Feature organization model by nairaj2 · Pull Request #6080 · learningequality/studio

nairaj2 · 2026-08-04T14:02:47Z

Summary

Adds backend API and controller support for the Organization and OrganizationRole models.

This change provides:

Organization create, read, update, and delete operations
Organization membership listing
Organization role updates
Permission checks for organization admins, editors, and viewers
Pagination and filtering for organization-related endpoints
Automated API tests covering organization management, membership management, role updates, and permission enforcement

Organization administrators can manage organization settings, memberships, and roles. Editors can view memberships but cannot manage organization settings, memberships, or roles. Viewers have read-only access to organization resources.

Frontend changes and data model changes are outside the scope of this PR.

…

References

References
Closes #5967
Builds on #5962

…

Reviewer guidance

Run the organization API tests with:

pytest -q contentcuration/contentcuration/tests/test_organization.py

Reviewers can verify that:

Authenticated users can create organizations
The organization creator is assigned the administrator role
Users can only access organizations permitted by their membership and role
Only organization administrators can update organization settings
Organization members can list memberships
Only organization administrators can update or remove memberships and roles
Editors and viewers cannot manage organization membership or roles
Organization and membership endpoints support pagination and filtering
Unauthorized requests are rejected appropriately

This PR does not include frontend changes.
…

AI usage

Used AI to help review the existing Studio API patterns and draft portions of the organization viewsets and tests.

I reviewed and edited the generated code to align it with Studio's ValuesViewset, serializer, routing, pagination, and permission conventions. I also ran the organization tests locally and used the failures to correct routing, response formatting, authentication expectations, and role-permission behavior.

learning-equality-bot · 2026-08-04T14:03:30Z

👋 Hi @nairaj2, thanks for contributing!

For the review process to begin, please verify that the following is satisfied:

Contribution is aligned with our contributing guidelines
Pull request description has correctly filled AI usage section & follows our AI guidance:
AI guidance

State explicitly whether you didn't use or used AI & how.

If you used it, ensure that the PR is aligned with Using AI as well as our DEEP framework. DEEP asks you:
- Disclose — Be open about when you've used AI for support.
- Engage critically — Question what is generated. Review code for correctness and unnecessary complexity.
- Edit — Review and refine AI output. Remove unnecessary code and verify it still works after your edits.
- Process sharing — Explain how you used the AI so others can learn.
Examples of good disclosures:

"I used Claude Code to implement the component, prompting it to follow the pattern in ComponentX. I reviewed the generated code, removed unnecessary error handling, and verified the tests pass."

"I brainstormed the approach with Gemini, then had it write failing tests for the feature. After reviewing the tests, I used Claude Code to generate the implementation. I refactored the output to reduce verbosity and ran the full test suite."

Also check that issue requirements are satisfied & you ran pre-commit locally.

Pull requests that don't follow the guidelines will be closed.

Reviewer assignment can take up to 2 weeks.

rtibblesbot · 2026-08-04T18:17:00Z

🔵 Review posted

Last updated: 2026-08-04 18:38 UTC

learning-equality-bot · 2026-08-04T18:17:01Z

📢✨ Before we assign a reviewer, we'll turn on @rtibblesbot to pre-review. Its comments are generated by an LLM, and should be evaluated accordingly.

rtibblesbot

PR #6080 — blockers inline; newest commits unreviewed.

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

Ran a phased review pipeline over the pull request diff:

Classified the diff to select review passes (core, frontend, backend) and whether manual QA was required
Core review pass checked correctness, design, architecture, testing, completeness, and DRY/SRP/Rule-of-Three principles
Specialized frontend/backend review passes applied framework-specific lenses where those files changed
For UI changes: manual QA and an accessibility audit against a live dev server, when available
Checked CI status and linked issue acceptance criteria
Synthesized one review from those passes and chose the verdict from the findings, CI status, and QA evidence

rtibblesbot · 2026-08-04T18:37:52Z

+class OrganizationMemberSerializer(BulkModelSerializer):
+    """
+    Write serializer for updating OrganizationRole membership records.
+


blocking: no create route; Invitation.accept() (models.py:3738) is channel-only. Sole OrganizationRole writer: perform_create (179). #5967 membership/roles unmet.

rtibblesbot · 2026-08-04T18:37:52Z

+def _is_site_admin(user):
+    return bool(getattr(user, "is_admin", False))
+
+


blocking: Channel.filter_edit_queryset/filter_view_queryset (models.py:1216, 1235) ignore OrganizationRole — no Channel.organization access (#5967). Add Exists(OrganizationRole).

rtibblesbot · 2026-08-04T18:37:52Z

+from rest_framework import serializers
+from rest_framework.exceptions import PermissionDenied
+from rest_framework.exceptions import ValidationError
+from rest_framework.permissions import IsAuthenticated


blocking: pre-commit fails on head (reorder-python-imports, black); Linting job fails.

rtibblesbot · 2026-08-04T18:37:52Z

+
+
+class OrganizationMemberFilter(FilterSet):
+    organization = CharFilter(field_name="organization_id")


blocking: User.id is an integer PK; ?user=abc → 500 (reproduced). Use NumberFilter, UUIDFilter.

rtibblesbot · 2026-08-04T18:37:53Z

+            raise ValidationError(
+                "An organization must have at least one active admin."
+            )
+


blocking: serialize_object() re-reads get_queryset() (251, active-only): self-deactivation commits, then 404s (reproduced).

rtibblesbot · 2026-08-04T18:37:53Z

+        "created_at",
+        "updated_at",
+    )
+


suggestion: model-level filter_view_queryset/filter_edit_queryset (base.py:585-599); repeated at 162, 274, 293; _require_admin unreachable.

rtibblesbot · 2026-08-04T18:37:53Z

+
+    def perform_update(self, serializer):
+        with transaction.atomic():
+            membership = (


suggestion: select_for_update(of=("self",)); lock order against 334 deadlocks.

rtibblesbot · 2026-08-04T18:37:53Z

+
+
+class OrganizationAPITestCase(BaseAPITestCase):
+    """Shared organization API fixtures and URL helpers."""


suggestion: convention: tests/viewsets/ + StudioAPITestCase. BaseAPITestCase.setUp adds an unused channel tree.

rtibblesbot · 2026-08-04T18:37:53Z

+            raise PermissionDenied(
+                "Only active organization admins may manage membership."
+            )
+


praise: covers demotion, deactivation, deletion; locked in-transaction; tested.

nairaj2 added 9 commits July 13, 2026 21:37

feat: Added organization API layer

32edb66

Feat: Edited the org model

f788782

Feat: Added first name and last name

24138b0

Remove direct organization membership creation

c509082

Feat: added tests

7bea2e6

Feat: fixed tests

05260f0

Feat: Fixed tests

0a942d2

Feat: Fixed tests

6a488b5

Feat: Fixed tests

3639f87

rtibbles requested a review from rtibblesbot August 4, 2026 18:16

[pre-commit.ci lite] apply automatic fixes

bfe04de

rtibblesbot reviewed Aug 4, 2026

View reviewed changes

		def _is_site_admin(user):
		return bool(getattr(user, "is_admin", False))



		class OrganizationMemberFilter(FilterSet):
		organization = CharFilter(field_name="organization_id")



		class OrganizationAPITestCase(BaseAPITestCase):
		"""Shared organization API fixtures and URL helpers."""

Uh oh!

Uh oh!

Conversation

nairaj2 commented Aug 4, 2026

Summary

References

Reviewer guidance

AI usage

Uh oh!

learning-equality-bot Bot commented Aug 4, 2026

Uh oh!

rtibblesbot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔵 Review posted

Uh oh!

learning-equality-bot Bot commented Aug 4, 2026

Uh oh!

rtibblesbot left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

rtibblesbot commented Aug 4, 2026 •

edited

Loading