeChoices, modeChoi
     const [dataFieldChoices, setDataFieldChoices] = useState({});
 
     const fetchObjecttypeVersions = (objecttype_id) => {
-        fetch(`/admin/core/objecttype/${objecttype_id}/_versions/`, {
+        fetch(`/api/v2/objecttypes/${objecttype_id}/versions`, {
             method: 'GET',
+            credentials: 'same-origin',
+            headers: {
+                'Accept': 'application/json',
+            }
+        })
+        .then(response => {
+            if (!response.ok) {
+                throw new Error(`Error ${response.status}: ${response.statusText}`);
+            }
+            return response.json();
         })
-        .then(response => response.json())
         .then(response_data => {
-            if (response_data?.length > 0) {
+            const results = response_data.results || response_data;
+
+            if (Array.isArray(results) && results.length > 0) {
                 const objecttypes = {
-                    [objecttype_id]: response_data.reduce((acc, version) => {
+                    [objecttype_id]: results.reduce((acc, version) => {
                         const properties = Object.keys(version?.jsonSchema?.properties || {});
                         acc[version.version] = properties.reduce((propsAcc, prop) => {
                             propsAcc[prop] = `record__data__${prop}`;
@@ -33,11 +44,12 @@ const PermissionForm = ({objectFields, tokenChoices, objecttypeChoices, modeChoi
                         return acc;
                     }, {})
                 };
-            setDataFieldChoices(objecttypes);
-            }  
+
+                setDataFieldChoices(objecttypes);
+            }
         })
         .catch(error => {
-            console.error('An error occurred while fetching the Objecttype versions endpoint:', error);
+            console.error('An error occurred while fetching the Objecttype versions:', error);
         });
     };
     useEffect(() => {

src/objects/scss/admin/admin_overrides.scss

@@ -1,2 +1,3 @@
 @import "./admin_theme";
 @import "./app_overrides";
+@import "components/all";

src/objects/scss/admin/components/_permission-fields.scss

@@ -1,7 +1,24 @@
 .permission-fields {
-    margin-left: 170px;
-
     &__nested {
         margin-left: 30px;
     }
+
+    .checkbox-row {
+        display: flex;
+        align-items: center;
+        gap: 6px;
+        margin-bottom: 6px;
+    }
+
+    .checkbox-row label {
+        display: inline;
+        width: auto;
+        min-width: 0;
+        padding: 0;
+    }
+
+    h3 {
+        margin-top: 12px;
+        margin-bottom: 6px;
+    }
 }