Skip to content

Comments

Enable admin site in Kesäseteli and add utilities to automatically manage admin user group#3830

Merged
nikomakela merged 5 commits intomainfrom
YJDH-733-admin-ad-login
Jan 15, 2026
Merged

Enable admin site in Kesäseteli and add utilities to automatically manage admin user group#3830
nikomakela merged 5 commits intomainfrom
YJDH-733-admin-ad-login

Conversation

@nikomakela
Copy link
Contributor

@nikomakela nikomakela commented Dec 31, 2025 •
edited
Loading

YJDH-733.

  • Refactored HelsinkiOAuth2CallbackView to be context-aware regarding redirect destinations.
  • The admin site ADFS-login needs a handler for next-parameter that defines where to redirect after a successful authentication.
  • Add a new app to Kesäseteli: "Staff Admin Permissions".

Staff Admin Permissions

The main goals are:

  1. To ensure the admins group is created during the post_migrate process in all environments.
  2. To maintain full CRUD (Create, Read, Update, Delete) permissions for all models registered in the Django Admin in local development.
  3. To automatically assign this group to new staff users (e.g., mock users) during local development to avoid manual configuration.

Signals:

  • Connect signal to ensure 'admins' group exists after migration
    • Ensure the 'admins' group exists after migration. This does NOT assign permissions, only creates the empty group if missing.
  • Connect signal to assign admin group to new staff users.
    • Assign the admin group to newly created staff users ONLY if settings.AUTO_ASSIGN_ADMIN_TO_STAFF is True. If env variable is unset, the setting is True by default if DEBUG and NEXT_PUBLIC_MOCK_FLAG are True.

How to apply and test changes:

  1. Run python manage.py migrate to create admin group
  2. Run python manage.py setup_admin_permissions to set permissions to admin group
  3. Set settings.AUTO_ASSIGN_ADMIN_TO_STAFF to True.
  4. Use ADFS login button in admin site login screen

@terovirtanen
Copy link
Contributor

terovirtanen commented Dec 31, 2025

YJDH-KESASETELI-API branch is deployed to platta: https://yjdh-kesaseteli-pr3830.api.dev.hel.ninja 🚀🚀🚀

@terovirtanen
Copy link
Contributor

terovirtanen commented Dec 31, 2025

YOUTH branch is deployed to platta: https://nuortenkesaseteli-pr3830.dev.hel.ninja 🚀🚀🚀

@terovirtanen
Copy link
Contributor

terovirtanen commented Dec 31, 2025

YJDH-HELSINKILISA-API branch is deployed to platta: https://helsinkilisa-pr3830.api.dev.hel.ninja 🚀🚀🚀

@terovirtanen
Copy link
Contributor

terovirtanen commented Dec 31, 2025

EMPLOYER branch is deployed to platta: https://kesaseteli-pr3830.dev.hel.ninja 🚀🚀🚀

@terovirtanen
Copy link
Contributor

terovirtanen commented Dec 31, 2025

HANDLER branch is deployed to platta: https://kesaseteli-handler-ui-pr3830.dev.hel.ninja 🚀🚀🚀

@terovirtanen
Copy link
Contributor

terovirtanen commented Dec 31, 2025

TestCafe result is success for https://nuortenkesaseteli-pr3830.dev.hel.ninja 😆🎉🎉🎉

@terovirtanen
Copy link
Contributor

terovirtanen commented Dec 31, 2025

TestCafe result is success for https://kesaseteli-handler-ui-pr3830.dev.hel.ninja 😆🎉🎉🎉

@terovirtanen
Copy link
Contributor

terovirtanen commented Dec 31, 2025

HANDLER branch is deployed to platta: https://helsinkilisa-ui-handler-pr3830.dev.hel.ninja 🚀🚀🚀

@terovirtanen
Copy link
Contributor

terovirtanen commented Dec 31, 2025

APPLICANT is deployed to platta: https://helsinkilisa-ui-pr3830.dev.hel.ninja 🚀🚀🚀

@terovirtanen
Copy link
Contributor

terovirtanen commented Dec 31, 2025

TestCafe result is success for https://kesaseteli-pr3830.dev.hel.ninja 😆🎉🎉🎉

@terovirtanen
Copy link
Contributor

terovirtanen commented Dec 31, 2025

TestCafe result is success for https://helsinkilisa-ui-pr3830.dev.hel.ninja 😆🎉🎉🎉

@terovirtanen
Copy link
Contributor

terovirtanen commented Dec 31, 2025

TestCafe result is success for https://helsinkilisa-ui-handler-pr3830.dev.hel.ninja 😆🎉🎉🎉

@nikomakela nikomakela force-pushed the YJDH-733-admin-ad-login branch from 6353f18 to 3e13b26 Compare December 31, 2025 10:47
@terovirtanen
Copy link
Contributor

terovirtanen commented Dec 31, 2025

YJDH-KESASETELI-API branch is deployed to platta: https://yjdh-kesaseteli-pr3830.api.dev.hel.ninja 🚀🚀🚀

@terovirtanen
Copy link
Contributor

terovirtanen commented Dec 31, 2025

YOUTH branch is deployed to platta: https://nuortenkesaseteli-pr3830.dev.hel.ninja 🚀🚀🚀

@terovirtanen
Copy link
Contributor

terovirtanen commented Dec 31, 2025

YJDH-HELSINKILISA-API branch is deployed to platta: https://helsinkilisa-pr3830.api.dev.hel.ninja 🚀🚀🚀

@terovirtanen
Copy link
Contributor

terovirtanen commented Dec 31, 2025

HANDLER branch is deployed to platta: https://kesaseteli-handler-ui-pr3830.dev.hel.ninja 🚀🚀🚀

@terovirtanen
Copy link
Contributor

terovirtanen commented Dec 31, 2025

EMPLOYER branch is deployed to platta: https://kesaseteli-pr3830.dev.hel.ninja 🚀🚀🚀

@terovirtanen
Copy link
Contributor

terovirtanen commented Dec 31, 2025

TestCafe result is success for https://nuortenkesaseteli-pr3830.dev.hel.ninja 😆🎉🎉🎉

@terovirtanen
Copy link
Contributor

terovirtanen commented Dec 31, 2025

TestCafe result is success for https://kesaseteli-handler-ui-pr3830.dev.hel.ninja 😆🎉🎉🎉

@terovirtanen
Copy link
Contributor

terovirtanen commented Dec 31, 2025

APPLICANT is deployed to platta: https://helsinkilisa-ui-pr3830.dev.hel.ninja 🚀🚀🚀

@terovirtanen
Copy link
Contributor

terovirtanen commented Dec 31, 2025

HANDLER branch is deployed to platta: https://helsinkilisa-ui-handler-pr3830.dev.hel.ninja 🚀🚀🚀

@terovirtanen
Copy link
Contributor

terovirtanen commented Dec 31, 2025

TestCafe result is success for https://kesaseteli-pr3830.dev.hel.ninja 😆🎉🎉🎉

@terovirtanen
Copy link
Contributor

terovirtanen commented Dec 31, 2025

TestCafe result is success for https://helsinkilisa-ui-pr3830.dev.hel.ninja 😆🎉🎉🎉

@terovirtanen
Copy link
Contributor

terovirtanen commented Dec 31, 2025

TestCafe result is success for https://helsinkilisa-ui-handler-pr3830.dev.hel.ninja 😆🎉🎉🎉

@nikomakela nikomakela force-pushed the YJDH-733-admin-ad-login branch from 3e13b26 to 45bedf4 Compare December 31, 2025 12:46
@terovirtanen
Copy link
Contributor

terovirtanen commented Dec 31, 2025

YJDH-KESASETELI-API branch is deployed to platta: https://yjdh-kesaseteli-pr3830.api.dev.hel.ninja 🚀🚀🚀

@nikomakela nikomakela force-pushed the YJDH-733-admin-ad-login branch from 45bedf4 to a9f9efa Compare December 31, 2025 12:56
@terovirtanen
Copy link
Contributor

terovirtanen commented Dec 31, 2025

YJDH-KESASETELI-API branch is deployed to platta: https://yjdh-kesaseteli-pr3830.api.dev.hel.ninja 🚀🚀🚀

@terovirtanen
Copy link
Contributor

terovirtanen commented Dec 31, 2025

YJDH-HELSINKILISA-API branch is deployed to platta: https://helsinkilisa-pr3830.api.dev.hel.ninja 🚀🚀🚀

@azure-pipelines
Copy link

azure-pipelines bot commented Jan 8, 2026

TestCafe result is success for https://nuortenkesaseteli-pr3830.dev.hel.ninja 😆🎉🎉🎉

@azure-pipelines
Copy link

azure-pipelines bot commented Jan 8, 2026

HANDLER branch is deployed to platta: https://kesaseteli-handler-ui-pr3830.dev.hel.ninja 🚀🚀🚀

@azure-pipelines
Copy link

azure-pipelines bot commented Jan 8, 2026

APPLICANT is deployed to platta: https://helsinkilisa-ui-pr3830.dev.hel.ninja 🚀🚀🚀

@azure-pipelines
Copy link

azure-pipelines bot commented Jan 8, 2026

TestCafe result is success for https://kesaseteli-pr3830.dev.hel.ninja 😆🎉🎉🎉

@azure-pipelines
Copy link

azure-pipelines bot commented Jan 8, 2026

TestCafe result is success for https://kesaseteli-handler-ui-pr3830.dev.hel.ninja 😆🎉🎉🎉

@azure-pipelines
Copy link

azure-pipelines bot commented Jan 8, 2026

TestCafe result is success for https://helsinkilisa-ui-pr3830.dev.hel.ninja 😆🎉🎉🎉

@azure-pipelines
Copy link

azure-pipelines bot commented Jan 8, 2026

TestCafe result is success for https://helsinkilisa-ui-handler-pr3830.dev.hel.ninja 😆🎉🎉🎉

@nikomakela nikomakela force-pushed the YJDH-733-admin-ad-login branch from a89ba90 to 20c7e6a Compare January 13, 2026 13:58
@azure-pipelines
Copy link

azure-pipelines bot commented Jan 13, 2026

YJDH-KESASETELI-API branch is deployed to platta: https://yjdh-kesaseteli-pr3830.api.dev.hel.ninja 🚀🚀🚀

@nikomakela
feat(shared,auth): preserve deep links and admin redirects in ADFS
b900b01 
YJDH-733.

Refactored HelsinkiOAuth2CallbackView to be context-aware regarding
redirect destinations.

Previously, the view forcibly redirected all successful logins to
ADFS_LOGIN_REDIRECT_URL. This hijacked intentional destinations,
such as Django Admin deep links or specific application sub-pages.

Changes:
- Replaced manual 'next' parameter parsing with reliance on the
  library's internal 'state' decoding.
- Added logic to honor redirects if the destination is the Admin
  site or a specific deep link.
- Maintained the fallback to ADFS_LOGIN_REDIRECT_URL for generic
  logins (e.g., from the home page).
- Cleaned up error handling and MFA redirect detection.
@nikomakela
feat(kesaseteli,admin): tools for semi automated admin management
d5c5099 
YJDH-733.

Added a new app to project: "Staff Admin Permissions".

This app provides utilities to automatically manage an "admins" user
group and simplify permission setup for staff users in **development
environments**.

The main goals are:
1.  To ensure the `admins` group is created during the `post_migrate`
process in all environments.
2.  To maintain full CRUD (Create, Read, Update, Delete) permissions for
all models registered in the Django Admin in local development.
3.  To automatically assign this group to new staff users (e.g., mock
users) during local development to avoid manual configuration.
@nikomakela nikomakela force-pushed the YJDH-733-admin-ad-login branch from 20c7e6a to d5c5099 Compare January 13, 2026 14:15
@sonarqubecloud
Copy link

sonarqubecloud bot commented Jan 13, 2026

Quality Gate Failed Quality Gate failed for 'yjdh'

Failed conditions
2 Security Hotspots

See analysis details on SonarQube Cloud

@sonarqubecloud
Copy link

sonarqubecloud bot commented Jan 13, 2026

Quality Gate Passed Quality Gate passed for 'yjdh'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@azure-pipelines
Copy link

azure-pipelines bot commented Jan 13, 2026

YJDH-KESASETELI-API branch is deployed to platta: https://yjdh-kesaseteli-pr3830.api.dev.hel.ninja 🚀🚀🚀

@azure-pipelines
Copy link

azure-pipelines bot commented Jan 13, 2026

YOUTH branch is deployed to platta: https://nuortenkesaseteli-pr3830.dev.hel.ninja 🚀🚀🚀

@azure-pipelines
Copy link

azure-pipelines bot commented Jan 13, 2026

HANDLER branch is deployed to platta: https://kesaseteli-handler-ui-pr3830.dev.hel.ninja 🚀🚀🚀

@azure-pipelines
Copy link

azure-pipelines bot commented Jan 13, 2026

TestCafe result is success for https://nuortenkesaseteli-pr3830.dev.hel.ninja 😆🎉🎉🎉

@azure-pipelines
Copy link

azure-pipelines bot commented Jan 13, 2026

HANDLER branch is deployed to platta: https://helsinkilisa-ui-handler-pr3830.dev.hel.ninja 🚀🚀🚀

@azure-pipelines
Copy link

azure-pipelines bot commented Jan 13, 2026

TestCafe result is success for https://kesaseteli-handler-ui-pr3830.dev.hel.ninja 😆🎉🎉🎉

@azure-pipelines
Copy link

azure-pipelines bot commented Jan 13, 2026

EMPLOYER branch is deployed to platta: https://kesaseteli-pr3830.dev.hel.ninja 🚀🚀🚀

@azure-pipelines
Copy link

azure-pipelines bot commented Jan 13, 2026

YJDH-HELSINKILISA-API branch is deployed to platta: https://helsinkilisa-pr3830.api.dev.hel.ninja 🚀🚀🚀

@azure-pipelines
Copy link

azure-pipelines bot commented Jan 13, 2026

APPLICANT is deployed to platta: https://helsinkilisa-ui-pr3830.dev.hel.ninja 🚀🚀🚀

@azure-pipelines
Copy link

azure-pipelines bot commented Jan 13, 2026

TestCafe result is success for https://kesaseteli-pr3830.dev.hel.ninja 😆🎉🎉🎉

@azure-pipelines
Copy link

azure-pipelines bot commented Jan 13, 2026

TestCafe result is success for https://helsinkilisa-ui-handler-pr3830.dev.hel.ninja 😆🎉🎉🎉

@azure-pipelines
Copy link

azure-pipelines bot commented Jan 13, 2026

TestCafe result is success for https://helsinkilisa-ui-pr3830.dev.hel.ninja 😆🎉🎉🎉

charn
charn approved these changes Jan 15, 2026
View reviewed changes
Copy link
Contributor

@charn charn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! 👍 :shipit:

@nikomakela nikomakela merged commit a861f35 into main Jan 15, 2026
130 checks passed
@nikomakela nikomakela deleted the YJDH-733-admin-ad-login branch January 15, 2026 12:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@charn charn charn approved these changes

@karisal-anders karisal-anders karisal-anders approved these changes

@ext-hjasplund ext-hjasplund Awaiting requested review from ext-hjasplund

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@nikomakela @terovirtanen @charn @karisal-anders